Notice of Privacy Practices of FAHC’s Self-Insured Health Plans Administered by
Vermont Managed Care
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Our Legal Duty
The Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA)
imposes requirements on health plans concerning the use and disclosure of Protected
Health Information. This document is a Notice of Privacy Practices (“Privacy Notice”)
of Fletcher Allen Health Care’s (“FAHC’s”) Self-Insured Plans (collectively referred
to as the “Plan” or “we”) that is being provided to you as a participant in the
Plan. Protected Health Information (sometimes referred to as “PHI”) means information
relating to your past, present or future health or medical condition, the provision
of health care to you, or payment for the provision of health care to you. The Plan
is administered by Vermont Managed Care (“VMC”), and PHI also includes records that
VMC maintains about your coverage and claims as the Plan’s administrator.
The Plan is required by federal law to maintain the privacy of your Protected Health
Information, and to provide you with this Privacy Notice to describe how Protected
Health Information about you may be used and disclosed and your rights regarding
your PHI, including how you may obtain access to your PHI. Access to and disclosure
of the information described in this Privacy Notice applies to the Plan, and to
PHI maintained by FAHC or VMC on behalf of the Plan, but it does not apply to information
that is maintained by FAHC as an employer. Please read the notice carefully, and
file it for future reference.
Uses and Disclosures of PHI
The privacy rules allow the use and disclosure of your health information without
your authorization as described below. With the exception of uses for the purposes
of treatment, only the “minimum necessary” amount of health information will be
used or disclosed by the Plan, as defined under the HIPAA rules.
Primary Uses and Disclosures of PHI
Treatment
Includes providing, coordinating, or managing health care by one or more health
care providers. For example, the Plan may share health information about you with
physicians who are treating you.
Payment
Includes activities by the Plan, other plans, or providers to obtain payment, make
coverage and eligibility determinations and provide reimbursement for health care.
For example, we might also use your information to coordinate benefits, to examine
medical necessity, and to issue explanations of benefits to the person who subscribes
to the health plan in which you participate.
Health Care Operations
Includes activities such as wellness and risk assessment programs, quality assessment
and improvement activities, customer service, internal grievance resolution, case
management, and similar activities, as defined by HIPAA. For example, we may use
your information to process a claim or resolve a grievance that you may have with
the Plan.
As Required or Permitted by Law
Please see the next section titled “Other allowable uses or disclosures of your
health information.”
Plan Sponsor
Disclosures to FAHC for plan administration functions. For example, FAHC may seek
information to evaluate future changes to your benefit plan or to obtain bids for
reinsurance.
Business Associates
Disclosures to individuals and entities (called “Business Associates”) in order
to perform various functions on behalf of the Plan or to provide certain types of
services (such as member service support, utilization management, subrogation, or
pharmacy benefit management), including VMC as Plan Administrator, pursuant to a
Business Associate agreement.
Other Providers or Health Plans
Disclosures to assist health care providers in connection with their treatment or
payment activities, or to assist other health plans or providers in connection with
certain of their health care operations such as quality assurance, or accreditation,
certification, licensing or credentialing.
To You or with Your Authorization
Disclosures to you, as described in the Individual Rights section of this notice.
Other Allowable Uses or Disclosures of Your PHI
Treatment Alternatives
Disclosure to you to provide information about treatment alternatives or other health-related
benefits and services.
Public Health Activities
- Disclosures made in the good-faith belief that releasing your health information
is necessary to prevent or lessen a serious and imminent threat to public or personal
health or safety, if made to someone reasonably able to prevent or lessen the threat
(including disclosures to the target of the threat).
- Disclosures to public health authorities to prevent or control disease or report
child abuse or neglect or for public health investigations.
- Disclosures to the Food and Drug Administration to collect or report adverse events
or product defects.
Victims of Abuse, Neglect, or Domestic Violence
Disclosures to government authorities, including protected services agencies authorized
by law to receive reports of abuse, neglect, or domestic violence, as required by
law or if you agree or we believe that disclosure is necessary to prevent serious
harm to you or potential victims. (You will be notified of the Plan’s disclosure
if informing you will not put you at further risk.)
Judicial and Administrative Proceedings
Disclosures in response to a court or administrative order, subpoena, discovery
request, or other lawful process. (The Plan may be required to notify you of the
request, or receive satisfactory assurance from the party seeking your health information
that efforts were made to notify you or to obtain a qualified protective order concerning
the information.)
Law Enforcement Purposes
Disclosures to law enforcement officials required by law or pursuant to legal process,
or to identify a suspect, fugitive, witness, or missing person; disclosures about
a crime victim if you agree or if disclosure is necessary for immediate law enforcement
activity; disclosure about a death that may have resulted from criminal conduct;
and disclosure to provide evidence of criminal conduct on the Plan’s premises.
Health Oversight Activities
Disclosures to health agencies for activities authorized by law (audits, inspections,
investigations, or licensing actions) for oversight of the health care system, government
benefits programs for which health information is relevant to beneficiary eligibility,
and compliance with regulatory programs or civil rights laws.
Specialized Government Functions
Disclosures about individuals who are Armed Forces personnel or foreign military
personnel under appropriate military command; disclosures to authorized federal
officials for national security or intelligence activities; and disclosures to correctional
facilities or custodial law enforcement officials about inmates.
HHS Investigations
Disclosures of your health information to the Department of Health and Human Services
(HHS) to investigate or determine the Plan’s compliance with the HIPAA privacy rule.
Coroners, Medical Examiners, Funeral Directors, and Organ Donation
Disclosures to a coroner or medical examiner for purposes of identifying you after
you die, determining cause of death, or to perform other duties authorized by law.
We also might disclose, as authorized by law, information to funeral directors so
that they may carry out their duties on your behalf. Further, we might disclose
PHI to organizations that handle organ, eye, or tissue donation and transplantation.
Research
Disclosures for the purpose of conducting research when an institutional review
board or privacy board has: (1) reviewed the research proposal and established protocols
to ensure the privacy of the information; and (2) approved the research.
Workers’ Compensation
Disclosures made to comply with workers’ compensation laws and other similar programs
that provide benefits for work-related injuries or illnesses.
To Family and Friends
Disclosures with your agreement, (or without your agreement if you are unavailable
to agree such as in a medical emergency situation), to a family member, friend or
other person to the extent necessary to help with your health care or with payment
for your health care.
Individual Rights
Except as described in this notice, other uses and disclosures of your Protected
Health Information will be made only with your written authorization. You may revoke
your authorization as permitted by the privacy rules. However, you cannot revoke
your authorization with respect to disclosures the Plan has already made in reliance
on your authorization. You have the following rights with respect to your Protected
Health Information the Plan maintains. These rights are subject to certain limitations.
Review Your Protected Health Information
You have the right to inspect and obtain a copy of your Protected Health Information,
except you do not have the right to copies of psychotherapy notes or information
compiled for civil, criminal, or administrative proceedings. You must make a request
in writing to obtain access to your Protected Health Information. You may obtain
a form to request access by using the contact information listed at the end of this
notice. You may also request access by sending a letter to the address at the end
of this notice. If you request copies, we might charge you a reasonable fee for
each page, and postage if you want the copies mailed to you. You may request that
we provide copies in a format other than photocopies. We will use the format you
request unless we cannot reasonably do so. If you request an alternative format,
we might charge a cost-based fee for providing your Protected Health Information
in that format. If you prefer, we will prepare a summary or an explanation of your
PHI, but we might charge a fee to do so. We might deny your request to inspect and
copy your PHI in certain limited circumstances. Under certain conditions, our denial
will not be reviewable. If this event occurs, we will inform you in our denial that
the decision is not reviewable. If you are denied access to your information and
the denial is subject to review, you may request that the denial be reviewed. A
licensed health care professional chosen by us will review your request and the
denial. The person performing this review will not be the same person who denied
your initial request.
Request to Restrict Your Protected Health Information
You have the right to ask the Plan to restrict the use and disclosure of your Protected
Health Information to carry out Treatment, Payment, or Health Care Operations, except
for uses or disclosures required by law. We are not required to agree to a requested
restriction, but if we do, we will abide by the agreement (except in an emergency).
Any agreement to a request for additional restrictions must be in writing and signed
by a person authorized to make such an agreement. We will not be liable for uses
and disclosures made outside of the requested restriction unless the agreement to
restrict is in writing. We may end the agreement to the requested restriction by
notifying you in writing.
You may request a restriction by writing to the Plan using the information listed
at the end of this notice. In your request you must describe: (1) the information
for which you want to limit our use and disclosure; and (2) how you want to limit
our use and/or disclosure of the information.
Receive Confidential Communications
If you believe that a disclosure of all or part of your PHI may endanger you, you
have the right to request that we communicate with you in confidence about your
Protected Health Information. This means that you may request that we send you information
by alternative means, or to an alternate location. The Plan must accommodate your
request if: it is reasonable, specifies the alternative means or alternate location,
and specifies how payment issues (premiums and claims) will be handled. You may
request such confidential communications by writing to the Plan using the information
listed at the end of this notice
Amend Your Health Information
You have the right to request an amendment to your PHI. Your request must be in
writing, and it must explain why the information should be amended. We may deny
your request if we did not create the information you want amended or for certain
other reasons. If your request is denied, we will provide you with a written explanation.
You may respond with a statement of disagreement, which will be appended to the
information you wanted to amend. If the Plan accepts your request to amend the information,
we will make reasonable efforts to inform others, including people you name, of
the amendment and to include the changes in any future disclosures of that information.
Receive an Accounting of Disclosures
You have the right to a list of certain disclosures the Plan has made of your Protected
Health Information going back six years from the date of your request, but not for
disclosures made prior to April 14, 2003. You do not have a right to receive an
accounting of any disclosures made:
- For Treatment, Payment, or Health Care Operations;
- To you about your own health information;
- Incidental to other permitted or required disclosures;
- Where authorization was provided;
- For national security or intelligence purposes or to correctional institutions or
law enforcement officials in certain circumstances; and
- As part of a “limited data set” (health information that excludes certain identifying
information).
You may request an accounting by submitting your request in writing using the information
listed at the end of this notice. Your request may be for disclosures made up to
6 years before the date of your request, but in no event, for disclosures made prior
to April 14, 2003.
Paper Copy of This Notice
You are receiving this notice by mail. This Privacy Notice will also be posted on
the FAHC Web site at www.fahcpreferred.org
Even if you agree to receive this notice on the web site, or by electronic mail
(e-mail), you are entitled to receive a paper copy as well. Please contact the Plan
using the information listed at the end of this notice to obtain this notice in
written form. If the e-mail transmission has failed, and we are aware of the failure,
then it will provide a paper copy of the notice to you. When exercising these rights,
please put your request in writing and send it to Vermont Managed Care, Privacy
Officer, PO Box 1150, Burlington, Vermont 05402-1150
Other Relevant Information Regarding Your PHI and This Privacy Notice
State Law
HIPAA Privacy Regulations generally do not “preempt” (or take precedence over) state
privacy or other applicable laws that provide individuals greater privacy protections.
As a result, to the extent state law applies, the privacy laws of a particular state,
or other federal laws, rather than the HIPAA privacy rules, might impose a privacy
standard under which we will be required to operate.
Changes to Privacy Policies
The Plan must abide by the terms of the Privacy Notice currently in effect. This
notice takes effect on April 14, 2003. However, the Plan reserves the right to
change the terms of its privacy policies as described in this notice at any
time, and to make new provisions effective for all PHI that the Plan maintains.
This includes PHI that was previously created or received, not just PHI created
or received after the policy is changed. If changes are made to the Plan’s
privacy policies described in this notice, you will be provided with a revised
Privacy Notice by mail. Copies of the most current Privacy Notice
may be obtained at any time by calling the Vermont Managed Care Customer Service
Department or by viewing the Fletcher Allen Preferred website at
www.fahcpreferred.org
Questions or Complaints
If you have any questions about the Plan’s privacy policies or your rights under
HIPAA, please write to Vermont Managed Care, PO Box 1150, Burlington, VT 05402-1150.
If you believe your privacy rights have been violated, you may complain to the Plan
and to the Secretary of Health and Human Services. You will not be retaliated against
for filing a complaint.
To file a complaint with the Plan, please describe your complaint in a letter addressed
to Vermont Managed Care, PO Box 1150, Burlington, VT 05402-1150 or Call 802-847-4862
or toll free at 1-866-582-6836.
To file a complaint with the U.S. Secretary of Health and Human Services use the
HIPAA Complaint Submission Form at cms.hhs.gov/hipaa/hipaa 2 or by mail to: HIPAA
Complaint, 7500 Security Blvd., C5-24-04, Baltimore, MD 21244.
NOTICE EFFECTIVE DATE: April 14, 2003
Revised 1/1/2011