 |
Notice of Privacy Practices
Authorization
to Disclose Health Information Form
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU
MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY
The Legal Duty of the Plan
The University of the Sciences in Philadelphia (the “Plan”)
is required by applicable federal and state laws to maintain the
privacy of your PHI. We are also required to give each of the participants
in our health benefits plans this notice about our privacy practices,
our legal duties, your rights and the rights of your dependents
concerning PHI. You, and each of your covered dependents, are also
sometimes referred to herein as a “Member.” The Plan
must follow the privacy practices that are described in this notice
while it is in effect.
The Plan reserves the right to change our privacy practices, and
the terms of this notice, at any time, according to applicable law.
Before we make a material change in our privacy practices, we will
change our notice and send the new notice to each of our enrolled
Subscribers at the time of the change. You may request a copy of
our notice at any time. The notice is also available on our web
site, www.usip.edu. For more information about the Plan’s
privacy practices, or to request an additional copy of this notice,
please contact us by using the information listed at the end of
this notice.
PHI
PHI is a special term created by the government. It is defined
as “any information that is created or maintained by the Plan
that relates to the past, present or future physical or mental health
or condition of an individual or the provision of and/or payment
for the provision of health care to an individual and which identifies
the individual, or with which there is a reasonable basis to believe
the information can be used to identify the individual.” PHI
includes information received or maintained in any form, including
oral statements. Examples of PHI are your name, address, Social
Security number, birth date, dates of service, telephone number,
fax number, account number, diagnosis code, and procedure code.
The Plan may receive PHI about you from various sources, such as
from enrollment or other forms, which include your name, address,
Social Security number, birth date, telephone number, health care
provider, other health insurance coverage, and information about
others in your household. The Plan may also receive PHI about you
from outside sources, such as employers, health care providers,
federal and state agencies, or third-party vendors.
Except as described below, unless you specifically authorize the
Plan to do so, the Plan will provide access to your PHI only to
you, your authorized representative, and those persons who need
the information to aid the Plan in the conduct of their business
(“our Business Associates”). You have the right to revoke
an authorization, and we have described how to do so in this notice.
When using or disclosing PHI, the Plan will make every reasonable
effort to limit the use or disclosure of that information to the
minimum extent necessary to accomplish the intended purpose. The
Plan maintains physical, technical and procedural safeguards that
comply with federal law and our Business Associates are limited
by contract to using or disclosing PHI that we provide to them to
only those purposes for which the information was disclosed.
Our Uses and Disclosures of PHI
The Plan is permitted to use and to disclose PHI in order to aid
in your treatment, obtain payment for health care services provided
to you and conduct our own “health care operations.”
Under limited circumstances, we may be able to provide PHI for the
health care operations of other providers and health plans. We may
use your PHI for purposes of treatment, payment and health care
operations without your authorization. At times it will be necessary
for the Plan to share PHI with our Business Associates so that they
may assist us with our health care operations. Specific examples
of the ways in which PHI may be used and disclosed are provided
below. This list is representative only and not every use and disclosure
in a category will be listed.
Treatment: Although the Plan does not engage in
treatment activities, we may disclose your PHI to a doctor or a
hospital that asks us for it to assist them in providing you with
treatment.
Payment: The Plan may use and disclose your PHI
to pay claims from doctors, hospitals and other providers for services
delivered to you that are covered by the Plan.
· Benefits and Claims: The Plan will use
PHI and will disclose this information for billing, claims management
and medical necessity review in order to fulfill our responsibility
to provide coverage and health care benefits as well as to provide
payment for health care services. For example, the Plan may use
information it receives from a health care provider in order to
process a claim. We will then send the Subscriber an Explanation
of Benefits that contains PHI about the care provided to you. The
Plan may also use and disclose PHI for billing and collection activities,
including services provided by an outside billing agent or collection
agency. In addition, we may share PHI with a billing agent who is
assisting a health care provider.
· Enrollment and Eligibility: The Plan receives
PHI including your name, address, Social Security number and birth
date at the time of your enrollment. This “enrollment information”
is used by the Plan to provide coverage for health care benefits
and for eligibility determinations. We may share enrollment information
with the “plan sponsor” of the Plan. Our plan sponsor
is University of the Sciences in Philadelphia.
· Coordination of Benefits, Adjudication, Subrogation:
The Plan and other health plans use and disclose PHI to determine
eligibility for benefits and periods of coverage. For example, if
you are covered under another health plan (e.g., Medicare or a spouse’s
policy) it may be necessary for the Plan to disclose PHI to the
other plans in order to determine eligibility and pay claims correctly
(coordination of benefits). Also, when processing a claim for health
care benefits (adjudication), it may be necessary for the Plan to
request information from, or share information with, a health care
provider. The Plan may also share information with an automobile
carrier or Workers’ Compensation carrier to determine third-party
liability coverage (subrogation).
Health Care Operations: The Plan may use and disclose
your PHI to rate our risk and determine our premiums for the health
benefits it provides to you, to conduct quality assessment and improvement
activities, to engage in care coordination or case management, and
to properly conduct our business.
· Appeals and Complaints: The Plan may
use and disclose PHI to investigate a complaint or process an appeal
by a Member. In order to do so, it may be necessary for us to gather
information or documents, including medical records, that are held
both internally and externally by the Plan or others. We may also
share PHI with an independent medical reviewer to determine medical
necessity and make recommendations to the Plan sponsor for use in
the appeals process.
· Customer Service: We may provide PHI to
a provider, a health care facility, or another health plan that
contacts us with questions regarding your health care coverage,
including questions concerning eligibility, claim status, effective
dates of coverage, or other issues.
· Billing: We receive PHI such as name,
address, Social Security number and birth date at the time of your
enrollment. We may use this information to bill the Subscriber for
the appropriate premiums. The information may also be used to reconcile
billings we receive from our Business Associates for services provided
to you.
· Fraud and Abuse Detection and Compliance Programs:
The Plan may use and disclose PHI for fraud and abuse detection
and in activities required by our compliance program. We may also
share this information with Health Oversight Agencies or other appropriate
entities.
· Health Promotion and Disease Prevention:
The Plan may use PHI to identify and contact you for population-based
activities relating to improving health or reducing health care
costs, such as information about disease management programs or
about health-related benefits and services or about treatment alternatives
that may be of interest to you.
· Litigation or When Required by Law: In
the event that you are involved in a lawsuit or other judicial proceeding,
the Plan may use and disclose PHI in response to a court or administrative
order as provided by law. For example, we may be required to disclose
PHI in response to a subpoena, warrant or other lawful process.
· Quality Improvement: The Plan may use
or disclose PHI to help us evaluate our performance. For example,
we may disclose names and addresses of our Members to a mailing
house for use in mailing customer satisfaction surveys.
· Research and Reporting: The Plan may use
your PHI in order to conduct an analysis of our data. This information
may be shared with internal departments such as auditing or it may
be shared with our Business Associates, such as our actuaries.
· Underwriting: The Plan may use and disclose
PHI for underwriting, premium rating or other activities relating
to the creation, renewal or replacement of contracts for health
insurance.
Other Uses and Disclosures of PHI
To You and with Your Authorization: The Plan must
disclose PHI to you, as described below in the Member’s Rights
section of this notice. You may, subject to the Plan’s policy
for Authorizations, give us written authorization to use PHI or
to disclose your PHI to anyone for any purpose. You may revoke an
Authorization in writing at any time; however, such revocation will
not affect any use or disclosures that were made under the Authorization
while it was in effect. For additional information regarding revocation,
use the contact information found at the end of this notice. Without
a written Authorization, the Plan may not use or disclose PHI for
any reason other than in the performance of treatment, payment,
or health care operations, and except for those purposes described
in this notice.
Health Oversight Activities: The Plan may share
PHI, as provided by law, with Health Oversight Agencies, regulatory
authorities or their appointed designees and reporting agencies.
These agencies include, but are not limited to, the Centers for
Medicare and Medicaid Services.
Business Associates: The Plan may disclose PHI to entities that
perform a wide variety of services on our behalf. For example, we
work with auditors, attorneys, actuaries, consultants, and other
health care plans who act as third-party administrators for the
Plan.
To Individuals Involved in Your Care or Payment for Your
Care: We generally will not disclose PHI to your family
members, close friends or others without your written authorization.
However, under certain circumstances, the Plan may disclose PHI
to such persons. For example, if you appear at the Plan office with
your spouse and ask for PHI, we may ask you if we can provide you
with your PHI in front of your spouse or even infer that it is permissible
because you have brought your spouse with you. However, this verbal
or implied authorization only applies to the particular disclosure
and future disclosures of PHI to family members will require a new
authorization, either written or verbal, depending on the circumstances.
We may also disclose PHI for certain limited purposes to your family
members, close friends or others in cases of a medical emergency
where you are unable to provide authorization.
Disaster Relief: The Plan may use or disclose your
name, location and general condition or death to a public or private
organization authorized by law or by its charter to assist in disaster
relief efforts, such as the American Red Cross.
Plan Sponsor: The Plan may disclose eligibility,
enrollment, and limited disenrollment information to our plan sponsor
in order to permit them to perform their plan administration functions
on behalf of the Plan. We may provide our plan sponsor with complete
information relating to voluntary disenrollment information. We
will limit the information we provide to the plan sponsor relating
to involuntary disenrollment (termination of benefits) to a statement
that the particular Member’s benefits have been terminated
and, if applicable, the fact that a Health Oversight Agency has
been notified.
We may also disclose summary information about you and the participants
enrolled in the Plan to our plan sponsor for them to use to obtain
premium bids for the health insurance coverage we offer and/or to
decide whether to modify, amend or terminate any of the benefits
we currently offer through the Plan. The information we may disclose
will simply summarize the claims history, claims expenses, or types
of claims experienced by the participants in the Plan. The summary
information will be stripped of demographic information (e.g., name
and address) but it is possible that the plan sponsor may be able
to identify information about you or other participants contained
in the summary information. In order to obtain any of the above
information, the plan sponsor will be required to provide assurances
to us that the confidentiality of the information will be protected
and that the information will not be used in any employment-related
decisions. No other information will be shared with the plan sponsor
without your Authorization, executed according to the Plan’s
Authorization policy.
Public Health and Communicable Disease Reporting: The Plan
may disclose your PHI to a public health authority who is permitted
by law to collect or receive the information. Our reporting may
be made in order to prevent or control disease, injury or disability,
report child abuse or neglect, notify a person who may have been
exposed to a disease or may be at risk for contracting a disease
or condition or notifying the appropriate government authority if
we believe a Member has been the victim of abuse, neglect or domestic
violence, to name a few.
Research, Death, Organ Donation: The Plan may use
or disclose PHI for research purposes, in limited circumstances
and with certain safeguards. We may also disclose the PHI of a deceased
person to a coroner, medical examiner, funeral director, or organ
procurement organization for certain purposes.
Required by Law: For example, the Plan must disclose
your PHI to the U.S. Department of Health and Human Services if
it asks to see it for purposes of determining whether we are in
compliance with federal privacy laws. We may also disclose your
PHI when authorized by Workers’ Compensation or similar laws.
To Law Enforcement and for Public Safety: Under
certain circumstances, we may disclose your PHI for law enforcement
purposes. Examples include: responding to court orders, warrants,
or grand jury subpoenas; providing PHI in response to requests by
law enforcement officials for identification and/or location of
individuals; responding to inquiries by law enforcement relating
to victims of crime; providing information to law enforcement with
respect to crimes occurring on the Plan’s premises. In addition,
under some circumstances, we may disclose your PHI in order to prevent
or lessen a serious and imminent threat to the health or safety
of a person or the public (including providing information to law
enforcement authorities to apprehend a suspect or fugitive or advising
an individual about threats made against them). Finally, we may
disclose your PHI if you are an inmate or other person in lawful
custody and we are requested to do so by an appropriate law enforcement
official or correctional institution.
Military and National Security: Under certain circumstances,
the Plan may disclose the PHI of armed forces personnel to military
authorities. We may also disclose PHI to authorized federal officials
for lawful intelligence, counterintelligence, and other national
security activities.
State Law Impact
To the extent that state law is more restrictive with respect to
our ability to use or disclose your PHI or to the extent that it
affords you greater rights with respect to the control of your PHI,
we will follow state law. This may arise if your PHI contains information
relating to HIV/AIDS, mental health, alcohol and/or substance abuse,
genetic testing, among others.
Member Rights
As a Member of the Plan, you have the following rights regarding
your PHI:
· Right to Inspect and Copy: With limited
exceptions, you have the right to inspect and/or obtain a copy of
your PHI that the Plan maintains in a designated record set. A “designated
record set” consists of all documentation relating to your
enrollment and the Plan’s use of your PHI including, for example,
payment, claims adjudication and case or medical management. You
may request that we provide copies of your PHI to you in a format
other than photocopies, which we will use unless we cannot practicably
do so. You must make a request in writing to obtain access to your
PHI.
The Plan may charge you a reasonable cost-based fee to process and
fulfill your request. If you prefer, you may request that we prepare
a summary or an explanation of your PHI for a fee. Contact us using
the information listed at the end of this notice for a full explanation
of our fee structure. If your request for access is denied, we will
provide a written explanation for the denial and your rights regarding
the denial.
The Plan does not receive or maintain a file of your treatment records.
You have a right to access these records through the treating physician,
facility, or other provider that created and/or maintains the records.
· Right to Amend: You have the right to
request that the Plan amend the PHI that we have created and that
is maintained in our designated record set. Your request must be
in writing, and it must explain why the information should be amended.
The Plan cannot amend demographic information, treatment records
or any other information created by others. If you would like to
amend any of this information, please contact your personnel office
or, to amend your treatment records, you must contact the treating
physician, facility or other provider that created these records.
We may deny your request if: 1) we did not create the information;
2) the information is not part of the designated record set maintained
by the Plan; 3) you do not have access rights to the information;
or 4) we believe the information is accurate and complete.
· Right to an Accounting of Disclosures:
You have the right to receive an accounting of the instances in
which the Plan or our Business Associates have disclosed your PHI.
You may request an accounting of disclosures made over the past
six years or back to April 14, 2003, whichever period is shorter.
Your request for an accounting must be made in writing.
We do not have to provide you with an accounting of certain excepted
disclosures, such as those made for treatment, payment or health
care operations purposes or made in accordance with an authorization,
so these will not appear on the accounting.
· Right to Request Restrictions: You have
the right to request that the Plan place additional restrictions
on the use or disclosure of your PHI for treatment, payment, health
care operations purposes, and for disclosures made to persons involved
in your care. Your request for restrictions must be in writing to
the Privacy Officer.
We are not required to agree to these additional restrictions and
in some cases will be prohibited from agreeing to them, but if we
do agree, we will abide by our agreement (except in an emergency).
Generally, the Plan will not agree to requests for restrictions
on uses and disclosures of PHI for treatment, payment or health
care operations. It is necessary for us to use and disclose PHI
for these purposes in order to provide the benefits that are afforded
to you. If we do agree to a restriction, our agreement will always
be in writing and signed by the Privacy Officer.
· Right to Request Confidential Communications:
You have the right to request that we communicate with you in confidence
about your PHI by using “alternative means” or an “alternative
location” if the disclosure of all or part of that information
to another person could endanger you. We will accommodate such a
request if it is reasonable, if the request specifies the alternative
means or locations, and if it continues to permit the Plan to collect
premiums and pay its claims. To request confidential communication
changes, you must make your request in writing to the Privacy Officer,
and you must clearly state that the information could endanger you
if it is not communicated in confidence as you request.
Right to Receive a Paper Copy of the Notice
If you receive this notice from our web site or by e-mail, you
are entitled to receive this notice in writing. Please contact us
using the information below to obtain this notice in written form.
Questions and Complaints
If you want more information about our privacy practices or have
questions or concerns, please contact us using the information listed
below.
If you are concerned that we may have violated your privacy rights,
or you disagree with a decision we made about access to your PHI,
you must submit your complaint in writing to the Privacy Officer.
You also may submit a written complaint to the U.S. Department of
Health and Human Services (HHS). The Plan supports your right to
protect the privacy of your PHI. We will not retaliate in any way
if you choose to file a complaint with us or with the HHS.
Eileen M. McGovern
HIPAA Privacy Officer
University of the Sciences in Philadelphia
600 South 43rd Street
Philadelphia, PA 19104-4495
Telephone: (215) 596-8771
Fax: (215) 895-1183
E-mail: e.mcgove@usip.edu
Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Telephone: 1-202-619-0257
Toll-Free: 1-877-696-6775
|
|
|
