Notice of Privacy Practices for The State Health Plan for Teachers and State Employees
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED BY THE PLAN AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US.
Original Effective Date: April 14th, 2003
Revised Effective Date: September 23rd, 2013
A federal law, the Health Insurance Portability and Accountability Act (HIPAA), requires that health Plan and health care providers protect the privacy of certain medical information. This notice covers the medical information practices of the State Health Plan for Teachers and State Employees. This notice is intended to inform you of your rights under the privacy provisions of HIPAA and the HIPAA obligations imposed on the Plan. The Plan is required to maintain the privacy of PHI in accordance with HIPAA (as summarized herein), provide this Notice to covered individuals, and notify affected individuals following a "breach" of unsecured PHI (as defined by HIPAA). The privacy laws of a particular state or other federal laws might impose a stricter privacy standard than HIPAA. If these stricter laws apply, the Plan will comply with the stricter law to the extent such laws are not otherwise preempted. It is necessary that certain employees of the plan sponsor be permitted to access, use, and/or disclose the minimum amount of your PHI to perform certain plan administration functions. In accordance with HIPAA, we restrict access to your health plan information only to certain employees who need to know that information to perform plan administration and we maintain physical, electronic, and procedural safeguards that comply with federal regulations to guard your health plan information. If you have general questions about your medical claims information maintained by the Plan, call or write to the privacy contact identified at the end of this notice. For a printer-friendly version of this notice, click here.
What information is protected?
Only identifiable health information that is created or received by or on behalf of the Plan is protected by HIPAA. This health information is called "protected health information" (PHI).
How the Plan May Use and Disclose your PHI
This section describes how the Plan can use and disclose PHI. Please note that this notice does not list every use or disclosure; instead it gives examples of the most common uses and disclosures.
It is necessary for certain third parties to assist the Plan in administering your health benefits under the Plan. These entities keep and use most of the PHI maintained by or on behalf of the Plan such as information about your health condition, the health care services you receive, and the payments for such services. They use and disclosure your PHI to process your benefit claims and to provide other services necessary to plan administration. They are legally obligated to use the same privacy protections as the Plan.
Primary Uses and Disclosures of PHI
- The Plan may disclose your PHI so that your doctors, dentists, pharmacies, hospitals and other health care providers may provide you with medical treatment.
- The Plan also may send your PHI to doctors for patient safety or other treatment-related reasons.
- The Plan may use and disclose your PHI to facilitate payment of benefits under the Plan; including determining eligibility for benefits, calculating your benefits under the Plan, paying your health care providers for treating you, calculating your copays and coinsurance amounts, deciding claims appeals and inquiries, and/or coordinating coverage. For example, the Plan may disclose information about your medical history to a physician to determine whether a particular treatment is experimental, investigational, or medically necessary or to decide if the Plan will cover the treatment.
- The Plan may use and disclose your PHI for additional related health care operations necessary to operate the Plan, including but not limited to: underwriting and soliciting bids from potential insurance carriers; merger and acquisition activities; setting premiums; deciding employee premium contributions; submitting claims to the Plan' stop-loss (or excess loss) carrier; conducting or arranging for medical review; legal services; audit services; and fraud and abuse detection programs. NOTE: The Plan will not use or disclose "genetic information" (as defined in 45 C.F.R. 160.103) for purposes of underwriting.
- The Plan may use your PHI to contact you or give you information about treatment alternatives or other health-related benefits and services that may be of interest to you.
Other Uses and Disclosures of PHI
- The Plan is required to disclose your PHI to the Secretary of the U.S. Department of Health and Human Services if the Secretary is investigating or determining compliance with HIPAA.
- The Plan will disclose PHI about you when required to do so by federal, state or local law.
- The Plan may release your PHI for Workers' Compensation or similar programs.
- The Plan may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
- If you are an organ donor, the Plan may release your PHI to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
- If you are a member of the armed forces, the Plan may release your PHI as required by military command authorities.
- The Plan may disclose your PHI for certain public health activities including but not limited to:
- Disclosure to a public health authority that is authorized by law to collect or receive information for the purpose of preventing or controlling disease and conducting public health surveillance and public health investigations;
- Disclosure to a person who has responsibility to the FDA regarding the quality, safety, or effectiveness of an FDA-regulated product or activity; and
- Disclosure to a person who may have been exposed to a communicable disease or who may be otherwise at risk of contracting or spreading a disease or condition, if the covered entity is authorized by law to notify such person.
- If the Plan reasonably believe that you or a child has been the victim, of domestic or child abuse or neglect, the Plan may disclose PHI to certain entities authorized by law to receive such information provided certain conditions are satisfied (in most cases your agreement is necessary unless you are incapacitated or the Plan reasonably believe that disclosure is necessary to prevent harm or threat to life).
- The Plan may disclose your PHI to a health oversight agency for activities authorized by law (for example, audits, investigations, inspections, and licensure).
- If you are involved in a lawsuit or a dispute, the Plan may disclose your PHI in response to a court or administrative order.
- The Plan may also disclose your PHI in response to a subpoena, discovery request, or other lawful process provided that, if the Plan is not a party to the litigation, good faith attempts have been made to tell you about the request or to obtain an order protecting the information requested.
- The Plan may release your PHI if asked to do so by a law enforcement official in certain instances.
- The Plan may disclose PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining the cause of death, or other duties as authorized by law.
- The Plan may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
- If you are an inmate of a correctional institution or under the custody of a law enforcement official, the Plan may release your PHI to the correctional institution or law enforcement official.
- Using its best judgment, the Plan may disclose your PHI to a family member, other relative, or close friend. Such a use will be based on how involved the person is in your care or payment that relates to that care.
- The Plan may release claims payment information to spouses, parents, or guardians, unless you specifically object in writing to the Privacy Manager identified in the Notice.
Other uses and disclosures of your PHI that are not described above will be made only with your written authorization. For example, an authorization is required in the following instances: (i) any use or disclosure of psychotherapy notes except as otherwise permitted in 45 C.F.R. 164.508(a)(2); (ii) any use or disclosure for "marketing" except as otherwise permitted in 45 C.F.R. 164.508(a)(3); (iii) any disclosure which constitutes a sale of PHI. If you authorize the Plan to use or disclose your PHI, you may revoke the authorization at any time in writing. However, your revocation will only stop future uses and disclosures that are made after the Plan receive your revocation. It will not have any effect on the prior uses and disclosures of your PHI.
Your Rights Regarding PHI
You have the following rights regarding PHI the Plan has about you:
- You have the right to inspect and copy your PHI that may be used to make decisions about your benefits. To inspect and copy your PHI that may be used to make decisions about you, you must submit your request in writing to the appropriate privacy contact listed on page If you request a copy of this information, the Plan may charge a fee for the costs of copying, mailing or other supplies associated with your request. The Plan may deny your request to inspect and copy your PHI in certain very limited circumstances. HIPAA provides several important exceptions to your right to access your PHI. For example, you will not be permitted to access psychotherapy notes or information compiled in anticipation of, or for use in, a civil, criminal or administrative action or proceeding. The Plan will not allow you to access your PHI if these or any of the exceptions permitted under HIPAA apply. If you are denied access to your PHI, you may request a review of the denial.
- If you feel that PHI the Plan have about you is incorrect or incomplete, you may ask the Plan to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan. To request an amendment, you must submit your request in writing to the appropriate Privacy Contact listed below. Your request must list the specific PHI you want amended and explain why it is incorrect or incomplete. The Plan may deny your request for an amendment if it is not in writing or does not list why it is incorrect or incomplete. In addition, the Plan may deny your request if you ask the Plan to amend information that is:
If the Plan denies your request, they must provide you a written explanation for the denial and an explanation of your right to submit a written statement disagreeing with the denial no later than 60 days after receipt of your request.
- Not part of the PHI kept by or for the Plan;
- Not created by the Plan or its third party administrators;
- Not part of the information which you would be permitted to inspect and copy; or
- Accurate and complete.
- When you request, we are required to disclose to you the portion of your PHI that contains medical records, billing records, and any other records used to make decisions regarding your health care benefits. You also have the right to request an "accounting" of certain disclosures of your PHI. The accounting will not include (1) disclosures for purposes of treatment, payment, or health care operations; (2) disclosures made to you; (3) disclosures made pursuant to your authorization; (4) disclosures made to friends or family in your presence or because of an emergency; (5) disclosures for national security purposes; and (6) disclosures incidental to otherwise permissible disclosures. To request an accounting, you must submit a written request to the Privacy Contact identified in this Notice. Your request must state a time period of no longer than six (6) years.
- You have the right to request that the Plan communicate with you about health plan matters in a certain way or at a certain location. We are only obligated to comply with such a request if the disclosure will endanger you. For example, you can ask that the Plan only contact you at work or by mail. You also have the right to request a restriction or limitation on your protected health information that we use or disclose for treatment, payment, or health care operations or for disclosures to other individuals involved in your care. We are generally not obligated to comply with any request for restrictions or limitations. To request alternative communications or restrictions and/or limitations, you must submit your request in writing to the appropriate privacy contact listed below or you can call 888-234-2416. Your request must specify how or where you wish to be contacted.
Changes to This Notice
The Plan has the right to change this notice at any time. The Plan also have the right to make the revised or changed notice effective for medical information the Plan already have about you as well as any information received in the future. You may request a copy by calling 888-234-2416.
If you believe your privacy rights have been violated, you may file a complaint with the Plan or with the Secretary of the Department of Health and Human Services.
To file a complaint with the Plan, contact the Privacy Contact identified in this Notice. You will not be penalized or retaliated against for filing a complaint.
The Privacy Contact is:
State Health Plan
Attention: HIPAA Privacy Officer,
4901 Glenwood Avenue, Suite 300,
Raleigh, NC 27612-3820