This Notice describes how medical information about you may
be used and disclosed and how you can get access to this
information.
Please review it carefully.
This Notice is required by law.
The AlaskaCare self-funded group health plan, including the State of
Alaska Active Employee Plan, the Defined Benefit (DB) Retiree Plan,
and the Defined Contribution (DCR) Retiree Plan (which may include
health, dental, vision, employee assistance, wellness, medical flexible
spending accounts, COBRA administration, or other coverage affecting
any structure of the body as those benefits may be offered from time to
time) (hereafter referred to as the “Plan”), is required by law to take
reasonable steps to maintain the privacy of your personally identifiable
health information (called Protected Health Information or PHI) and
to inform you about the Plan’s legal duties and privacy practices with
respect to Protected Health Information including:
- The Plan’s uses and disclosures of PHI,
- Your rights to privacy with respect to your PHI,
- The Plan’s duties with respect to your PHI,
- Your right to file a complaint with the Plan and with the
Secretary of the U.S. Department of Health and Human Services
(HHS),
- The person or office you should contact for further information
about the Plan’s privacy practices, and
- To notify affected individuals following a breach of unsecured
Protected Health Information.
PHI use and disclosure by the Plan is regulated by the Health
Insurance Portability and Accountability Act (HIPAA). You may find
these rules in Section 45 of the Code of Federal Regulations, Parts 160
and 164. The regulations will supersede this Notice if there is any
discrepancy between the information in this Notice and the
regulations. The Plan will abide by the terms of the Notice currently in
effect. The Plan reserves the right to change the terms of this Notice
and to make the new Notice provisions effective for all PHI it
maintains.
You may receive a Privacy Notice from a variety of the insured group
health benefit plans offered by the State of Alaska. Each of these
notices will describe your rights as it pertains to that plan and in
compliance with the Federal regulation, HIPAA. This Privacy Notice,
however, pertains to your Protected Health Information related to the
AlaskaCare self-funded benefit plan (the “Plan”) and outside
companies contracted to help administer Plan benefits, called
“Business Associates.”
Effective Date
The effective date of this Notice is October 1, 2019, and this notice
replaces notices previously distributed to you.
Privacy Officer
The Plan has designated a Privacy Officer to oversee the
administration of privacy by the Plan and to receive complaints. The
Privacy Officer may be contacted at:
State of Alaska
Division of Retirement and Benefits
P.O. Box 110203
Juneau, AK 99811-0203
Phone: (907) 465-4460
Email: .
Your Protected Health Information
The term
Protected Health Information (PHI) includes all
information related to your past, present or future health condition(s)
that individually identifies you or could reasonably be used to identify
you and is transferred to another entity or maintained by the Plan in
oral, written, electronic, or any other form.
PHI does not include health information contained in employment
records held by the State of Alaska in its role as an employer, including
but not limited to: health information on disability benefits, life
insurance, accidental death and dismemberment insurance, sick leave,
Family or Medical Leave (FMLA), drug testing, etc.
When the Plan May Disclose Your PHI
Under the law, the Plan may disclose your PHI without your written
authorization in the following cases:
- At your request. If you request it, the Plan is required to give you
access to your PHI in order to inspect it and copy it.
- As required by an agency of the government. The Secretary of
the Department of Health and Human Services may require the
disclosure of your PHI to investigate or determine the Plan’s
compliance with the privacy regulations.
- For treatment, payment or health care operations. The Plan and
its Business Associates will use your PHI (except psychotherapy
notes in certain instances as described below) without your
consent, authorization or opportunity to agree or object in order to
carry out treatment, payment, or health care operations.
Definitions and Examples of Treatment, Payment, and Health Care Operations |
Treatment is health care |
Treatment is the provision, coordination, or management of health care and related services. It also includes but is not limited to coordination of benefits with a third party and consultations and referrals between one or more of your health care providers.
- For example: The Plan discloses to a treating specialist the name of your treating primary care physician so the two can confer regarding your treatment plan.
|
Payment is paying claims for health care and related activities |
Payment includes but is not limited to making payment for the provision of health care, determination of eligibility, claims management, and utilization review activities such as the assessment of medical necessity and appropriateness of care.
- For example: The Plan tells your doctor whether you are eligible for coverage or what percentage of the bill will be paid by the Plan.
|
Health Care Operations keep the Plan operating soundly. |
Health care operations includes but is not limited to quality assessment and improvement, patient safety activities, business planning and development, reviewing competence or qualifications of health care professionals, underwriting, enrollment, premium rating, and other insurance activities relating to creating or renewing insurance contracts. It also includes disease management, case management, conducting or arranging for medical review, legal services, and auditing functions including fraud and abuse compliance programs and general administrative activities.
- For example: The Plan uses information about your medical claims to refer you to a health care management program, to project future benefit costs, or to audit the accuracy of its claims processing functions.
|
The Plan may disclose PHI to the Plan Sponsor for purposes of
treatment, payment, and health care operations in accordance with the
Plan amendment. The Plan may disclose PHI to the Plan Sponsor for
review of your appeal of a benefit or for other reasons related to the
administration of the Plan.
In addition, the Plan may use or disclose “summary health
information” to the Plan Sponsor for obtaining premium bids or
modifying, amending or terminating the group health Plan. Summary
health information is information that summarizes claims history,
claims expenses, or type of claims experienced by individuals for
whom the Plan Sponsor has provided health benefits under a group
health plan. Identifying information will be deleted from summary
health information, in accordance with HIPAA. The Plan may not (and
does not) use your genetic information that is PHI for underwriting
purposes.
Although the Plan does not routinely obtain psychotherapy notes, an
authorization will be required by the Plan before the Plan will use or
disclose psychotherapy notes about you. Psychotherapy notes are
separately filed notes about your conversations with your mental
health professional during a counseling session. They do not include
summary information about your mental health treatment. However,
the Plan may use and disclose such notes when needed by the Plan to
defend itself against litigation filed by you.
The Plan usually will require an authorization form for uses and
disclosure of your PHI for sales or marketing purposes if the Plan
receives direct or indirect payment from the entity whose product or
service is being marketed or sold. You have the right to revoke an
authorization at any time.
Use or Disclosure of Your PHI Where You Will Be Given an Opportunity to Agree or Disagree Before the Use or Release
Disclosure of your PHI to family members, other relatives, and your close personal friends without your written consent or authorization is allowed if:
- The information is directly relevant to the family or friend’s
involvement with your care or payment for that care, and
- You have either agreed to the disclosure or have been given an
opportunity to object and have not objected.
Under this Plan your PHI may automatically be disclosed internally
within the State of Alaska’s Department of Administration. For
example, in the event the Plan is notified of a condition that may
initiate a short-term disability benefit, the Plan may automatically
communicate this information to the Disability Coordinator to allow
the processing of appropriate paperwork.
Note that PHI obtained by the Plan Sponsor’s employees through Plan
administration activities will NOT be used for employment related
decisions.
Use or Disclosure of Your PHI Where Consent, Authorization or Opportunity to Object Is Not Required
In general, the Plan does not need your written authorization to
release your PHI if required by law or for public health and safety
purposes. The Plan and its Business Associates are allowed to use and
disclose your PHI without your written authorization under the
following circumstances:
- When required by law.
- When permitted for purposes of public health activities. This
includes reporting product defects, permitting product recalls
and conducting post-marketing surveillance. PHI may also be
used or disclosed if you have been exposed to a communicable
disease or are at risk of spreading a disease or condition, if
authorized by law.
- To a school about an individual who is a student or prospective
student of the school, if the Protected Health Information that is
disclosed is limited to proof of immunization and the school is
required by State or other law to have such proof of
immunization prior to admitting the individual.
- When authorized by law to report information about abuse,
neglect, or domestic violence to public authorities if a
reasonable belief exists that you may be a victim of abuse,
neglect, or domestic violence. In such case, the Plan will
promptly inform you that such a disclosure has been or will be
made unless that notice would cause a risk of serious harm.
- To a public health oversight agency for oversight activities
authorized by law. These activities include civil, administrative
or criminal investigations, inspections, licensure or disciplinary
actions (for example, to investigate complaints against
providers), and other activities necessary for appropriate
oversight of government benefit programs (for example, to
investigate Medicare or Medicaid fraud).
- When required for judicial or administrative proceedings. For
example, your PHI may be disclosed in response to a subpoena
or discovery request, provided certain conditions are met.
- When required for law enforcement health purposes (for
example, to report certain types of wounds).
- For law enforcement purposes if the law enforcement official
represents that the information is not intended to be used
against the individual, the immediate law enforcement activity
would be materially and adversely affected by waiting to obtain
the individual’s agreement, and the Plan in its best judgment
determines that disclosure is in the best interest of the
individual.
- When required to be given to a coroner or medical examiner to
identify a deceased person, determine a cause of death, or other
authorized duties.
- When required to be given to funeral directors to carry out
their duties with respect to the decedent or for use and
disclosures for cadaveric organ, eye, or tissue donation
purposes.
- For research, subject to certain conditions.
- When, consistent with applicable law and standards of ethical
conduct, the Plan in good faith believes the use or disclosure is
necessary to prevent or lessen a serious and imminent threat to
the health or safety of a person or the public.
- When authorized by and to the extent necessary to comply with
workers’ compensation or other similar programs established
by law.
- When required, for specialized government functions, to
military authorities under certain circumstances, or to
authorized Federal officials for lawful intelligence,
counterintelligence and other national security activities
Any other Plan uses and disclosures not described in this Notice will
be made only if you provide the Plan with written authorization,
subject to your right to revoke your authorization, and information
used and disclosed will be made in compliance with the minimum
necessary standards of the privacy regulations.
Your Individual Privacy Rights
You May Request Restrictions on PHI Uses and Disclosures
You may request the Plan to restrict the uses and disclosures of
your PHI:
- To carry out treatment, payment, or health care operations; or
- To family members, relatives, friends, or other persons identified
by you who are involved in your care.
The Plan, however, is not required to agree to your request if the Plan
Administrator or Privacy Officer determines it to be unreasonable--for
example, if it would interfere with the Plan’s ability to pay a claim.
You May Inspect and Copy Your PHI
You have the right to inspect and obtain a copy (in hard copy or
electronic form) of your PHI (except psychotherapy notes and
information compiled in reasonable contemplation of an
administrative action or proceeding) contained in a “Designated
Record Set,” for as long as the Plan maintains the PHI.
A Designated Record Set includes your medical records and billing
records that are maintained by or the Plan. Records include
enrollment, payment, billing, claims adjudication, and case or medical
management record systems maintained, or other information used by
or for the Plan to make decisions about you.
You or your personal representative will be required to complete a
form to request access to the PHI in your Designated Record Set.
Requests for access to your PHI should be made to the Plan’s Privacy
Officer at their address listed on the first page of this Notice. The Plan
reserves the right to charge a reasonable cost-based fee for creating or
copying the PHI or preparing a summary of your PHI.
You Have the Right to Amend Your PHI
You or your Personal Representative have the right to request that the
Plan amend your PHI or a record about you in a designated record set
for as long as the PHI is maintained in the designated record set. You
should make your request to amend PHI to the Privacy Officer at their
address listed on the first page of this Notice.
You Have the Right to Receive an Accounting of the Plan’s PHI
Disclosures
At your request, the Plan will also provide you with an accounting of
disclosures by the Plan of your PHI during the six years (or shorter
period if requested) before the date of your request. The Plan will not
provide you with an accounting of disclosures related to treatment,
payment, health care operations, or disclosures made to you or
authorized by you in writing. If you request more than one accounting
within a 12-month period, the Plan will charge a reasonable, costbased fee for each subsequent accounting.
You Have the Right to Request that PHI be Transmitted to You
Confidentially
The Plan will permit and accommodate your reasonable request to
have PHI sent to you by alternative means or to an alternative location
(such as mailing PHI to a different address or allowing you to
personally pick up the PHI that would otherwise be mailed), if you
provide a written request to the Plan that the disclosure of PHI to your
usual location could endanger you. If you believe you have this
situation, you should contact the Plan’s Privacy Officer to discuss your
request for confidential PHI transmission.
You Have the Right to Receive a Paper or Electronic Copy of This
Notice Upon Request
To obtain a paper or electronic copy of this Notice, contact the Plan’s
Privacy Officer at their address listed on the first page of this Notice.
Breach Notification
If a breach of your unsecured Protected Health Information occurs,
the Plan will notify you.
Your Personal Representative
You may exercise your rights to your Protected Health Information
(PHI) by designating a person to act as your Personal Representative.
Your Personal Representative will generally be required to produce
evidence (proof) of the authority to act on your behalf before the
Personal Representative will be given access to your PHI or be allowed
to take any action for you.
Under this Plan, proof of such authority will include a completed and
signed Authorization for the Use and/or Disclosure of Protected Health
Information form (ben043).
This Plan will NOT automatically recognize your spouse as your Personal Representative and vice versa.
In order for your legal spouse to be your Personal Representative,
you must complete and submit the Authorization for the Use and/or
Disclosure of Protected Health Information form (ben043)to the
Division. The form is available on the Division’s website, Alaska.
gov/pdf/forms/ben043.pdf.
You may also present the Division with a copy of a notarized Health
Care Power of Attorney form allowing one spouse to make decisions
about the other spouse’s health care if they are unable to do so, or a
document demonstrating you are the court-appointed conservator
or guardian for your spouse.
If you have appointed your spouse as your Personal Representative
you can indicate the date the authorization expires. If no expiration
date is listed, this authorization will expire two (2) years from the
date of signature.
The Plan retains discretion to deny access to your PHI to a Personal
Representative to provide protection to those vulnerable people who
depend on others to exercise their rights under these rules and who
may be subject to abuse or neglect.
The Plan will generally consider a parent or guardian as the Personal
Representative of an unemancipated minor (a child generally under age 18) unless the applicable law requires otherwise. Spouses and unemancipated minors may request that the Plan restrict PHI that
goes to family members as described above under the section titled
“Your Individual Privacy Rights.”
The Plan’s Duties
The Plan is required by law to maintain the privacy of your PHI and to
provide you and your eligible dependents with Notice of its legal
duties and privacy practices. The Plan is required to comply with the
terms of this Notice. However, the Plan reserves the right to change its
privacy practices and the terms of this notice and to apply the changes
to any PHI maintained by the Plan.
Notice Distribution: The Notice will be provided to each person
when he or she initially enrolls for benefits in the Retiree Plan (the
Notice is provided in the Plan’s New Enrollment materials). The Notice
is also available on the State of Alaska website. The Notice will also be
provided upon request. Once every three years, the Plan will notify
the individuals then covered by the Plan where to obtain a copy of the
Notice. This Plan will satisfy the requirements of the HIPAA regulation
by providing the Notice to the named insured (covered employee) of
the Plan; however, you are encouraged to share this Notice with other
family members covered under the Plan.
Notice Revisions: If a privacy practice of this Plan is changed
affecting this Notice, a revised version of this Notice will be provided
to you and all participants covered by the Plan at the time of the
change. Any revised version of the Notice will be distributed within
60 days of the effective date of a material change to the uses and
disclosures of PHI, your individual rights, the duties of the Plan, or
other privacy practices stated in this Notice. Because our health plan posts its Notice on its website, we will prominently post the revised Notice on that website by the effective
date of the material change to the Notice. We will also provide the
revised notice, or information about the material change and how to
obtain the revised Notice, in our next annual mailing to individuals
covered by the Plan.
Disclosing Only the Minimum Necessary Protected Health Information
When using or disclosing PHI or when requesting PHI from another
covered entity, the Plan will make reasonable efforts not to use,
disclose, or request more than the minimum amount of PHI necessary
to accomplish the intended purpose of the use, disclosure or request,
taking into consideration practical and technological limitations.
Your Right to File a Complaint
If you believe that your privacy rights have been violated, you may file
a complaint with the Plan in care of the Plan’s Privacy Officer, at the
address listed on the first page of this Notice. Neither your employer
nor the Plan will retaliate against you for filing a complaint.
You may also file a complaint (within 180 days of the date you know
or should have known about an act or omission) with the Secretary of
the U.S. Department of Health and Human Services by contacting
their nearest office as listed in your telephone directory or through
their website, hhs.gov/ocr/about-us/contact-us/index.html or hhs.gov/
ocr/privacy/hipaa/complaints/index.html, or contact the Privacy
Officer for more information about how to file a complaint.
If You Need More Information
If you have any questions regarding this Notice or the subjects
addressed in it, you may contact the Plan’s Privacy Officer at the
address listed at the beginning of this Notice.