Health Plan HIPAA Privacy Notice

Section 1: Purpose of This Notice and Effective Date

This Privacy Notice applies to the offices of the Equity-League Health Benefit Fund (the “Fund”), the medical, hospital and prescription drug services that the Fund provides through Cigna (except mail order pharmacy), optical coverage through Davis Vision and services through other business associates of the Fund. The Fund’s HMOs and mail order pharmacy provider will send you a notice of their privacy practices separately.

Effective date: The effective date of this Notice is September 23, 2013.

This Notice is required by law: The Fund is required by law to take reasonable steps to ensure the privacy of your personally identifiable health information and to inform you about:

1. The Fund’s uses and disclosures of Protected Health Information (PHI);
2. Your rights to privacy with respect to your PHI;
3. The Fund’s duties with respect to your PHI;
4. Your right to file a complaint with the Fund and/or with the Secretary of the United States Department of Health and Human Services (HHS); and
5. The person or office you should contact for further information about the Fund’s privacy practices.

Back to top

Section 2: Your Protected Health Information

Protected Health Information (PHI) Defined

The term “Protected Health Information” (PHI) means all individually identifiable health information related to an individual’s past, present or future physical or mental health condition, or to payment for health care services. PHI includes information maintained by the Fund in oral, written, or electronic form.

When the Fund May Disclose Your PHI

Under the law, the Fund may disclose your PHI without your consent or authorization, or without giving you the opportunity to agree or object, in the following cases:

• At your request. If you request it, the Fund is required to give you access to certain of your PHI in order to allow you to inspect and/or copy it.
• When required by applicable law.
• As required by HHS. The Secretary of the United States Department of Health and Human Services may require the disclosure of your PHI to investigate or determine the Fund’s compliance with the privacy regulations.
• Public health purposes. To an authorized public health authority if required by law or for public health and safety purposes. PHI may also be used or disclosed if you have been exposed to a communicable disease or are at risk of spreading a disease or condition, if authorized by law.
• Domestic violence or abuse situations. When authorized by law to report information about abuse, neglect or domestic violence to public authorities if a reasonable belief exists that you may be a victim of abuse, neglect or domestic violence. In such case, the Fund will promptly inform you that such a disclosure has been or will be made unless that notice would cause a risk of serious harm.
• Health oversight activities. To a health oversight agency for oversight activities authorized by law. These activities include civil, administrative or criminal investigations, inspections, licensure or disciplinary actions (for example, to investigate complaints against health care providers) and other activities necessary for appropriate oversight of government benefit programs (for example, to the Department of Labor).
• Legal proceedings. When required for judicial or administrative proceedings. For example, your PHI may be disclosed in response to a subpoena or court-ordered discovery request.
• Law enforcement health purposes. When required for law enforcement purposes (for example, to report certain types of wounds).
• Law enforcement emergency purposes. For certain law enforcement purposes, including:
  • identifying or locating a suspect, fugitive, material witness or missing person, and
  • disclosing information about an individual who is or is suspected to be a victim of a crime.
• Determining cause of death and organ donation. When required to be given to a coroner or medical examiner to identify a deceased person, determine a cause of death or other authorized duties. We may also disclose PHI for cadaveric organ, eye or tissue donation purposes.
• Funeral purposes. When required to be given to funeral directors to carry out their duties with respect to the decedent.
• Research. For research, subject to certain conditions.
• Health or safety threats. When, consistent with applicable law and standards of ethical conduct, the Fund in good faith believes that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person reasonably able to prevent or lessen the threat, including to the target of the threat.
• Workers’ compensation programs. When authorized by and to the extent necessary to comply with workers’ compensation or other similar programs established by law.
• For treatment, payment or health care operations. The Fund and its business associates will use PHI in order to carry out:
  • Treatment,
  • Payment, and
  • Health care operations.

Treatment is the provision, coordination, or management of health care and related services. It also includes but is not limited to consultations and referrals between one or more of your providers.

For example, the Fund may disclose to a treating orthodontist the name of your treating dentist so that the orthodontist may ask for your dental x-rays from the treating dentist.

Payment includes but is not limited to actions to make coverage determinations and payment (including billing, claims management, subrogation, Fund reimbursement, reviews for medical necessity and appropriateness of care, and utilization review and pre-authorizations).

For example, the Fund may tell a doctor whether you are eligible for coverage, or what percentage of the bill will be paid by the Fund. If we contract with third parties to help us with payment operations, such as a physician who reviews medical claims, we will also disclose information to them. These third parties are known as “business associates.”

Health care operations includes but is not limited to quality assessment and improvement, reviewing competence or qualifications of health care professionals, underwriting, premium rating and other insurance activities relating to creating or renewing insurance contracts. It also includes disease management, case management, conducting or arranging for medical review, legal services, and auditing functions including fraud and abuse compliance programs, business planning and development, business management and general administrative activities.

For example, the Fund may use information about your claims to refer you (if appropriate) to a disease management program or to a healthy pregnancy program; or to project future benefit costs or audit the accuracy of our claims processing functions. The Fund generally does not use or disclose genetic information for any purpose, and it will not under any circumstances use or disclose genetic information for underwriting purposes.

• Disclosure to the Fund’s Trustees. The Fund will also disclose PHI to the Fund Sponsor, which is the Board of Trustees of the Equity-League Health Trust Fund, for purposes related to treatment, payment, and health care operations. The Fund has amended its Plan Document to permit this use and disclosure, as required by federal law. For example, the Fund may disclose information to the Board of Trustees to allow them to decide an appeal.

In addition, the Fund may disclose “summary health information” to the Board of Trustees for obtaining premium bids or for modifying, amending or terminating the Fund’s group health plan. Summary information summarizes the claims history, claims expenses or type of claims experienced by individuals for whom a plan sponsor such as the Board of Trustees has provided health benefits under a group health plan. Identifying information will be deleted from summary health information, in accordance with federal privacy rules.

Except as otherwise indicated in this Notice, uses and disclosures of your PHI will be made only with your written authorization, which is subject to your right to revoke your authorization.

When the Disclosure of Your PHI Requires Your Written Authorization

Although the Fund does not routinely obtain psychotherapy notes, it must generally obtain your written authorization in order to use or disclose psychotherapy notes about you. However, the Fund may use and disclose such notes when needed by the Fund to defend itself against litigation filed by you. Psychotherapy notes are separately filed notes about your conversations with your mental health professional during a counseling session. They do not include summary information about your mental health treatment.

Although the Fund does not routinely sell PHI or use it for marketing purposes, it must obtain your written authorization before it may sell your PHI or use it for marketing purposes.

When You Can Object and Prevent the Fund from Using or Disclosing PHI

The Fund will disclose to your spouse/domestic partner the portion of your PHI that is directly relevant to your spouse or domestic partner’s involvement with your care or payment for that care, unless you notify the Fund’s Privacy Official in writing (contact information below) that you object to our sharing that information with your spouse or domestic partner. In an emergency, or if you become incapacitated, the Fund may also disclose your PHI to other family members, relatives or close friends under certain circumstances as permitted by the Fund’s procedures, unless you have previously notified the Fund’s Privacy Official in writing that you do not want your information shared under those circumstances.

If you want the Fund to disclose your PHI routinely to persons other than your spouse or domestic partner (e.g., to your children) then you must complete an authorization form designating that person as authorized to receive your PHI. Any authorization you make can be revoked by you at any time. Authorization and revocation forms are available from the Privacy Official at the Fund office.

Other Uses or Disclosures

The Fund may contact you to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Back to top

Section 3: Your Individual Privacy Rights

You May Request Restrictions on PHI Uses and Disclosures

You may request the Fund to:

1. Restrict the uses and disclosures of your PHI to carry out treatment, payment or health care operations, or
2. Restrict uses and disclosures to family members, relatives, friends or other persons identified by you who are involved in your care.

The Fund, however, is not required to agree to your request.

You or your personal representative will be required to complete a form to request restrictions on uses and disclosures of your PHI. The form is available from the Fund’s Privacy Official:

Privacy Official
Equity League Health Benefit Fund
165 West 46th Street
New York, NY 10036
(212) 869-9380

You May Request Confidential Communications

The Fund will accommodate your reasonable request to receive communications of PHI confidentially by alternative means or solely at alternative locations (e.g., mailing information somewhere other than to your home address) where the request includes a statement that disclosure using the Fund’s regular communications procedures could endanger you.

You or your personal representative will be required to complete a form to request confidential communications of your PHI. The form is available from the Fund’s Privacy Official.

You May Inspect and Copy Your PHI

You have a right to inspect and to obtain a copy of your PHI contained in a “designated record set,” defined below, for as long as the Fund maintains the PHI in a designated record set.

The Fund must provide the requested information within 30 days if the information is maintained on site at the Fund’s offices, or within 60 days if the information is maintained offsite. A single 30 day extension is allowed if the Fund is unable to meet the deadline.

You or your personal representative will be required to complete a form to request access to the PHI that the Fund maintains in a designated record set. The Fund may charge a reasonable fee to provide this information to you. Requests for access to PHI should be made to the Fund’s Privacy Official.

If access is denied, you or your personal representative will be provided with a written denial setting forth the reason for the denial, a description of how you may exercise your review rights, and a description of how you may file a complaint with the Fund and/or HHS.

Designated Record Set: means the enrollment, payment, billing, claims adjudication and case or medical management record systems maintained by or for the Fund about you, or other information used in whole or in part by or for the Fund to make decisions about you. Information used by the Fund for quality control or peer review analyses, and not used to make decisions about you, is not part of a designated record set.

You Have the Right to Amend Your PHI

You have the right to request that the Fund amend your PHI or a record about you in a designated record set that is maintained by or for the Fund for as long as the PHI is maintained in the designated record set, subject to certain exceptions. See the Fund’s “Right to Amend” Policy (available on request from the Fund’s Privacy Official) for a list of exceptions.

The Fund has 60 days after receiving your request to act on it. The Fund is allowed a single 30-day extension if it is unable to meet the 60-day deadline. If the Fund denies your request in whole or part, the Fund must provide you with this denial in writing and explain in it the reason that your request is not being granted. You or your personal representative may then submit a written statement disagreeing with the denial. Your statement will be included with any future disclosure of the PHI at issue.

You should make your request to amend PHI to the Fund’s Privacy Official. You or your personal representative will be required to complete a form to request amendment of the PHI.

You Have the Right to Receive an Accounting of Certain of the Fund’s PHI Disclosures

At your request, the Fund will also provide you with an accounting of certain disclosures by the Fund of your PHI. We do not have to provide you with an accounting of disclosures related to treatment, payment for treatment, or health care operations, or disclosures made to you or authorized by you in writing. See the Fund’s “Accounting for Disclosures” Policy (available on request from the Fund’s Privacy Official) for the complete list of PHI disclosures for which an accounting is not required.

The Fund has 60 days to provide the accounting. The Fund is allowed an additional 30 days if the Fund gives you a written statement of the reasons for the delay and the date by which the accounting will be provided.

If you request more than one accounting within any 12-month period, the Fund will charge a reasonable, cost-based fee for each accounting the Fund provides after the first accounting.

Your Personal Representative

You may exercise your rights under this Policy through a personal representative. Except as provided below in connection with parents of unemancipated minor children, or in certain emergency medical situations, your personal representative will be required to produce evidence of authority to act on your behalf before the personal representative will be given access to your PHI or be allowed to take any action for you. Proof of such authority includes a completed, signed and approved Appointment of Personal Representative form. You may obtain this form by contacting the Fund’s Privacy Official.

The Fund retains discretion to deny access to your PHI to a personal representative to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse or neglect.

The Fund will recognize certain individuals as personal representatives without completion of an Appointment of Personal Representative form. For example, the Fund will consider a parent or guardian as the personal representative of an unemancipated minor, unless applicable state law requires otherwise. Unemancipated minors may, however, request that the Fund restrict information that goes to family members, as described more fully at the beginning of Section 3 of this Notice. Certain other documentation may be used instead of the Appointment of Personal Representative form, including official legal documentation that demonstrates that under relevant state law, the representative is authorized to make health care decisions for you (e.g., appointment as a legal guardian, or a health care power of attorney).

You may review the Fund’s “Policy and Procedure for the Recognition of Personal Representatives” (available on request from the Fund’s Privacy Official) for a more complete description of the circumstances where the Fund will consider an individual to be your personal representative for purposes of exercising your rights under this Privacy Notice.

Information that Does Not Identify You

This Notice does not apply to information that has been de-identified. De-identified information is information that:

• Does not identify you, and
• With respect to which there is no reasonable basis to believe that the information can be used to identify you.

Back to top

Section 4: The Fund’s Duties

Maintaining Your Privacy

The Fund is required by law to maintain the privacy of your protected health information, provide you with certain rights with respect to your protected health information, provide you with a copy of this Notice of our legal duties and privacy practices with respect to your protected health information, and follow the terms of this Notice until such time as it may be amended. We are also required to notify you if your protected health information has been breached.

This Notice is effective beginning on September 23, 2013. However, the Fund reserves the right to change its privacy practices and this Notice, and to apply the changes to all the PHI that the Fund uses or maintains, including PHI that the Fund received prior to the date that it changed its privacy practices.

If a privacy practice is materially changed, a revised version of this Notice will be posted prominently on the Fund’s website within sixty (60) days of the effective date of the material change, which may pertain to:

• The uses or disclosures of your PHI;
• Your individual rights;
• The duties of the Fund; or
• Other privacy practices stated in this notice.

A written copy of the most current version of this Notice is available to you at any time upon request from the Fund’s Privacy Official. Any other person, including dependents of named participants, may also obtain a copy of this Notice at any time upon request from the Fund’s Privacy Official.

Disclosing Only the Minimum Necessary Protected Health Information

When using or disclosing PHI, or when requesting PHI from another covered entity, the Fund will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations. However, the minimum necessary standard will not apply in the following situations:

• Disclosures to or requests by a health care provider for treatment;
• Uses or disclosures made to you;
• Disclosures made to the Secretary of the United States Department of Health and Human Services, pursuant to its enforcement activities under HIPAA;
• Uses or disclosures required by law; and
• Uses or disclosures required for the Fund’s compliance with the HIPAA privacy regulations.

Back to top

Section 5: Your Right to File a Complaint

If you believe that your privacy rights have been violated, you may file a written complaint with the Fund in care of the Fund’s Privacy Official. The Fund will not retaliate against you for filing a complaint.

You may also file a complaint with:

Office for Civil Rights
U.S. Department of Health & Human Services
Jacob Javits Federal Building
26 Federal Plaza, Suite 3312
New York, NY 10278

Back to top

Section 6: If You Need More Information

If you have any questions regarding this Notice or the subjects addressed in it, please contact the Privacy Official at the Fund Office.

Back to top

Section 7: Conclusion

Section 7: Conclusion
PHI use and disclosure by the Fund is regulated by the federal Health Insurance Portability and Accountability Act, known as HIPAA. You may find the HIPAA rules at 45 Code of Federal Regulations Parts 160 and 164. This Notice attempts to summarize the Fund’s obligations under the regulations. The regulations will supersede this Notice if there is any discrepancy between the information in this Notice and the regulations.

Back to top