Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice is effective March 1, 2021.

This Notice applies to the health benefits provided under the CLDA Limited Medical Health Plan (the “Plan”).

The references to “we” and “us” throughout this Notice mean the Plan.

This Notice has been drafted to comply with the “HIPAA Privacy Rules,” under federal law. Any terms that are not defined in this Notice have the meaning specified in the HIPAA Privacy Rules.

How We Protect Your Privacy

Please provide this Notice to your family.

We are required by law to protect the privacy of your protected health information (“PHI”) and to provide you with this notice of our privacy practices. We will not disclose PHI without your authorization unless it is necessary to provide your health benefits and administer the Plans, or as otherwise required or permitted by law. When we need to disclose individually identifiable information, we will follow the policies described in this Notice to protect your confidentiality.

We maintain PHI and have procedures for accessing and storing confidential records. We restrict internal access to your PHI to employees who need that information to provide your benefits. We train those individuals on policies and procedures designed to protect your privacy. Our Privacy Officer monitors how we follow those policies and procedures and educates our organization on this important topic.

How We May Use and Disclose Your Protected Health Information (“PHI”)

Your protected health information (“PHI”) is individually identifiable health information that relates to your past, present or future physical or mental health or condition; the provision of health care to you; or the past, present or future payment for the provision of health care to you. We will not use your PHI or disclose it to others without your written authorization, except for the following purposes. When required by law, we will restrict disclosures to the Limited Data Set, or if necessary, to the minimum necessary information to accomplish the intended purpose.

Treatment. We may disclose your PHI to your health care provider for its provision, coordination or management of your health care and related services. For example, we may disclose your PHI to a health care provider when the provider needs that information to provide treatment to you. We may also disclose PHI to another covered entity to conduct health care operations in the areas of quality assurance and improvement activities or accreditation, certification, licensing or credentialing.

Payment. We may use or disclose your PHI for Plan payment purposes, including the collection of premiums. For example, we may share your PHI with another covered entity, such as an insurer, group health plan or health care provider, for their payment purposes.

Health Care Operations. We may use or disclose your PHI for our health care operations. We may use or disclose your PHI to conduct audits, for plan administration, to run our organization, and for purposes of risk management, although no genetic information can be used or disclosed for underwriting purposes. We may use or disclose your PHI to provide you with customer service activities or develop programs. We may also provide your PHI to our attorneys, accountants, and other consultants who assist us in performing our functions. We may disclose your PHI to other health care providers or entities for certain health care operations activities, such as quality assessment and improvement activities, case management and care coordination, or as needed to obtain or maintain accreditation or licenses to provide services. We will only disclose your PHI to these entities if they have or have had a relationship with you and your PHI pertains to that relationship, such as with other health plans or insurance carriers in order to coordinate benefits, if you or your family members have coverage through another health plan.

Disclosures to the Plan Sponsor. CLDA is the Plan sponsor. We may disclose your PHI to employees of the Plan sponsor. The Plan sponsor is not permitted to use PHI for any purpose other than the administration of the Plan. The Plan sponsor must certify, among other things, that it will only use and disclose your PHI as permitted by the Plan, restrict access to your PHI to those individuals whose job it is to administer the Plan and it will not use PHI for any employment-related actions or decisions. The Plan may also disclose enrollment information to the Plan sponsor. The Plan may also disclose summary health information to the Plan sponsor for purposes of obtaining bids for health insurance or amending or modifying the Plan.

Disclosures to Business Associates. We may contract with individuals and entities (business associates) to perform various functions on our behalf or provide certain types of services. To perform these functions or provide these services, our business associates will receive, create, maintain, use or disclose PHI. We require the Business Associates to agree in writing to contract terms to safeguard your information, consistent with federal law. For example, we may disclose your PHI to a business associate to provide service support.

Disclosures to Family Members or Others. Unless you object, we may provide relevant portions of your PHI to a family member, friend or other person you indicate is involved in your health care or in helping you receive payment for your health care. If you are not capable of agreeing or objecting to these disclosures because of, for instance, an emergency situation, we will disclose PHI (as we determine) in your best interest. After the emergency, we will give you the opportunity to object to future disclosures to family and friends.

Other Uses and Disclosures. The law allows us to disclose PHI without your prior authorization in the following circumstances:

Required by law. We may use and disclose your PHI to comply with the law.
Public health activities. We will disclose PHI when we report to a public health authority for purposes such as public health surveillance, public health investigations or suspected child abuse.
Reports about victims of abuse, neglect or domestic violence. We will disclose your PHI in these reports only if we are required or authorized by law to do so, or if you otherwise agree.
To health oversight agencies. We will provide PHI as requested to government agencies that have the authority to audit or investigate our operations.
Lawsuits and disputes. If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a subpoena or other lawful request, but only if efforts have been made to tell you about the request or obtain a court order that protects the PHI requested.
Law enforcement. We may release PHI if asked to do so by a law enforcement official in the following circumstances: (a) to respond to a court order, subpoena, warrant, summons or similar process; (b) to identify or locate a suspect, fugitive, material witness or missing person; (c) to assist the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (d) to investigate a death we believe may be due to criminal conduct; (e) to investigate criminal conduct; and (f) to report a crime, its location or victims or the identity, description or location of the person who committed the crime (in emergency circumstances).
Coroners, medical examiners and funeral directors. We may disclose PHI to facilitate the duties of these individuals.
Organ procurement. We may disclose PHI to facilitate organ donation and transplantation.
Medical research. We may disclose PHI for medical research projects, subject to strict legal restrictions.
Serious threat to health or safety. We may disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the general public.
Special government functions. We may disclose PHI to various departments of the government such as the U.S. military or U.S. Department of State.
Workers’ compensation or similar programs. We may disclose your PHI when necessary to comply with worker’s compensation laws.

Uses and Disclosures With Your Written Authorization

We will not use or disclose your PHI for any purpose other than the purposes described in this Notice, without your written authorization. For example, in general and subject to specific conditions, we will not use or disclose your psychiatric notes; we will not use or disclose your PHI for marketing and we will not sell your PHI unless you provide a written authorization to do so.

You may revoke written authorizations at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

Your Individual Rights

You have the following rights:

Right to inspect and copy your PHI. Except for limited circumstances, you may review and copy your PHI. Your request must be addressed to the Privacy Officer. In certain situations we may deny your request, but if we do, we will tell you in writing of the reasons for the denial and explain your rights with regard to having the denial reviewed. If the information you request is in an electronic designated record set, you may request that these records be transmitted electronically to yourself. If the information you request is in an electronic health record that is part of a designated record set, you may request that these records be transmitted electronically to yourself or a designated individual.

If you request copies of your PHI, we may charge you a reasonable fee to cover the cost. Alternatively, we may provide you with a summary or explanation of your PHI, upon your request if you agree to the rules and cost (if any) in advance.

Right to correct or update your PHI. If you believe that the PHI we have is incomplete or incorrect, you may ask us to amend it. Your request must be made in writing and must be addressed to the Privacy Officer. To process your request, you must use the form we provide and explain why you think the amendment is appropriate. We will inform you in writing as to whether the amendment will be made or denied. If we agree to make the amendment, we will make reasonable efforts to notify other parties of your amendment. If we agree to make the amendment, we will also ask you to identify others you would like us to notify.

We may deny your request if you ask us to amend information that:

Was not created by us, unless the person who created the information is no longer available to make the amendment;
Is not part of the PHI we keep about you;
Is not part of the PHI that you would be allowed to see or copy; or
Is determined by us to be accurate and complete.

If we deny the requested amendment, we will notify you in writing on how to submit a statement of disagreement or complaint or request inclusion of your original amendment request in your PHI.

Right to obtain a list of the disclosures. You have the right to get a list of PHI disclosures, which is also referred to as an accounting. You must make a written request to the Privacy Officer to obtain this information.

The list will not include disclosures we have made as authorized by law. For example, the accounting will not include disclosures made for treatment, payment and health care operations purposes. Also, no accounting will be made for disclosures made directly to you or under an authorization that you provided or those made to your family or friends.

The list we provide will include disclosures made within the last six years unless you specify a shorter period.

The first list you request within a 12-month period will be free. You may be charged for providing any additional lists within a 12‑month period.

Right to choose how we communicate with you. You have the right to ask that we send information to you at a specific address (for example, at work rather than at home) or in a specific manner (for example, by e-mail rather than by regular mail). We must agree to your request if you state that disclosure of the information may put you in danger.

Right to request additional restrictions on health information. You may request restrictions on our use and disclosure of your PHI for the treatment, payment and health care operations purposes explained in this Notice. While we will consider all requests for restrictions carefully, we are not required to agree to a requested restriction. However, we must comply with your request to restrict a disclosure of your PHI for payment or health care operations purposes if you paid for these services in full, out of pocket.

Right to be notified of a breach. You have the right to be notified in the event that we (or a Business Associate) discover a breach of unsecured PHI.

Right to a paper copy of this notice. You have the right to a paper copy of this notice, even if you have agreed to receive this notice electronically. You may ask us to give you a copy of this notice at any time. You may also obtain a copy of this notice on our website.

Questions and Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, put your complaint in writing and address it to the Privacy Officer. The Plan will not retaliate against you for filing a complaint. You may also contact the Privacy Officer if you have questions or comments about our privacy practices.

Future Changes to Our Practices and This Notice

We are required to follow the terms of the privacy notice currently in effect. However, we reserve the right to change our privacy practices and make any such change applicable to the PHI we obtained about you before the change. If a change in our practices is material, we will revise this Notice to reflect the change. We will send or provide a copy of the revised Notice. You may also obtain a copy of any revised Notice by contacting the Privacy Officer.

Privacy Officer

CLDA Limited Medical Health Plan

COMPLETE

PHONE