HIPAA Policy

“Notice of Privacy Practices”

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. “Protected health information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the past, present or future payment for the provision of health care to you.

We are required by Federal law to maintain the privacy of protected health information and to provide you with this notice of our legal duties and privacy practices with respect to protected health information. We will adhere to all state and Federal laws or regulations that provide additional privacy protections. In the event of a breach of unsecured PHI, we are required to notify you in accordance with Federal and state law.

We are required to abide by the terms of this Notice of Privacy Practices, but reserve the right to change the Notice at any time. Any change in the terms of this Notice will be effective for all PHI that we are maintaining at that time. If a material change is made to this Notice, a copy of the revised Notice will be mailed within sixty (60) days of the revision to all individuals covered under the plan at that time.

If you have questions about any part of this Notice or if you want more information about the privacy practices at Central States Indemnity Co. of Omaha, please contact the Privacy Compliance Department at P.O. Box 10817, Clearwater, Florida 33757-8817 or by calling toll-free (855)-664-5517.

How We May Use or Disclose Your Health Information.

The following categories describe the ways that we may use or disclose your health information.  For each category of uses and disclosures, we will explain what we mean and present some examples.  Not every use or disclosure will be listed, however all the ways we are permitted to use and disclose information will fall within one of the categories.

Treatment, payment or healthcare operations.

Federal law permits Central States Indemnity Co. of Omaha to use and disclose your PHI without your authorization or consent for the purposes of treatment, payment and healthcare operations.

• Treatment:  Treatment refers to the provision, coordination, or management of health care and related services by a doctor, hospital or other health care provider.  As a health plan we do not provide treatment.
• Payment:  We may use or disclose information about you to determine eligibility for plan benefits, obtain premiums, facilitate payment for the treatment or services you receive from healthcare providers, determine plan responsibility for benefits, or to coordinate benefits.  For example, payment functions may include sharing PHI with Medicare or other health plans for purposes of coordination of benefits; reviewing PHI to determine medical necessity of services received; providing PHI to vendors for the collection and payment of fees for Prescription Drug Card benefits.
• Healthcare Operations:  Healthcare operations refer to the basic business functions necessary to operate as an insurance plan.  Some examples of uses and disclosures permitted as part of healthcare operations include but are not limited to, the disclosure of PHI for underwriting, premium rating and other activities relating to plan coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs.  We may disclose PHI to consultants who provide legal, actuarial and auditing services to the plan.  Operations also include the use and disclosure of PHI for business planning, management and general administration of the plan.  We will share your protected health information with third party “business associates” that perform various activities (e.g., claim administration services) on behalf of the plan.  

Other uses and disclosures permitted without authorization

Federal law also allows a health plan to use and disclose PHI, without your authorization or consent, in the following ways:

• To you or a personal representative designated by you or designated by law to act for you.
• To the Secretary of Health and Human Services (HHS) or any employee of HHS as part of an investigation to determine our compliance with the Federal Privacy laws.
• To a Business Associate as part of a contracted agreement to perform services for the health plan.
• To legally authorized public health authorities such as the Food and Drug Administration, to report adverse reactions to controlled medications.
• To a health oversight agency, such as the Insurance Commissioner’s office, to respond to inquiries or investigations of the plan or requests to audit the plan.
• For law enforcement purposes such as in response to a court order, subpoena, discovery request or other lawful judicial or administrative proceeding.  
• As required by law.
• As required to comply with Worker’s Compensation or other similar programs established by law.
• As necessary, to assist medical examiners and funeral directors to carry out their duties.
• To organ procurement organizations or other such agencies to assist in the procurement of organs for transplantation. 
• For research purposes. 
• To avert a serious threat to the health or safety or yourself or another person or the public.
• For some specialized government functions.  For example, the Department of Veterans Affairs may use or disclose your PHI to determine eligibility or to provide benefits under the department.

The examples of uses and disclosures listed above are not provided as an all-inclusive list of the ways in which PHI may be used.  They are provided to describe the general uses and disclosures that may be made.

Uses and disclosures requiring your written authorization

The following uses and disclosures of your PHI will be made only with your written authorization:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes; and
• Disclosures that constitute a sale of your PHI

Other uses and disclosures of PHI not covered by this Notice or the laws that apply to us will only be made upon receiving your valid written authorization.  You may revoke an authorization at any time by providing written notice to us that you wish to revoke an authorization.  We will honor a request to revoke as of the day it is received and to the extent that we have not already used or disclosed your PHI in good faith with the authorization.

Uses and Disclosures Requiring an Opportunity to Agree or Disagree

Unless you object, we may disclose to a member of your family, a close friend or any person you identify, your PHI that directly relates to that person’s involvement with the payment related to your health care.  If you are unable to agree or object to this disclosure and in our professional judgment it is in your best interest to do so, we will disclose only such information is relevant to that individual’s involvement in your care.  For example, if we receive a telephone call regarding the payment status of a claim submitted to us, we will release only the information related to that particular claim. 

Prohibited Uses and Disclosures

Federal law prohibits Central States Indemnity Co. of Omaha from using and disclosing your genetic information for underwriting purposes.

Your Rights in Relation to Protected Health Information

Right to Request Restrictions on Uses and Disclosures.

You have the right to request that the plan limit its uses and disclosures of PHI in relation to treatment, payment or healthcare operations. You also have the right to request the plan restrict the disclosure of PHI to family members or personal representatives. Any such request must be made in writing to the Privacy Compliance Office listed in this Notice and must state the specific restriction and to whom the restriction should apply.

The plan is not required to agree to the restriction that you request. However, if it does agree to the requested restriction, it may not violate that restriction except as necessary to allow provision of emergency medical care to you.

Right to Request Confidential Communications.

You have the right to request that communications involving PHI be provided to you at an alternative location or by alternative means. The plan is required to accommodate any reasonable request if the normal method of disclosure would endanger you and that danger is stated in your request. Any such request must be made in writing to the Privacy Compliance Office listed in this notice.

Right to Access Your Protected Health Information.

You have the right to inspect and copy your PHI that is contained in a designated record set for as long as the plan maintains the PHI. A designated record set may contain claim information, premium records and any other records the plan has created in making claim and coverage decisions relating to you. Federal law does prohibit you from having access to the following records: psychotherapy notes; information complied in the reasonable anticipation of, or for use in a civil, criminal or administrative action or proceeding; and PHI that is subject to a law that prohibits access to that information. If your request for access is denied, you may have a right to have that decision reviewed. Requests for access to your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Amend Protected Health Information.

You have the right to request that PHI in a designated record set be amended for as long as the plan maintains the PHI. The plan may deny your request for amendment if it determines that the PHI was not created by the plan, is not part of the designated record set, is not information available for inspection, or that the PHI is accurate and complete. If your request for amendment is declined, you have the right to have a statement of disagreement included with the PHI. The plan has the right to include a rebuttal to your statement, a copy of which will be provided to you. Requests for amendment of your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Receive an Accounting of Disclosures.

You have the right to receive an accounting of all disclosures of your PHI that the plan has made, if any, for reasons other than disclosures for treatment, payment or healthcare operations, as described above, disclosures made to you or your personal representative and disclosures made pursuant to a valid authorization received from you. Your right to an accounting of disclosures applies only to PHI created or received by the plan after July 1, 2011 and cannot exceed a period of six years prior to the date of your request. Requests for an accounting of disclosures of your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Receive a Paper Copy of this Notice.

You have the right to receive a paper copy of this Notice upon request. This right applies even if you have previously agreed to accept this Notice electronically. Requests for a paper copy of this Notice should be directed to the Privacy Compliance Office listed in this Notice.

Complaints

If you believe that your privacy rights have been violated, you may file a compliant with the plan or the Secretary of Health and Human Services. The plan will not retaliate against you for filing a complaint.

Complaints filed with the plan should be filed in writing to:
Privacy Compliance Office
PO Box 10817
Clearwater, Florida 33757-8817

Complaints to the Secretary of Health and Human Services should be filed in writing to:
US Department of Health and Human Services
200 Independence Ave. SW
Washington, DC 20201

Privacy Contact Information

If you have any questions regarding this Notice you may obtain additional information by writing to:

Privacy Compliance Department
PO Box 10817
Clearwater, Florida 33757-8817
Or by calling
855-664-5517

Effective Date of Notice

This Notice becomes effective on September 23, 2013.