THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Original effective date of this notice: April 14, 2003
Revised:July 2023
Protecting the privacy of information about your medical conditions and health (protected health information) is a responsibility we take very seriously. We understand that your protected health information is personal and it is important to you that we keep it confidential. We are committed to the practices and procedures we established to protect the confidential nature of information about your health.
This notice describes the way we may use and disclose your protected health information to carry out treatment, payment and health care operations and for other purposes as permitted or required by law. It also describes your rights and duties regarding the use and disclosure of medical information.
INFORMATION THAT THIS NOTICE APPLIES TO
This notice applies to information in our possession that would allow someone to identify you and learn something about your health. It does not apply to information that could only be used to identify you. We collect personal information such as name, address, telephone number, Social Security number, age, sex and medical diagnosis to coordinate medical care. This information is obtained from member enrollment forms, member surveys and claims.
OUR RESPONSIBILITIES
USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION
The following categories describe different ways that we may use and disclose protected health information without your authorization. For each category, we give some examples of uses and disclosures. Not every use or disclosure in a category is listed. However, all of the ways we are permitted to use and disclose protected health information will fall within one of the categories.
Treatment: We do not provide medical treatment or services. We may disclose information about your health to a physician or health care professional involved in making a decision that could affect your care. For example, we might disclose information about your prior prescriptions to a pharmacist to determine if a pending prescription contradicts prior prescriptions.
Payment: We use and disclose information about your health to determine eligibility for benefits and payment of claims for medical treatment or services. For example, we may disclose information to your health care provider to verify coverage for medical treatment or services. Likewise, we may share medical information with a health care provider to assist in billing or filing claims for payment of treatment and services, including third party liability claims and coordination of benefits. We may also send you information about claims we pay and claims we do not pay (called an “Explanation of Benefits”) for you and your covered dependents. Under certain circumstances, you may request to receive this information confidentially.
Health Care Operations: We may use and disclose your medical information for activities that are necessary for our HMO and PPO and health insurance operations. These uses and disclosures are necessary for our business and to make sure you are receiving quality services. Some examples of how we may use and disclose information about your health include: conducting quality assessment and improvement activities such as outcomes evaluation and development of clinical guidelines; underwriting, premium rating and other activities relating to coverage; submitting claims for stoploss or reinsurance coverage; conducting or arranging for medical review; fraud and abuse detection programs; business planning and development such as cost management; and business management and general administrative activities.
OTHER PERMITTED AND REQUIRED USES AND DISCLOSURES THAT MAY BE MADE WITHOUT CONSENT, AUTHORIZATION OR OPPORTUNITY TO OBJECT
We may use or disclose your protected health information in the following situations without your authorization or without allowing you to object or agree to the use or disclosure
Required by Law: We may use or disclose your protected health information to the extent we are required to do so by state or federal law. We are required by law to meet many conditions before we can share your information. Go to hhs.gov/OCR/Privacy/HIPAA/understanding/consumers to learn more.
Law Enforcement: We may disclose your protected health information for law enforcement purposes. This includes providing information to help locate a suspect, fugitive, material witness or missing person in connection with suspected criminal activity.
Legal Proceedings: We may disclose protected health information in the course of any judicial or administrative proceedings, in response to an order of a court or administrative tribunal or in response to a subpoena, discovery request or other lawful process. Health Oversight: We may disclose your protected health information to a government agency, or its contractor, authorized to oversee activities required by law, such as audits, investigations and inspections.
Public Health and Safety: We may disclose your protected health information to a public health authority or other appropriate government authority, which is permitted by law to receive the information, for public health activities. The disclosure will be made for the purpose of controlling/preventing disease, helping with product recall, reporting adverse reactions to medications, reporting suspected abuse, neglect, exploitation, domestic violence, or preventing or reducing a serious threat to anyone’s health or safety
Worker’s Compensation: We may disclose medical information to the extent authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs that provide benefits for work-related injuries and illnesses.
Military Activities and National Security: We may disclose your protected health information to Armed Forces personnel under certain circumstances and to authorized federal officials for the conduct of national security and intelligence activities.
Research: We may disclose your protected health information to researchers when their research has been approved by an institutional review board and they comply with the privacy standards.
Others Involved in Your Care: Unless you object or law prohibits it, we may disclose certain information to a family member or to someone else who is involved in your medical care or payment for care. This may include telling a family member about the status of a claim or what benefits you are eligible to receive. If you are present (whether in person or on the telephone) you have the opportunity to provide your verbal agreement for that particular disclosure. If you would like for us to disclose your protected health information to someone that is representing you, you may provide this information to us in writing or a legal document such as a power of attorney or legal guardianship.
Health Benefits and Services: We may use your medical information, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. Employers/Plan Sponsors: If your health plan is through your employer, we may disclose enrollment, disenrollment and eligibility information to your employer and aggregate health information that does not identify an individual.
We may also disclose protected health information to your plan sponsor to carry out plan administration functions the plan sponsor performs upon certification by the plan sponsor that the plan documents have been amended to fully comply with the HIPAA Privacy and Security Rules.
OUR INFORMATION SHARING PRACTICES WITH ACEs, OHCAs and BAs
AFFILIATED COVERED ENTITIES
An Affiliated Covered Entity (ACE) is a group of organizations under common ownership or control who designate themselves as a single Affiliated Covered Entity for purposes of compliance with HIPAA Privacy Rule. As Affiliated Covered Entities we may share PHI for the joint management and operation of these entities for your treatment, payment of your claims, and for healthcare operational purposes and as permitted by the Privacy Rule. This sharing does not mean that one organization is responsible for the activities of another, but rather means we are all committed to protecting our members’ privacy rights. For a complete list of the members of the ACE, please contact our Customer Solutions Department under the Whom to Contact section and your request will be directed to our Privacy Officer.
ORGANIZED HEALTH CARE ARRANGEMENTS
We may share information that we have about you with other organizations such as New Hanover Health, LLC, Agilon Health Management, Inc. and Alignment Healthcare LLCs for purposes of health care operations under an organized health care arrangement. Sharing information enables us to:
BUSINESS ASSOCIATES
Business Associates are contracted third party individuals or entities who are performing various activities or functions for us or on our behalf that involves using or sharing protected health information. Business Associates are subject to the same privacy and security rules per a mutual written agreement.
We may disclose information about your health to our business associates to enable them to perform services for us or on our behalf relating to our operations. Some examples of business associates are our lawyers, auditors, accrediting agencies, consultants, pharmacy benefit managers, collection agencies utilization and case management and printing and mail service vendors. Our business associates are required to maintain the same high standards of safeguarding your privacy that we require of our own employees and affiliates.
YOUR RIGHTS
The following describes your rights regarding the protected health information we maintain about you. If you want to exercise your rights, please contact a member of our Member Services Department, who will give you the necessary information and forms for you to return to the address listed under “Whom to Contact” at the end of this notice.
Authorization: We may use and disclose your protected health information for any purpose that is listed in this notice without your written authorization. We will not use or disclose your protected health information for any other reason without your authorization. If you authorize us to use or disclose your medical information, you have the right to revoke the authorization in writing at any time. You may not revoke an authorization to the extent that we have taken action in reliance on the authorization. If the authorization is to permit disclosure of your information to an insurance company, as a condition of obtaining coverage, other laws may allow the insurer to continue to use your information to contest claims or your coverage, even after you have revoked the authorization.
Request a Restriction: You have the right to request that we restrict uses and disclosures of your medical information that we use for treatment, payment and health care operations. You also have the right to request a limit on the information we disclose about your health to someone who is involved in your care or the payment of your care, like a family member. Your request will be considered, however, we are not required to agree to a restriction. We cannot agree to restrict disclosures that are required by law.
Request Confidential Communications: If our normal communication channels could endanger you, you have the right to request that we send communications of your protected health information by alternative means or to an alternative location. You must make this request in writing and state our normal channels of communication could endanger you. We will consider all reasonable requests to the extent the request specifies an alternative location and allows us to continue to pay claims.
Obtain a Copy of Your Record: You have the right to see or obtain a copy of your information included in a designated record set. This right is limited to information about you that is used to make decisions such as claims, payment and enrollment records. Under state and federal law, this right does not include psychotherapy notes or information about your health compiled in reasonable anticipation of litigation, administrative action or administrative proceedings. To receive a paper copy, send your written request to the address listed under “Whom to Contact” at the end of this notice. We may charge a fee for the cost of copying and mailing the records. We will respond to your request within 30 days.
You may see your information in electronic form via our website by registering under hally.com.
We may deny you access to certain information if it would reasonably endanger the life or physical safety of you or another person. If you are denied access to information about your health, we will explain how you may appeal the decision.
Request a Correction to Your Record: You have the right to request that we correct your health or claims information for as long as we maintain such information if you believe that the information is incorrect or incomplete. This right is limited to information about you that is used to make decisions such as claims, payment or utilization management records. Your written request must include the reason or reasons that support your request. We will respond to your request in writing within 30 days. We may deny your request for correction if we determine the record was not created by us, is not available for inspection as specified by law or is accurate and complete.
Accounting of Disclosures: You have the right to receive a list (accounting) of certain disclosures of your protected health information made by us in the six years prior to the date of the request (or shorter period as requested). This does not include disclosures made to carry out treatment, payment and health care operations; disclosures made to you; disclosures made with your authorization; communications with family and friends; disclosures made for national security or intelligence purposes; or disclosures to correctional institutions or law enforcement officials. We will provide the first list of disclosures you request at no charge. A reasonable, cost based fee may be imposed for each subsequent request. You must tell us the time period you want the list to cover.
Request a Copy of this Notice: You have the right to obtain a paper copy of this notice at any time.
Complaints: You have a right to file a complaint if you think your privacy has been violated. You may file your complaint with our Member Services Department. (See “Whom to Contact” at the end of this notice.) You may also file a complaint with the U.S. Department of Health and Human Services Office of Civil Rights by visiting their website at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.
CHANGES TO THIS NOTICE
We reserve the right to change our privacy practices, as described in this notice, at any time. We reserve the right to apply these changes to any medical information that we already have, as well as to medical information we receive in the future. Before we make any change in the privacy practices described in this notice, we will mail a revised notice to you within 60 days of the effective date.
WHOM TO CONTACT
You may contact a member of our Customer Solutions Department at (877) 210-9167 or (TTY 711) for the hearing impaired. Representatives are available from 8 a.m. to 8 p.m., local time, 7-days a week. Voicemail will be used on weekends and holidays from April 1 – September 30. You may also write to the address below for the following information and requests:
FirstCarolinaCare Insurance Company
Customer Solutions Department
3310 Fields South Drive
Champaign, IL 61822
