• Limiting how we use and disclose your health information.
  
• Providing physical safeguards including secure offices and storage facilities, electronic protections and procedures.
  
• Training employees on our privacy policies and procedures.
  
  
  

HOW WE USE OR SHARE INFORMATION

HIPAA and other laws allow or require us to use and disclose your health information without your written permission. If one of the reasons below does not apply, we must get your written permission.

The following are ways we are permitted to use or share your health information:

• Treatment: to your primary care physician and health care providers who request it in connection with your treatment, preventive health, early detection and disease and case management programs.
  
  
• Payment: to pay your medical claims and determine if a service is covered by your plan. This may involve determining eligibility, premiums, coordination of benefits with another plan, utilization review and management, medical necessity review, coordination of care, responding to complaints, appeals and external review requests.
  
  
• Health care operations: We will use and disclose your health information to support our business activities, including:
  
  • Quality assessment and improvement activities, review of provider competence and performance, and accreditation by independent organizations, such as the National Committee for Quality Assurance.
    
  • Customer service.
    
  • Preventive health, disease and case management activities.
    
  • Underwriting and administration of reinsurance/stop-loss policies.
    
  • Business planning, such as cost management, claims analysis and fraud detection.
    
  • Transfer of policies or contracts from and to other insurers and facilitation of any potential sale or merger due diligence related activity.
    
    
• To your family member, friend or other person you identify whom is directly involved in your health care or payment for health care if you are present, unless you object. We would share only information directly relevant to that person's involvement in your care. There may be a situation when you are not present or are unable to make health care decisions for yourself. Then we may use or share health information if professional judgement says that doing so is in your best interest. For example, if you are unconscious and a friend is with you, we may share your health information so you can receive care or plan benefits. We may also share with a family member who calls with basic information about you and prior knowledge of a claim. In this case, we will confirm if the claim has been received and paid unless you previously informed us in writing that you do not want us to make any disclosures to that person.
  
• To verify your enrollment with Assist America or other organization that provides you with a special benefit because you are a CHA Health member.
  
• To give you information about alternative medical treatments and programs or about health related products and services that you may be interested in. For example, we might send you information about smoking cessation or weight loss programs.
  
• To share summary (not person-specific) health information with your employer if your employer pays for your health plan. If your employer has privacy procedures for receiving and protecting your health information, we may be required to disclose specific health information to your employer. Talk to your employer for more details.
  

There are also state and federal laws that may permit or require us to release your health information to others. We may disclose your health information for the following reasons:

• Health Oversight Activities - to state and federal agencies such as the US Department of Health and Human Services and the Kentucky Department of Insurance.
  
• Public Health Activities - for disease control and prevention, investigating prescription drug and medical device problems or to report abuse, neglect or domestic violence.
  
• Public Protection - to public health agencies if we believe there is a serious health or safety threat, or for disaster relief.
  
• Judicial or Administrative Hearings - in response to a court order, subpoena or other lawful process.
  
• Law Enforcement - to law enforcement officials for identifying or locating a suspect, fugitive, material witness or missing person.
  
• Coroners or Medical Examiners - to identify a deceased person, determine a cause of death, or as authorized by law.
  
• Organ Donation and Disease Registries – to authorized organizations involved with organ donation, transplants, and communicable disease registries.
  
• Specialized Government Functions – for military and veteran activities, national security and intelligence activities, and the protective services for the President and others.
  
• Workers Compensation – to programs that provide benefits for work-related injuries because of requirements of state worker compensation laws.
  
• Research Purposes – provide specific medical information to authorized personnel to work on research projects.
  

All Other Uses and Disclosures Require Your Prior Written Permission.
You may ask us to provide information to someone else by sending us a written authorization. In other situations we may ask for your written permission. If you give us written permission and change your mind you may revoke your written permission at any time. We will then stop using your health information for that certain situation. You may want someone to be a personal representative to act in your place. These requests must be in writing. You may obtain Authorization Forms and Personal Representative Forms from our Web site or by calling Member Services and mailing it to Member Services.

Mailings to You:
Unless you give us an alternative address, we will mail explanation of benefits forms and other mailings containing your health information to the address we have on record for the subscriber of the health benefits plan.


WHAT ARE YOUR RIGHTS

The following are your rights regarding your health information. To exercise these rights, follow the instructions below or call a CHA Health Member Services Representative at 800-457-5683 or 859-232-8686.

Right to Request Restrictions:
You have the right to ask us to limit how we use or disclose your health information. You may also ask us to limit the information that we give to family members or to others involved in your health care. To make a request, call Member Services. We will try to honor your request, we are not required to agree to these restrictions.

Confidential Communications:
You have the right to ask that we send your health information to you at an address of your choice or communicate in a special way to protect you from danger. If you believe that you would be harmed if we send your information to your current mailing address, you can ask us to send information by email or to work. You must tell us in writing what you want and the reason. Mail your request to the CHA Health Privacy Office. We will accommodate your reasonable requests as explained above.

Access to Your Health Information:
You have the right to look at and obtain a copy of your health information. You must make your request in writing. The Member Request to Access Protected Health Information Form is on our Web site or is available from Member Services. If you ask for a copy of your information, we may charge you a reasonable fee based on the cost of copying and postage. If you request, we can send you a summary or general explanation of your health information if you agree to any cost of preparing and sending it. In certain circumstances we may deny your request. If so, we will tell you why in writing and you can ask us to have the denial reviewed.

Amend Your Health Information:
You have the right to ask us to correct or add to the health information we have about you if you think there is a mistake. Your request must be in writing. The Request for Amendment of Protected Health Information Form is on our Web site or is available from Member Services. In certain circumstances, we can deny your request. All denials will be made in writing. You may respond by filing a written statement of disagreement. You have the right to request that your written request, our written denial and your statement of disagreement be included with your information if it is given out in the future.

Accounting of Certain Disclosures:
You have the right to get a list of disclosures of your health information made by us after April 14, 2003. The list will not include disclosures made for treatment, payment, and health care operations, to you or with your permission, or to persons involved in your care, for national security, law enforcement, corrections officials or to health oversight agencies.

Your request must be in writing. The Request for Accounting of Disclosures Form is on our Web site or available from Member Services. Your first list of disclosures is free. If you request another list within 12 months we will send you one if you agree to pay a reasonable fee for the additional list.


EXERCISING YOUR RIGHTS

You have a right to receive a copy of this notice upon request at any time.
You can also view a copy of the notice on our Web site at www.cha-health.com. If our privacy practices change, we will mail you a new notice within 60 days and post it on our Web site.

If you have any questions about our privacy practices, call Member Services at 800-457-5683 or 859-232-8686 Monday through Friday from 8:00 a.m. to 5:00 p.m. You may also send us questions by e-mail privacy@cha-health.com.

You have the right to file a complaint.
If you believe your privacy rights have been violated, you may file a complaint with us by letter or email to:

Privacy Office, CHA Health
PO Box 23468
Lexington, KY 40523-3468

privacy@cha-health.com

You may also notify the Secretary of the U.S. Department of Health and Human Services of your complaint. We will not take any action against you for filing a complaint. If you have any questions about the complaint process, including the address of the Secretary of Health and Human Services, please call the Privacy Office at 800-457-5683.