Policy 7.9: Health Insurance Portability and Accountability Act (HIPAA)

Original Date of Issue: 6/16/10
Revised: 7/17/14

Statutory Reference:
Standards for Privacy of Individually Identifiable Health Information, Final Rule, Office of the Secretary, Department of Health and Human Services. 45 CFR Section 164.520. Published in the Federal Register of Thursday, December 28, 2000.

Compliance Information:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

To persons enrolled in the Delaware County Community College’s Health Plan (The Plan):

The Plan is required by law to maintain the privacy of protected medical information and to provide covered individuals with notice of its legal duties and privacy practices with respect to protected medical information. The Plan is permitted to use and disclose this information under the guidelines of the Federal HIPAA law. Circumstances of such disclosures are described in part in this notice.

The Plan is required to abide by the terms of this notice until it is amended. The Plan reserves the right to change the terms of this notice and to make the new notice provisions effective for all protected health information that it maintains. All individuals covered under the Plan will receive a revised notice within 60 days of a material revision to the notice.

In order for the Plan to pay for your covered medical expenses, the Plan and those administering the Plan must create or receive certain medical information about you. This information may involve:

Payment activities such as billing and collection activities, eligibility determinations, adjudication of claims, pre-certification and utilization review, and coordination of benefits, or
Health care operation activities such as quality assessment, case management, subrogation, or business management, and general administrative activities, or
Treatment activities by your health care provider, such as providing information about other treatments you have received.

By your enrolling in the Plan, you have agreed to allow the Plan and its administrators to create or use your medical information in order to perform these duties without your express authorization. The Plan may also disclose medical information about you without your express authorization to business associates of the Plan who have an expressed need to know, such as actuaries who price the cost of coverage, the claims administrator who pays the claims, or other professionals who perform services on behalf of the Plan. All disclosures made by the Plan of medical information for purposes of payment or health care operation shall be the minimum necessary to accomplish the intended purpose of the disclosure, and any business associate who receives the information must agree to keep it strictly confidential.

The Plan may disclose information about your medical records to a medical professional treating you. No authorization is necessary for this disclosure.

The law requires the Plan to make certain disclosures, these include:

To the individual when properly requested
As necessary to comply with workers compensation or other similar programs.
As necessary for courts and law enforcement agencies. Disclosures to a law enforcement agency may occur if required by law (such as the occurrence of certain types of wounds) or if required by a court order or other legal process. The Plan may also disclose medical information: for the purpose of identifying or locating a suspect, witness, fugitive, or missing person; about a crime victim, if the victim agrees or emergency circumstances require disclosure without consent; about a person who has died if the nature of the death suggests that it may be the result of criminal conduct; or if there is evidence to suggest that a crime occurred on the premises.
As necessary for approved public health research and approved public health disclosures, including reporting of communicable diseases to the applicable governmental authorities (who may contact exposed individuals) and workforce medical investigations.
As necessary to a health oversight agency or its designated entity for oversight activities authorized by law.
As necessary if disclosure is required by another law.

The Plan may also be permitted or required to disclose medical information without your authorization under the following circumstances:

If authorized by law, to the proper authorities for purposes of reporting child abuse or domestic violence. Subject to certain restrictions, the Plan may also report this information to social services, but must generally inform the victim of the abuse that it is making the disclosure.
To officials working for or with the U.S. Food and Drug Administration. These disclosures may be necessary: to report adverse events with respect to food or dietary supplements, product defects (including use or labeling defects), or biological product deviations; for product tracking; to enable product recalls, repairs or replacements; or to conduct post marketing surveillance.
Upon your death, to a coroner, funeral director or to tissue or organ services, as necessary to permit them to perform their functions.
Under certain circumstances for approved research purposes whereby your personal health information will be de-identified and health information used in the aggregate.
To prevent or lessen a serious threat to the health or safety of a person or the public.
If authorized by law, in connection with military matters or matters of national security and intelligence.

In addition, the Plan may disclose medical information to the Plan Sponsor, Delaware County Community College, under the following conditions:

Delaware County Community College may not use any such information for employment-related decisions.
Delaware County Community College may receive such information as the Plan documents allow.
You have the right to inspect the Plan documents allowing disclosures.

You have the right:

To request restrictions on certain uses and disclosures of your medical information. The Plan may not agree with a requested restriction when it has cause for denial. If the Plan does agree with the request, then the Plan will abide by that restriction.
To receive your own confidential health information by alternative means or at alternative locations, if receipt of information in the usual manner could endanger you. You should contact Delaware County Community College„s Privacy Officer, Director of Human Resources, to request the alternative delivery. You must include a statement that disclosure of the information in the usual manner could endanger you.
To inspect and copy your own health information unless there are exceptions that apply to certain types of information. If you request to see or copy your own health information from Delaware County Community College‟s Privacy Officer and one of these exceptions apply, you will be given more information at that time, including the circumstances under which you may challenge the exception.
To amend your own health information when that information is incorrect.
To obtain an accounting of any disclosure of your confidential health information, other than disclosures for purposes of payment, health care operations or treatment or disclosures made in accordance with your written authorization.
To obtain a copy of this notice upon request, visit delaGATE.

Summary of Pennsylvania Statutes
Pennsylvania statutorily grants a patient the right of access to his medical records that are maintained by health care providers, health care facilities, and managed care plans. The state does not have a general, comprehensive statute protecting the privacy of confidential medical information. Rather, these privacy protections are addressed in statutes governing entities or medical conditions.

If you would like to pursue any of your individual rights regarding your PHI, contact Director, Human Resources, 901 South Media Line Road, Media, PA 19063 (610) 359-5302. You have the right to contact the U.S. Department of Health and Human Services‟ Office for Civil Rights (OCR) if you have any complaints about how the Plan has handled your PHI. For further information, contact the Delaware County Community College‟s Privacy Officer, Director, Human Resources, 901 South Media Line Road, Media, PA 19063-1094

Notice of Privacy Practices
The Delaware County Community College Health Plan (“Plan”) has the duty to protect your medical information. The Plan further has the duty to provide you with a notice of its privacy practices. The Plan has the right to change or modify this notice, at any time; any modifications will be communicated to you. This notice describes how your medical information may be used and disclosed, and how you can get access to it. Please review it carefully.

The Health Insurance Portability and Accountability Act (HIPAA) limits how a covered entity can use and disclose protected health information (PHI). Generally, a covered entity, including your health plan, your health care provider, or a health clearinghouse, can share information without your authorization, for purposes of treatment of you, payment for your medical services, and for the health plan‟s operation. In all other instances, you must authorize any use or disclosure of your health information.

Permitted Disclosures
The Plan can use and disclose your PHI for the following purposes, without your authorization, for making or obtaining payment for your health care, and for conducting health plan operations. Examples of when and how your PHI can be used and disclosed for payment purposes, without your authorization are:

For coordination of benefits among multiple plans that cover you.
For utilization review purposes.
For case management purposes.
Any other purpose necessary to ensure coverage for you, and to obtain or make payment for services rendered to you.

Examples of when and how your PHI can be used and disclosed for health plan operations, without your authorization, are:

To ensure coverage for you.
For quality assessment purposes.
For cost containment purposes.
To ensure compliance with the terms of the Plan, or with clinical or other relevant medical guidelines and protocols.
To provide you with treatment alternatives.
For health plan and provider accreditation, verification, licensure, or any other credentialing purposes.
For underwriting, premium rating, and related functions.
To create, renew, or replace your health insurance or health benefits.
To conduct audits, including compliance, medical, legal, business planning, cost containment, or customer service audit functions.

The Plan can share your PHI with the plan sponsor for certain administrative activities, without your authorization. Examples of sharing PHI include, but are not limited to:

Seeking premium bids for current or future coverage.
Obtaining reinsurance
Amending, modifying, or terminating the plan.
Participant and enrollment information.

Your PHI can be released in summary form, or, as part of “de-identified” information, in accordance with the Code of Federal Regulations.

Other instances, in which your PHI may be released, without your authorization, include:

When legally required by federal, state, or local law. This instance would include the release of PHI upon the receipt of an order, subpoena, or other judicial or administrative process that would lawfully compel the disclosure of your PHI. However, your PHI would only be disclosed after a reasonable effort has been made to notify you of the request for such information.
For law enforcement purposes, such as investigation of a crime.
To respond to a threat to public health or safety.
For workers compensation purposes, or other no fault law.
To a government authority, such as a social service or other protected service organization, authorized to receive reports of abuse, neglect, or domestic violence.

Authorization of Use and Disclosure

Except as provided above, the Plan will not release any of your PHI without your authorization. If you authorize the release of some or all of your PHI, you may revoke the authorization at any time. If you authorize release of your PHI, your authorization must include the following items:

A description of information used or disclosed.
Identification of the parties releasing, and the parties requesting the information.
An expiration date of the authorization.
Your signature.
Information about how to revoke the authorization.

Your Individual Rights

You have certain individual rights regarding your PHI, specifically:

If the plan maintains your PHI, you have the right to inspect and request a copy of it. The plan may charge a reasonable fee for copying this information. If the Plan does not maintain any PHI, which is the subject of your request, you will be directed to the appropriate party who can assist you with your inquiry.
You have the right to restrict the use and disclosure of your PHI, although the Plan is not required to agree with your request as to permitted disclosures.
You have the right to receive confidential communications. You have the right to limit or restrict where, or how, the Plan may contact you regarding your PHI
. You have the right to request amendments or modifications to your PHI. If you believe your PHI is inaccurate or incomplete, you have the right to request an amendment to your records. In order to be entitled to amend the records, the Plan must maintain the relevant records, and you must make the request for amendment in writing. The Plan has the right to deny your request to amend or modify your PHI if:
a) You do not have a substantive reason for the request.
b) The relevant records were not created by the Plan.
c) The request falls within an exception to the amendment rights provided by the law.
d) It is determined that the information is complete or accurate.
You have the right to obtain an accounting of any disclosure that has been made of your PHI, other than those disclosures made for health care payment, treatment, or other health care plan operations. To exercise this right, contact Director, Human Resources, 901 South Media Line Road, Media, PA 19063 (610) 359-5302.