Author: communications

• The uses and disclosures of PHI that may be made by the Plan;
• The rights of individuals under HIPAA privacy rules;
• The Plan’s legal duties with respect to the PHI; and
• Other information as required by the HIPAA privacy rules.

A privacy notice will be sent to Plan participants informing them that the District has access to PHI in connection with its plan administrative functions. The privacy notice will also imform them of the District’s complaint procedures, the name and telephone number of the contact person, and the date of the notice.
The notice of privacy practices will be placed on the District’s website. The notice will also be individually delivered to all participants:

• At the time of an individual’s enrollment in the Plan
• To a person requesting the notice; and
• Within 60 days after a material change to the notice.

The Plan will also provide notice of availability of the privacy notice at least once every three years.

1. Not use or further disclose PHI other than as permitted by the Plan documents or as required by law;
2. Ensure that any agents or subcontractors to whom it provides PHI received from the Plan agree to the same restrictions and conditions that apply to the District;
3. Not use or disclose PHI for employment-related actions;
4. Report to the Privacy Official any use or disclosure of the information that is inconsistent with the permitted uses or disclosures;
5. Make PHI available to Plan participants, consider their amendments and, upon request, provide them with an account of PHI disclosures;
6. Make the District’s internal practices and records relating to the use and disclosure of PHI received from the Plan available to the Department of Health and Human Services (DHHS) upon request; and
7. If feasible, return or destroy all PHI received from the Plan that the District still maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.
8. The Plan document must also require the District to (1) certify to the Privacy Official that the Plan documents have been amended to include the above restrictions and that the District agrees to those restrictions; and (2) provide adequate firewalls.

1. Use: The sharing, employment, application, utilization, examination, or analysis of individually identifiable health information by any person working for or within the Insurance Office of the District, or by a Business Associate of the Plan.
2. Disclosure: For information that is protected health information, disclosure means any release, transfer provision of access to, or divulging in any other manner of individually identifiable health information to persons not employed by or working with the Insurance Office of the District.

1. Director of Insurance Services who performs functions directly on behalf of the group health plan.
2. Employees in the District Insurance Office who have access to PHI on behalf of the District for use while performing daily responsibilities
   These employees may use and disclose PHI for Plan administrative functions, and may disclose PHI to other employees with access for plan administrative functions. However, the PHI disclosed must be limited to the minimum amount necessary to perform the plan administrative function. Employees with access may not disclose PHI to other employees unless an authorization is in place or the disclosure is otherwise in compliance with this policy.

1. Payment: Payment includes activities undertaken to obtain Plan contributions or to determine or fulfill the Plan’s responsibility for provision of benefits under the Plan, or to obtain or provide reimbursement for health care. Payment also includes:
   1. Eligibility and coverage determinations, including coordination or benefits and adjudication or subrogation of health benefit claims;
   2. Risk adjusting based on enrollee status and demographic characteristics; and
   3. Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess loss insurance) and related health care data processing.
      PHI may be disclosed for purposes of the Plan’s own health care operations. PHI may be disclosed to another covered entity for purposes of the other covered entity’s quality assessment and improvement, case management, or health care fraud and abuse detection programs, if the other covered entity has (or had) a relationship with the participant and the PHI requested pertains to that relationship.
2. Health Care Operations: Health care operations means any of the following activities to the extent that they are related to Plan administration:
   1. Conducting quality assessment and improvement activities;
   2. Reviewing health plan performance;
   3. Underwriting and premium rating;
   4. Conducting or arranging for medical review, legal services and auditing functions;
   5. Business planning and development; and
   6. Business management and general administrative activities.

1. The disclosure is to the individual who is the subject of the information (see the policy for “Access to Protected Information and Request for Amendment” that follows);
2. The disclosure is made to HHS for purposes of enforcing of HIPAA; or
3. The disclosure is required by law.

1. About victims of abuse, neglect or domestic violence;
2. For judicial and administrative proceedings;
3. For law enforcement purposes;
4. For public health activities;
5. For health oversight activities;
6. For cadaveric organ, eye or tissue donation purposes;
7. For certain limited research purposes;
8. To avert a serious threat to health or safety;
9. For specialized government functions;
10. That relate to workers’ compensation programs;
11. For treatment purposes; and
12. About decedents.

1. Uses or disclosures made to the individual;
2. Uses or disclosures made pursuant to a valid authorization;
3. Disclosures made to the Department of Labor (DOL);
4. Uses or disclosures required by law; and
5. Uses or disclosures required to comply with HIPAA.

All other disclosures must be reviewed on an individual basis with the Privacy Official to ensure that the amount of information disclosed is the minimum necessary to accomplish the purposes of the disclosure.

1. Performs or assists in performing a Plan function or activity involving the use and disclosure of protected health information, including claims processing or administration, data analysis, underwriting, etc.
2. Provides legal, accounting, actuarial, consulting, data aggregation, management, accreditation, or financial services, where the performance of such services involves giving the service provider access to PHI.

1. The enrollment, payment and claim adjudication record of an individual maintained by or for the Plan; or;
2. Other PHI used, in whole or in part, by or for the Plan to make coverage decisions about an individual.

1. To carry out treatment, payment or health care operations;
2. To individuals about their own PHI;
3. Incident to an otherwise permitted use or disclosure;
4. Pursuant to an authorization;
5. For purposes of creation of a facility directory or to persons involved in the patient’s care or other notification purposes;
6. As part of a limited data set;
7. To correctional institutions or law enforcement when the disclosure was permitted without authorization; or
8. For other national security or law enforcement purposes.

The Plan shall respond to an accounting request within 60 days. If the Plan is unable to provide the accounting within 60 days, it may extend the period 30 days, provided that it gives the participant notice including the reason for the delay and the date the information will be provided.
The accounting must include the date of the disclosure, the name of the receiving party, a brief description of the information disclosed, and a brief statement of the purpose of the disclosure, or a copy of the written request for disclosure, if any.
The first accounting in any 12-month period shall be provided free of charge. Subsequent accountings will be charged a fee for time and material.