Notice of Privacy Practices - Group Medical Plans
Olathe Health System, Inc.
Comprehensive Health and Welfare Benefit Plan
NOTICE OF PRIVACY PRACTICES
Effective Date: April 14, 2003
Last Revised: September 23, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU RECEIVE ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have questions concerning this notice, please contact:
Compensation & Benefits Manager
20333 W. 151st Street, Olathe, KS 66061
The Olathe Health System, Inc. (the Company) Comprehensive Health and Welfare Benefit Plan (the Plan) is required by law to maintain the privacy of your health information. This Notice describes your rights and certain obligations the Plan and third parties who assist in the administration of Plan claims have regarding the use and disclosure of health information. It also tells you about the ways in which the Plan may use and disclose health information about you. Individually identifiable information about your past, present, or future health or condition is considered protected health information (PHI). This notice applies to all PHI maintained by the Plan. The Plan is obligated to follow the terms of the notice that is currently in effect.
The Plan participates in what the federal privacy rules call an "Organized Health Care Arrangement" for the purpose of carrying out healthcare operations among the members. The members of the Organized Health Care Arrangement are:
- Olathe Health System, Inc. Comprehensive Health and Welfare Benefit Plan
- Blue Cross and Blue Shield of Kansas City Medical Plan
- Delta Dental of Kansas Dental Care Plan
- Surency Vision, Surency Life and Health Insurance Company
- HBS Flex Flexible Benefits Plan
- UNUM Employee Assistance Program
You may also receive one or more privacy notices from the members of the Organized Health Care Arrangement that provide benefits under the Plan. Those notices will describe how the members use and disclose PHI, and your rights with respect to the PHI they maintain.
The Plan is committed to protecting the confidentiality of your PHI, as well as the health information of your dependents covered by the Plan. Such information includes, but is not limited to, the following:
- Enrollment data. In order to provide you with health benefits, the Plan must collect information about you and your dependents. When you enroll, the Company collects enrollment data from you and transmits that data to the Plan.
- Claims data. The Plan also receives claims data from both you and health care providers, such as doctors, hospitals, and medical labs. Information about your claims, including diagnosis codes, amounts paid, amounts written off, and amounts payable by you, is maintained in the Plan's records. The Plan may also receive information about your medical condition and proposed methods of treatment in order to pre-certify treatment or to determine if the expenses you incurred are covered by the Plan.
- Contributions. Contributions or "premiums" are collected from you through the payroll process. Both your contributions and company contributions are deposited in the Plan's trust. Claims submitted by you or your health care providers are paid from contributions to the trust in accordance with the terms of the Plan (See your medical plan Summary Plan Description for additional detail).
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION.
Right To Review and Obtain a Copy. You have the right to review and obtain a copy of the health information collected and maintained by the Plan within the designated record set. To review and request a copy of your health information, you must complete a specific form providing information needed to process your request. To obtain this form or to obtain more information concerning this process, please contact the person identified on the first page of this notice. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other supplies and services associated with your request. We may require that you pay such fee prior to receiving the requested copies. We may deny your request to inspect and copy in certain limited circumstances. If your request is denied, you will be informed of the reason for the denial and will have an opportunity to submit a statement of disagreement to be maintained with your records. If you are denied access to health information, you may request that the denial be reviewed. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right To Request Amendment. If you believe that the Plan's records contain information about you that is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan. To request an amendment, you must complete a specific form providing information we need to process your request, including the reason that supports your request. To obtain this form or to obtain more information concerning this process, please contact the person identified on the first page of this notice.
We may deny your request for an amendment if you fail to complete the required form in its entirety. In addition, we may deny your request if you ask us to amend information that:
- was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
- is not part of the health information kept by or for the Plan;
- is not part of the information that you would be permitted to inspect and copy; or
- is accurate and complete.
If your request is denied, you will be informed of the reason for the denial and will have an opportunity to submit a statement of disagreement to be maintained with your records.
Right to an Accounting of Disclosures. You have the right to request an "accounting of disclosures." This is a list of the disclosures we made of health information about you, with certain exceptions specifically defined by law. To request this list or accounting of disclosures, you must complete a specific form providing information we need to process your request. To obtain this form or to obtain more information concerning this process, please contact the person identified on the first page of this Notice.
Your request must state a time period that may not be longer than six years and may not include dates six years prior to the date on which the accounting is requested. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend.
We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
To request restrictions, you must complete a specific form providing information we need to process your request. To obtain this form or to obtain more information concerning this process, please contact the person identified on the first page of this notice.
Further, you have the right to restrict certain disclosures of PHI to a health plan when you have paid, in full, for the health care item or service you wish to restrict. For more information, discuss this restriction right with your health care provider.
Right to Request Alternative Methods of Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request an alternative method of communication, you must complete a specific form providing information we need to process your request. To obtain this form, or to obtain more information concerning this process, please contact the person identified on the first page of this notice. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to Receive Breach of PHI Notification. You have a right to be notified if we determine that there has been a breach of your PHI.
Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, contact the person identified on the first page of this notice.
HOW TO FILE COMPLAINTS CONCERNING THE PLAN'S PRIVACY PRACTICES
If you believe your rights with respect to health information about you have been violated by the Plan, you may file a complaint with the Plan by contacting the person identified on the first page of this Notice. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized for filing a complaint.
HOW THE PLAN MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU
Uses and Disclosures of Protected Health Information without Your Specific Authorization
The Plan may use and disclose your health information about you for payment or health care operations without any consent or authorization beyond your enrollment in the Plan.
Treatment means the provision, coordination, or management of healthcare by a health care provider. While treatment primarily means the care provided by your doctors and hospital, the Plan could share PHI with your health care providers for treatment purposes.
Payment includes activities associated with collecting contributions (sometimes called premiums) for health care from you. It also refers to actions to pay you or your health care provider for covered expenses. Activities associated with payment include, but are not limited to:
- enrollment activities (including verification of eligibility and collection of your contributions),
- collection of contributions from you and your Company,
- payment for covered expenses, including coordination of benefits with other plans in which you are enrolled,
- review of payment decisions upon appeal,
- obtaining payment under a contract for reinsurance,
- activities related to pre-certification or pre-authorization of benefits and utilization review,
- determination of medical necessity,
- disclosure of contribution payment history to a consumer reporting agency.
Health Care Operations includes, but is not limited to:
- activities undertaken to reduce overall health care costs,
- case management and care coordination,
- contacting you or your health care provider about alternative treatments,
- evaluating practitioner and provider performance,
- training of non-health care professionals,
- activities related to obtaining an insurance or reinsurance contract for the provision of health care,
- conducting or arranging for medical review, legal services, and auditing functions,
- establishment of contribution rates,
- business planning and development,
- analysis related to managing and operating the Plan,
- development or change of payment methods or coverage policies,
- educational activities.
Pursuant to applicable federal law, there are several other uses and disclosures the Plan may make without your specific authorization such as the following circumstances:
1. Disclosures of Protected Health Information to Olathe Health System, Inc. as the Plan Sponsor. There are three circumstances under which the Plan may disclose PHI concerning you to the Plan Sponsor (i.e., your employer, Olathe Health System, Inc.) without your expressed authorization.
First, the Plan may inform the Plan Sponsor whether you are enrolled in the Plan.
Second, the Plan may disclose summary health information to the Plan Sponsor. The Plan Sponsor must limit its use of that information to obtaining quotes from insurers or modifying, amending, or terminating the Plan. Summary health information is information that summarizes claims history, claims expenses, or types of claims without identifying you.
Third, the Plan may disclose your PHI to the Plan Sponsor for Plan administrative purposes. This is because employees of the Plan Sponsor may perform administrative functions necessary for the management and operation of the Plan. The Plan Sponsor has agreed to the following limitations on its use and disclosure of your PHI:
- The Plan Sponsor will only use or disclose PHI for Plan administrative purposes or as required by law.
- The Plan Sponsor will ensure that any agents to whom the Plan Sponsor provides PHI are bound by the same restrictions and conditions that apply to the Plan Sponsor with respect to such information.
- The Plan Sponsor will not use or disclose PHI for employment-related actions and decisions or in connection with any other benefit or benefit plan.
- The Plan Sponsor will promptly report to the Plan any use or disclosure of PHI that is inconsistent with the permitted uses and disclosures.
The Plan will not disclose, for underwriting purposes, PHI that is genetic information.
2. Creation of de-identified health information. The Plan may use your PHI to create de-identified health information. This means that all data items that would help identify you, such as name, address, birth date, and hire date are removed or modified. This would allow analysis of health plan information without the analyst knowing whom the data refers to. Once information is de-identified, it is no longer protected.
3. Furnishing data to Business Associates. The Plan's Business Associates (e.g., the third-party administrator, legal counsel, and consultants) receive and maintain your PHI to carry out payment and health care operations. For instance, if you have a serious medical condition that will require long-term medical care, information related to your condition could be shared with a company that specializes in large claim management.
4. Uses and disclosures required by law. The Plan will use and/or disclose your PHI when required by law to do so. The disclosure will be the minimum necessary to fulfill the legal requirement.
5. Disclosures for public health activities. We may disclose your PHI for public health activities such as:
- To a public health authority that is authorized by law to collect data for the purpose of preventing or controlling disease, injury, or disability.
- To a public health authority or other appropriate government authority authorized by law to receive reports of child or elder abuse or neglect.
- To a person or business subject to the jurisdiction of the Food and Drug Administration ("FDA") for activities related to the quality, safety, or effectiveness of an FDA regulated product or activity.
- To a person who may have been exposed to a communicable disease if such disclosure is permitted by law.
6. Disclosures for health oversight activities. The Plan may disclose your PHI to a health oversight agency for oversight activities. The disclosure must be authorized by law and could include audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions. It could also include other activities necessary for appropriate oversight of the health care system or entities subject to civil rights laws for which health information is necessary for determining compliance.
7. Disclosures for judicial and administrative proceedings. Your PHI may be disclosed during any judicial or administrative proceeding if it is:
- In response to an order of a court or administrative tribunal and includes no more information than that required to satisfy the order;
- In response to a subpoena, discovery request, or other lawful process not accompanied by an order and the party seeking information has made reasonable efforts to inform you of its actions.
8. Disclosures for law enforcement purposes. We may disclose your PHI to a law enforcement official as required by law or in compliance with:
- A court order, court-ordered warrant, a subpoena, or summons issued by a judicial officer;
- A grand jury subpoena; or
- An administrative request related to a legitimate law enforcement inquiry.
9. Disclosures regarding victims of a crime. In response to a law enforcement official's request, the Plan may disclose information about you with your approval. We may also disclose information in an emergency situation or if you are incapacitated, if it appears you were the victim of a crime.
10. Disclosures to avert a serious threat to health or safety. We may disclose your PHI to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, or as necessary for law enforcement authorities to identify or apprehend an individual.
11. Disclosures for specialized government functions. The Plan may disclose your PHI as required to comply with governmental requirements for national security reasons or for protection of certain government personnel or foreign dignitaries.
12. Disclosures for research purposes. The Plan may use or disclose your PHI for research provided that we obtain documentation that authorization has been waived by either an Institutional Review Board or a privacy board.
13. Coroners, Medical Examiners, Funeral Directors, and Organ Donation. We may disclose PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or for the coroner or medical examiner to perform other duties authorized by law. We also may disclose, as authorized by law, information to funeral directors so that they may carry out their duties. Further, we may disclose PHI to organizations that handle organ, eye, or tissue donation and transplantation.
14. Inmates. If you are an inmate of a correctional institution, we may disclose your PHI to the correctional institution or to a law enforcement official for: (1) the institution to provide health care to you; (2) your health and safety and the health and safety of others; (3) the safety and security of the correctional institution.
15. Workers' Compensation. We may disclose your PHI to comply with workers' compensation laws and similar programs that provide benefits for work-related injuries or illnesses.
16. Others Involved in Your Health Care. We may disclose your health information to your family or friends or any other person identified by you when they are involved in your care or payment for your care. We will only disclose the health information directly related to their involvement in your care or payment. When permitted to do so by law, we may coordinate our uses and disclosures of your health information with public or private entities authorized to assist in disaster relief efforts. If you are not present or able to agree to these disclosures of your PHI, then, using our professional judgment, we may determine whether the disclosure is in your best interest.
Uses and Disclosures Requiring Your Authorization
If we maintain or receive psychotherapy notes about you, most disclosures of these notes require your written authorization. Your written authorization is also required for disclosures that constitute a sale of PHI or if we would directly or indirectly receive a financial benefit from a use or disclosure of your PHI for some marketing purposes. Other uses and disclosures of your health information not covered in the previous sections of this notice will only be made by the Plan with your written permission or authorization.
If you provide authorization for any use or disclosure of your PHI, you may revoke that authorization, in writing, at any time. Once you revoke your authorization, we will no longer use or disclose the information about you for the reasons covered by that authorization, but we cannot take back any uses or disclosures already made with your permission.
Changes to this Notice
We reserve the right to change the terms of this notice and to make the revised notice effective with respect to all PHI regardless of when the information was created. If the notice is revised, we will prominently post the change or the revised notice on our web site by the effective date of the material change to the notice. Further, we will either provide the revised notice or information about the material change and how to obtain the revised notice, in the next annual mailing to individuals then covered by the plan. If we do not post the change or the revised notice on our web site, the new notice will be provided to you either through e-mail or U.S. Postal Service within sixty days of such revision. The notice, or information about how to obtain the notice, will be provided to you no less frequently than once every three years.