HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) SUMMARY OF OUR NOTICE OF PRIVACY PRACTICES This summary describes how the International Union, UAW Health Plan (Health Plan) may use and disclose your Protected Health Information (PHI) to carry out payment activities, health plan operations and for other purposes that are either permitted or required by law. It also explains your rights to access and control your PHI. The attached Notice of Privacy Practices provides more details. This updated Notice and Privacy Practices are effective February 15, 2016. This notice applies to your health benefits provided by the International Union, UAW. It applies to coverage you have under the Health Plan. Health Plan Responsibilities Federal regulations established to comply with the Health Insurance Portability and Accountability Act (HIPAA) requires the Health Plan to maintain the privacy of your PHI. The Health Plan has the right under HIPAA to use and disclose your PHI for payment activities and health plan operations. There are other uses for which the Health Plan is allowed or required to use and disclose your PHI. The Health Plan has voluntarily agreed to limit use and disclosure to those instances in which the law actually requires disclosure or when required as part of regulatory or legal proceedings. The UAW as your employer will not have access to your PHI. Participant Rights As a participant in the Health Plan, you have the following rights regarding your PHI: 1. You have the right to request that the Health Plans restrict the PHI used or disclosed about you for payment or health care operations. The Health Plan is not required to honor your request, but if the Health Plan agrees, it must abide by the restriction. See the attached HIPAA Notice of Privacy Practices for more details. 2. You have the right to inspect and copy your PHI. 3. If you believe your PHI is incorrect or incomplete, you may request that it be amended. 4. You have a right to an accounting of disclosures of your PHI for certain reasons. 5. If you believe that a disclosure of any part of your PHI may somehow endanger you, you may request that the PHI be sent to you in an alternative manner or location. 1
Complaints If you believe your privacy rights have been violated, you may file a complaint with the UAW Privacy Officer and/or Secretary of the U.S. Department of Health and Human Services. To inquire about the use of your PHI, to exercise your rights under HIPAA or to register a complaint: Linda Catanzaro Privacy Officer Employee Benefits & Pensions International Union, UAW 8000 East Jefferson Detroit, MI 48214 Phone: (313) 926-5354 or Department of Health & Human Services The Hubert H. Humphrey Building 200 Independence Avenue, S.W. Washington, DC 20201 www.hhs.gov/ocr You will not be retaliated against for filing a complaint. The Effective Date of this Updated Notice is February 15, 2016. 2
HIPAA NOTICE OF PRIVACY PRACTICES For the International Union, UAW Health Plan THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. You are receiving this Privacy Notice because you are enrolled in an International Union, UAW (Union) Health Plan (Health Plan). The Health Plan is committed to protecting the confidentiality of any health information collected about you. This Notice describes how the Health Plan may use and disclose your Protected Health Information (PHI). PHI is any information created or received by a health care provider, health plan, or health care clearinghouse that relates to your past, present or future physical or mental health condition, or provision of or payment for health care. PHI is information, including demographics, that identifies the individual or may reasonably be used to identify the individual. The Union's Health Plan Workface (Workforce) who administers and manages the Health Plan may use your PHI only for appropriate plan purposes (such as for payment or health care operations), but not for purposes of other benefits not provided by the Health Plan and not for employment-related purposes of the Union. The Workforce must comply with all HIPAA requirements that apply to the Health Plan and protect the confidentiality of your PHI. The Health Plan is required by the Health Insurance Portability and Accountability Act (HIPAA) to provide this Notice to you. Additionally, the Health Plan is required by law to: Maintain the privacy and security of your PHI, and Provide you with a Privacy Notice of its legal duties and privacy practices with respect to your PHI, and Comply with the terms of the Privacy Notice that are currently in effect, and Let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI, and Provide you with certain rights with respect to your PHI, and Follow the duties and privacy practices described in this Notice and provide you with a copy of it, and Not use or share your PHI other than as described in this Notice unless you can tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind; and Follow the terms of the Notice that is currently in effect. We reserve the right to change the terms of this Notice and to make new provisions regarding your PHI that we maintain, as allowed or required by law. If we make any material change to this Notice, we will provide you with a copy of our revised Notice of Privacy Practices by mail to your last known address of record. 3
If you have questions about any part of this Privacy Notice or if you want more information about the privacy practices of the Health Plan, please contact the Privacy Officer listed at the end of this Notice. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION The Health Plan is permitted by law to use and disclose your protected health information (PHI) in certain ways. These are described below, with examples of permitted uses. This Notice does not list every permitted use or disclosure the Health Plan may make. However, all the ways the Health Plan is permitted to use or disclose PHI will fall within one of the categories below. Treatment Purposes: The Health Plan may disclose PHI to a health care provider for the health care provider's treatment purposes; although it is more likely a health care provider would receive your PHI from another health care provider than from the Health Plan. For example, if your Primary Care Physician (PCP) or your treating medical provider refers you to a specialist for treatment, the Health Plan can disclose your PHI so the specialist to whom you have been referred so (s)he can become familiar with your medical condition, prior diagnoses and treatment, and prognosis. Payment Purposes: The Health Plan may use your PHI to determine your eligibility for Health Plan benefits, evaluate and process any requests for coverage and claims for benefits you make, and may review PHI included with claims to reimburse providers for treatment and services rendered. Additionally, the Health Plan may disclose PHI to another group health plan or to a health care provider for the payment purposes of the Health Plan, the other group health plan, or the health care provider. For example, the Health Plan can disclose your PHI to another health plan or payer for purposes of coordinating payment of benefits. Likewise, we may share your PHI with another entity to assist in the adjudication or subrogation of health claims. Health Care Operations Purposes: The Health Plan may use PHI for its own health care operations and may disclose PHI to another group health plan, a health care provider, a medical group or a hospital for the health care operations purposes of the Health Plan, or for certain health care operations purposes of the other entities. Examples of the Health Plan's health care operations include underwriting, premium rating and other activities related to plan coverage; conducting quality assessment and improvement activities; submitting claims for stop-loss coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; and business planning, management and general administration of the Health Plan. To a Business Associate of the Health Plan: The Health Plan may disclose PHI to a Business Associate (BA) of the Health Plan, if a valid Business Associate Agreement is in place between the Business Associate and the Health Plan. A Business Associate is an entity that performs a function on behalf of the Health Plan and that uses PHI in doing so, or provides services to the Health Plan such as legal, actuarial, accounting, consulting or administrative services. Examples of Business Associates include the Health Plan's 4
Third-Party Administrator (TPA) and broker. In order to perform these functions or to provide these services, Business Associates will receive, maintain, use and/or disclose your PHI, but only after they agree in writing with us to implement appropriate safeguards regarding your PHI. For example, we may disclose your PHI to a Business Associate to administer claims or to provide support services, such as utilization management, pharmacy benefit management or subrogation, but only after the Business Associate enters into a Business Associate contract with us. To the International Union, UAW: The Health Plan may also disclose enrollment/disenrollment information to the International Union, UAW as Plan Sponsor for enrollment or disenrollment purposes only, and may disclose summary health information to the Union for the purpose of obtaining premium bids or modifying or terminating the plan. Where Required by Law or Required as Part of a Regulatory or Legal Proceeding: the Health Plan may disclose PHI as required by law or when required as part of a regulatory or legal proceeding. For example, the Health Plan may disclose medical information when required by a court order in a litigation proceeding, or pursuant to a subpoena, or as necessary to comply with Workers' Compensation laws. Prohibited Uses: Your PHI cannot be used for employment purposes without your specific authorization. Genetic information cannot be used to determine whether you will be offered coverage or the price of that coverage. As Required by Law: We will disclose your PHI when required to do so by federal, state or local law. For example, we may disclose your PHI when required by national security laws or public health disclosure laws. To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. Military and Veterans: If you are a member of the armed forces, we may release your PHI as required by military command authorities. DISCLOSURES OF PROTECTED HEALTH INFORMATION WITH AUTHORIZATION Under HIPAA, the Health Plan is allowed to use or disclose your PHI for various activities listed below. The Health Plan is voluntarily restricting itself to those disclosures outlined above. Should a request be made for a disclosure that does not meet one of the above categories, the Health Plan will only make such a disclosure with your authorization or at the request of your personal representative, so long as you provide us with written notice/authorization and supporting documentation (i.e., power of attorney). 5
Note: Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief of the following: a. You have been, or may be, subjected to domestic violence, abuse or neglect by such person; or b. Treating such person as your personal representative could endanger you; and c. In the exercise of professional judgment, it is not in your best interest to treat the person as your personal representative. Authorizations: Other uses or disclosures of your PHI not described above will be made only with your written authorization. You may revoke written authorization at any time, as long as the revocation is in writing. Once we receive your written revocation, it will be effective only for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation. Workers Compensation: We may release your PHI for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness. Public Health Risks: We may disclose your PHI for public safety health actions such as: To prevent or control disease, injury, or disability; or To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition. Lawsuits and Disputes: If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested. Law Enforcement: We may disclose your PHI if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons or similar process. Required Disclosures We are required to disclose your PHI as follows. Government Audits: We are required to disclose your PHI to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule. 6
Disclosures to You: When you request, we are required to disclose to you the portion of your PHI that contains medical records, billing records, and any other records used to make decisions regarding your healthcare benefits. We are also required, when requested, to provide you with an accounting of most disclosures of your PHI if the disclosure was for reasons other than for payment, treatment, or healthcare operations, and if the PHI was not disclosed pursuant to your individual authorization. Once you have authorized disclosure of your PHI, you may revoke the authorization at any time. The revocation will only be effective for disclosures subsequent to the revocation. Examples of instances in which the Health Plan is voluntarily restricting its right to use and disclose your PHI include: Public Health Activities such as preventing or controlling diseases, injury or disability; reporting abuse or neglect; reporting domestic violence; report to the Food and Drug Administration on products and reactions to medications; and reporting disease or infection exposure. Law Enforcement or Specific Government Functions such as identifying or locating a suspect, fugitive, material witness or missing person; and other law enforcement purposes. Research regardless of whether or not required measures to protect your privacy are in place. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION You have the following rights with respect to your PHI. To submit one of the requests listed below, you must submit a written request directly to the Health Plan or to the International Union, UAW Privacy Officer, Office of the Secretary Treasurer, 8000 E. Jefferson, Detroit, MI 48214. The right to inspect and copy a designated record set of your PHI. The right to request restrictions on certain uses and disclosures of PHI (although the Health Plan is not required to agree to a requested restriction). The right to inspect and copy certain PHI that may be used to make decisions about your healthcare benefits. To inspect and copy your PHI, you must submit your request in writing to the Privacy Officer. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed by submitted a written request to the Privacy Officer. 7
The right to receive confidential communications of PHI, if you believe your Health Plan's usual method of communicating PHI may endanger you. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you at work or by mail only. To request confidential communications, you must make your request in writing to the Privacy Officer. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests if you clearly provide information that the disclosure or all or part of your protected information could endanger you. The right to amend PHI you feel is incorrect. If the Health Plan denies your request you will be allowed to have a statement concerning the dispute inserted with your PHI. If you think the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan. To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In additional, if you ask us to amend information, we may deny your request for the following reasons: - It is not part of the medical information kept by or for the Plan; - It was not created by us, unless the person or entity that created the information is no longer available to make the amendment; - It is not part of the information that you would be permitted to inspect and copy; or - It is already accurate and complete. If we deny your request, you have the right to file a Statement of Disagreement with us and any future disclosures of the disputed information will include your statement. If we deny your request, we will tell you why in writing within 60 days. The right to receive an accounting of disclosures the Health Plan has made of your PHI. The Health Plan is not required to, and it will not, account for disclosures made for treatment, payment or health care operations, pursuant to your Authorization, to you, to disclosures made to friends or family in your presence because of an emergency, disclosures for national security purposes and disclosures incidental to otherwise permissible disclosures. When you submit your written request to the Privacy Officer, please note the time period for which you want an accounting, and the format in which you wish to receive it (e.g., paper or electronically). The Health Plan will not account for disclosures made more than six years prior to your request, nor for disclosures made before HIPAA became effective for the Health Plan [April 14, 2003]. The Health Plan will provide one accounting of disclosures free of charge once every twelve (12) months. 8
You have the right to request a restriction or limitation on your PHI that we use or disclose for payment or health care operations. You also have the right to request a limit on your PHI that we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a surgery that you had. Except as provided in the next paragraph, we are not required to agree to your request. However, if we do agree to the request, we will honor the restriction until you revoke it or we notify you. Effective February 17, 2010 (or such other date specified as the effective date under applicable law), we will comply with any restriction request if: (1) except as otherwise required by law, the disclosure is to the Health Plan for purposes of carrying out payment or healthcare operations (and is not for purposes of carrying out treatment); and (2) the PHI pertains solely to a health care item or service for which the heath care provider involved has been paid out of pocket or in full by someone other than the Health Plan (and you are not seeking reimbursement from the Health Plan) To request restrictions, you must make your request in writing to the Privacy Officer and state (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply: for example, disclosures to your spouse. The right to file a complaint if you feel your privacy rights have been violated. For details, see subsequent section of this Privacy Notice entitled "The Health Plan's Grievance Procedures." The right to receive a paper copy of this Notice of Privacy Practices upon request to the Health Plan, even if you have previously agreed to receive this Notice electronically. THE HEALTH PLAN AND YOUR PROTECTED HEALTH INFORMATION The Health Plan is a Covered Entity (CE) and has responsibilities under HIPAA regarding uses and disclosure of PHI. The Health Plan has a legal obligation to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy practices with respect to PHI. The Health Plan is required to abide by the terms of the current Notice of Privacy Practices (Notice). The Health Plan reserved the right to change the terms of this Notice at any time and to make the revised Notice provisions effective for all PHI the Health Plan maintains, even PHI obtained prior to the effective date of the revisions. If the Health Plan revises its Notice, it will notify you of these changes by mailing the revised Notice by first class mail. 9
THE HEALTH PLAN'S GRIEVANCE PROCEDURES If you believe your PHI has been impermissibly used or disclosed, or that your privacy rights have been violated in any way, you may file a complaint with the Health Plan or with the Office for Civil Rights of the United States Department of Health and Human Services. To file a complaint, you must submit your written complaint to the: Linda Catanzaro Privacy Officer Employee Benefits & Pensions International Union, UAW 8000 East Jefferson Detroit, MI 48214 Phone: (313) 926-5354 or Department of Health & Human Services The Hubert H. Humphrey Building 200 Independence Avenue, S.W. Washington, DC 20201 www.hhs.gov/ocr All complaints must be submitted in writing. You will not be penalized, or in any other way retaliated against, for filing a complaint with the Office for Civil Rights or with us. LC:lmb/opeiu494 10