Policy 10.02: Health Insurance Portability and Accountability Act (HIPAA) Policy and Notice of Privacy Practices

I.   Policy

It is the policy of Quincy College to protect the privacy of employee personal health information in compliance with applicable laws. This type of information is retained because the College provides group health insurance benefits through the City of Quincy. Under federal law, employee health information, known as protected health information (PHI), is information about you, including  demographic  information, that may identify you and that relates to health care services provided to you, the payment of health care services provided to you, or your physical or mental health or condition in the past, present or future. This Notice of Privacy Practices describes how the College, and/or representatives of the City of Quincy, may use and disclosed your PHI and your rights to access and control this information.

As a group health plan, we are required by Federal law to maintain the privacy of PHI and to provide you with this notice of our legal duties and privacy practices. We are required to abide by the terms of this Notice of Privacy Practices. The College reserves the right to change the terms of this notice at any time and is obligated to abide by the terms of the current notice. Any change in the terms of this Notice will be effective for all PHI that we are maintaining at that time. If a change is made to this Notice, a copy of the revised Notice will be provided to all individuals covered under  the plan at that time.

II.   Procedures

Usesand Disclosures:

Treatment, Payment and Health Care Operations Federal law allows a group health plan to use and disclose PHI, for the purposes of treatment, payment and health care operations, without your consent or authorization. Examples of permitted uses and disclosures that we, as a group health plan, may make under each section are listed below:

Treatment:

Treatment refers to the provision and coordination of health care by a doctor, hospital or  other health care provider. As a group health plan administrator, we do not provide treatment.

Payment:

Payment refers to the activities of a group health plan in collecting premiums and paying claims under the plan for healthcare services you receive. Examples of uses and disclosures under this section include the sending of PHI to an external medical review company to determine the medical necessity or experimental status of a treatment; sharing PHI with other insurers to determine coordination of benefits or settle subrogation claims; providing PHI to the plan's UR Company for pre-certification or case management services; providing PHI in the billing, collection and payment of and fees to plan vendors such as PPO Networks, UR Companies, Prescription Drug Card Companies and reinsurance carriers; and sending PHI to a reinsurance carrier to obtain reimbursement of claims paid under the plan.

Health Care Operations:

Health Care Operations refers to the basic business functions necessary to operate a group health plan. Examples of uses and disclosures under this section include conducting quality assessment studies to evaluate the plan’s performance or the performance of a particular network or vendor; the use of PHI indetermining the cost impact of  benefit  design  changes; the disclosure of PHI to  underwriters for the purpose of calculating premium rates and providing reinsurance quotes to the plan; the disclosure of PHI to stop-loss or reinsurance carriers to obtain claim reimbursements to the plan; disclosure of PHI to plan consultants who provide legal, actuarial and auditing services to the plan;and use of PHI in general data analysis used  in the long term management and planning for the plan and company.

Other Uses and Disclosures Allowed Without Authorization:

Federal law also allows a group health plan to use and disclose PHI, without your consent or authorization, in the following ways:

• To you, as the covered
• To a personal representative designated by you to receive PHI or a personal representative designated by law such as the parent or legal guardian of child, or the surviving family members or representative of the estate of a deceased
• To the Secretary of Health and Human Services (HHS) or any employee of HHS as part of an investigation to determine our compliance with the HIPAA Privacy Rules.
• To a Business Associate as part of a contractual agreement to perform services for the group health
• To a health oversight agency, such as the Department of Labor (DOL), the Internal Revenue Service (IRS) and the Insurance Commissioner's Office, to respond to inquiries or investigations of the plan, requests to audit the plan, or to obtain necessary licenses.
• In response to a court order, subpoena, discovery. request or other lawful, judicial or administrative proceeding.
• As required for law enforcement purposes. For example to notify authorities of a criminal act.
• As required to comply with Workers' Compensation or other similar programs established by law.
• To the Plan Sponsor, as necessary to carry out administrative functions of the plan such as evaluating renewal quotes for reinsurance of the plan, funding check registers, reviewing claim appeals, approving subrogation settlements and evaluating the performance of the plan.
• In providing you with information about treatment alternatives and health services that may be of interest to you as a result of a specific condition that the plan is case managing.

The examples of permitted uses and disclosures listed above are not provided as an all- inclusive list of the ways in which PHI may be used.They are provided to describe in general the types of uses and disclosures that may be made.

Uses and Disclosures with Your Authorization:

Other uses and disclosures of your PHI will only be made upon receiving your written authorization. You may revoke an authorization at any time by providing written notice to  us that you wish to revoke an authorization. We will honor a request to revoke as of the day it is received and to the extent that we have not already used or disclosed your PHI in  good faith with the authorization.

Your Rights in Relation to PHI:

Right to Request Restrictions on Uses and Disclosures

You have the right to request that the plan limit its uses and disclosures of PHI in relation to  treatment, payment and health care operations or not use or disclose your PHI for these reasons at all. You also have the right to request the plan restrict the use or disclosure of your PhI to family members or personal representatives. Any such request must be made  in writing to the Privacy Contact listed in this Notice and must state the specific restriction requested and to whom that restriction would apply.

The plan is not required to agree to a restriction that you request. However, if it does agree to the requested restriction, it may not violate that restriction except as necessary to allow  the provision of emergency medical care to you.

Right to Receive Confidential Communication

You have the right to request that communications involving PHI be provided to you at an alternative location or by an alternative means of communication. The plan is required to accommodate any reasonable request if the normal method of disclosure would endanger you and that danger is stated in your request. Any such request must be made in writing to the Privacy Contact listed in this Notice.

Right to Access to Your Protected Health Information

You have the right to inspect and copy your PHI that is contained in a designated record set for as long as the plan maintains the PHI. A designated record set contains claim information, premium and billing records and any other records the plan has created in making claim and coverage decisions relating to you. Federal law does prohibit you from having access to the following records psychotherapy notes; information complied in reasonable anticipation of, or for use in a civil, criminal or administrative action or proceeding; and PHI that is subject to a law that prohibits access to that information. If your request for access is denied, you may have a right to have that decision reviewed. Requests for access to your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Amend Protected Health Information

You have the right to request that PHI in a designated record set be amended for as long as the plan maintains PHI.The plan may deny your request for amendment if it determines that the PHI was not created by the plan, is not part of designated record set, is not information that is available for inspection, or that the PHI is accurate and complete. If your request for amendment is declined, you have the right to have a statement of disagreement included with the PHI and the plan has a right to include a rebuttal to your statement a copy of which will be provided to you. Requests for amendment of your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Receive an Accounting of Disclosures

You have the right to receive an accounting of all disclosures of your PHI that the plan has made, if any, for reasons other than disclosures for treatment, payment and health care operations, as described above, and disclosures made to you or your personal representative. Your right to an accounting of disclosures applies only to PHI created by the plan after April 14, 2003 and cannot exceed a period of six years prior to the date of your request. Requests for an accounting of disclosures of your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Receive a Paper Copy of this Notice

You have the right to receive a paper copy of this Notice upon request. This right applies even if you have previously agreed to accept this Notice electronically. Requests for a paper copy of this Notice should be directed to the Human Resources Privacy Contact listed in this Notice. 

Complaints:

You may bring your complaint to the College's Human Resources Department by contacting Human Resources at 617-984-1611 located at President’s Place 1^st floor. You may file a complaint with the College by notifying the Human Resources. Grievance policy and procedures will be implemented and it is unlawful for any person or persons to retaliate against an individual for putting forth a complaint. Investigative procedures outlines in the  Harassment policy shall pertain to complaints of this nature as necessary for implementation of fair and consistent practices.

You may also bring your complaint to the Secretary of Health and Human Services if you believe  your privacy rights have been violated by the College. You may contact the Office of Civil Rights, Department of Health and Human services at 200 Independence Avenue, SW, Washington D.C, 20201.

Complaints should be filed in writing with the Privacy Contact listed I this Notice.The plan will not retaliate against you for filing a complaint.

Privacy Contact: You may contact the Privacy Officer for the plan through your  employer's Human Resources Department at 617-984-1611.

Effective Date of Notice: Under the auspices of the City of Quincy, Quincy College published this notice and it becomes effective on April 14, 2003.

Original: June 2006