Notice of Privacy Practices - Group Health Plan

Madison County 

Notice of Privacy Practices
 Group Health Plan

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  

****PLEASE READ THIS NOTICE CAREFULLY****

Effective Date:

This Notice of Privacy Practices is effective as of January 1, 2021.

Our Privacy Commitment to You:

Madison County has established a self-insured group health plan to provide certain benefits to its eligible enrollees and their family, as applicable. The Madison County Health Care Plan (“Plan”) is committed to complying with HIPAA and all applicable state laws regarding the privacy, confidentiality and security of its enrollees protected health information. The Plan, as administered by Madison County’s designated workforce members, may create, receive, use or disclose its enrollees’ protected health information for the purposes of administering health-related employee benefits and for those other uses and disclosures as further described herein.  This notice describes your rights and the Plan’s responsibilities concerning information about you. The Plan has established policies and procedures to guard against unnecessary disclosure of your health information and for ensuring that your health information is not inappropriately disclosed. “Protected health information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or conditions and related health care services.

We are required to abide by the terms of this Notice of Privacy Practices.  We may change the terms of this Notice at any time.  Any revised Notice of Privacy Practices would be effective for all protected health information that we maintain at that time.  Upon your request, we will provide you with any revised Notice of Privacy Practices by calling the Privacy Officer and requesting that a revised copy be sent to you in the mail.  A copy of the current Notice of Privacy Practices will be prominently posted on our website at www.madisoncounty.ny.gov  

If you have questions about any part of this notice or if you want more information about the privacy practices at Madison County, please contact:

Privacy Officer

Madison County

138 N Court Street

Wampsville, New York 13163

Phone: (315) 366-2203

Uses and Disclosures of Protected Health Information

• The Plan may use or disclose your protected health information to arrange for payment of health care services on behalf of Plan enrollees, including but not limited to, arranging reimbursement for costs related to medical care you receive, evaluating the eligibility of claims submitted, and ensuring adequate claim coverage and payment. We will provide a copy or a summary of your health information, within 10 days of your request. If we need additional time to respond to your request for copies, we will notify you in writing explaining the reason for the delay and expected completion date.

• The Plan may use or disclose your protected health information for its own business and health care operations to facilitate the administration of the Plan and as necessary to provide coverage and services to all Plan enrollees. Health care operations include, but are not limited to, quality assessment and improvement activities, review and auditing (including compliance reviews, medical reviews, legal services and compliance programs), business planning and development, and business management and general administrative activities of benefit plans.

• The Plan may use or disclose your protected health information to provide to you information on health-related benefits and services that may be of interest to you. This includes disclosure of limited information to Madison County or your health care providers in order to notify you of programs that may impact your health care coverage such as health coaching and wellness programs. You may contact the Privacy Officer to request that these materials not be sent to you.

• Business Associateshe Plan may use or disclose your protected health information with third party “business associates” that perform various activities for the Plan (e.g., computer consulting company, law firm or other consultants).  Whenever an arrangement between the Plan and a business associate involves the use or disclosure of your protected health information, we will have a written contract that contains terms that will protect the privacy of your protected health information.

To Madison County.  Madison County may receive your protected health information from the Plan because Madison County as the Plan’s sponsor has agreed to the following:

• The Plan will only disclose protected health information to Madison County upon receipt of a certification by Madison County that the plan documents have bee
• An amended to incorporate required provisions. 
• Madison County will not use or further disclose any protected health information except as permitted or required to carry out administrative responsibilities as the Plan sponsor. 
• Madison County as Plan sponsor will require any agents, including subcontractors who assist the Plan in administrative functions and receive protected health information, to agree to the same restrictions, conditions and protections that we follow with respect to such information. 
• Madison County will not use or disclose protected health information obtained as the Plan sponsor for employment related actions and decisions or in connection with any other benefit or employee benefit plan of Madison County. 
• Madison County will report to the Plan any use or disclosure of protected health information that is inconsistent with the uses or disclosures provided for of which they become aware. 
• Madison County will make protected health information available to you as required by HIPAA. 
• Madison County will make protected health information available to the Plan for amendment and will incorporate any amendments to protected health information in accordance with HIPAA.
• Madison County will make available information required to provide an accounting of disclosures in accordance with HIPAA. 
• Madison County will make its internal practices, books, and records relating to the use and disclosure of protected health information received from Plan available to the Secretary of HHS for purposes of determining compliance by the Plan.
• If feasible, Madison County will return or destroy all protected health information received from the Plan that Madison County still maintains in any form and retain no copies when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.
• Madison County will ensure that adequate separation of protected health information is established as required by HIPAA.
• The Plan may disclose summary health information (as defined under HIPAA) to Madison County as the Plan sponsor if Madison County requests the summary health information for the purposes of: (A) obtaining premium bids from health plans for providing health insurance coverage under the Plan, or (B) modifying, amending or terminating the Plan. 
• The Plan may disclose to Madison County information on whether the individual is participating in the Plan or is enrolled in or had disenrolled from a health insurance insurer or HMO offered by the Plan.
• Under no circumstance will genetic testing information be used by Madison County and/or Plan for underwriting purposes. 

Other Permitted and Required Uses and Disclosures that may be made with your Permission or Opportunity to Object

The Plan may use or disclose your protected health information, provided that you are informed in advance of the use or disclosure and you have an opportunity to agree to or prohibit or restrict the use or disclosure, for certain purposes in accordance with applicable law, including but not limited to the following.

Others Involved in Your Health Care: Unless you object, we may use or disclose protected health information to a family member a relative, a close friend or any other person you identify, your protected health information that directly relates to that person’s involvement in your health care or payment related to your health care, in accordance with federal and state confidentiality and privacy laws, rules and regulations.  

Information to your family members: Subject to applicable state law, unless prior preference is expressed to the Plan, a deceased patient’s health information may be disclosed to an administrator, executor, or distributee, in accordance with applicable state and federal law.

Immunization Disclosure to Schools: Upon your agreement, which may be oral or in writing, the Plan may disclose proof of immunization to a school where a state or other law requires the school to have such information prior to admitting the student. 

Other Permitted and Required Uses and Disclosures without Authorization or Opportunity to Agree or Object

The Plan may use or disclose your protected health information without your written consent or the opportunity to agree or object for certain purposes in accordance with applicable law, including but not limited to the following.

Required by Law: We may use or disclose your protected health information to the extent that the use or disclosure is required by law.  The use or disclosure will be made in compliance with the law.

Public Health:  We may use or disclose your protected health information for public health activities to a public health authority that is permitted by law to collect or receive the information.  The disclosure will be made for the purpose of controlling disease, injury or disability.  We also may disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.  

Health Oversight:  We may disclose your protected health information to a governmental agency for activities authorized by law, such as audits, investigations, and inspections.

Legal Proceedings:  The Plan may disclose protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.

Law Enforcement:  The Plan may also disclose protected health information, so long as applicable legal requirements are met, for law enforcement purposes.  These law enforcement purposes included (1) legal processes, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of Practice, and (6) medical emergency and it is likely that a crime has occurred.

Decedents:  Health information may be disclosed by Plan to funeral directors or coroners to enable them to carry out their lawful duties.  Protected health information does not include health information of a person who has been deceased for more than 50 years.

Organ/Tissue Donation:  Your protected health information may be used or disclosed by Plan for cadaver organ, eye or tissue donation purposes.

Criminal Activity:  The Plan may use or disclose your protected health information if the Plan believes that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety or a person or the public.  We also may disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.

Workers’ Compensation:  Your protected health information may be used or disclosed by the Plan as authorized to comply with workers’ compensation laws and other similar legally established programs.

Required Uses and Disclosures:  Under the law, we must make disclosures to you when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the federal privacy regulations.

Uses and Disclosures of Protected Health Information based upon your Written Authorization

Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law or as otherwise described above.  You may revoke your authorization at any time, in writing, except to the extent that the Plan has already taken an action in reliance on the use or disclosure indicated in the authorization.

The following uses and disclosures will be made only with your authorization:

• Uses and disclosures for marketing purposes;
• Uses and disclosures that constitute the sale of protected health information; and
• Other uses and disclosures not described in this Notice of Privacy Practices.

Your Rights

This means you may inspect and obtain a copy of protected health information about you that is contained in a designated record set maintained by the Plan for as long as we maintain the protected health information. We may charge you our standard fee for the costs of copying, mailing or other supplies we use to fulfill your request.

This means you may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment or health care operations.  You also may request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices.  Your request must state the specific restriction requested and to whom you want the restriction to apply.

• For special government functions such as military, national security, and presidential protective services In most circumstances, the Plan is not required to agree to a restriction that you may request.   However, if you request us to restrict disclosures to a health plan that we would normally make as part of payment or health care operations, we must agree to that restriction if the protected health information relates to health care which you have paid out of pocket in full.
• If the Plan agrees to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment.  You may request a restriction using the form for requests for restrictions on protected health information from the HIPAA Privacy Officer, or you may provide us your request, in writing.  Your request must include (a) the information you wish restricted; (b) whether you are requesting to limit the Plan’s use, disclosure, or both; and (c) to whom you want the limits to apply.

You have the right to electronic copies of your protected health information when requested.

Where information is not readily producible in the form and format requested, the information must be provided in an alternative readable electronic format as agreed to by you and the Plan may charge a reasonable cost based fee for labor in copying protected health information and postage where you request that information be transmitted via mail or courier. 

For example, you may ask us to contact you by mail, rather than by phone at home.  You do not have to provide us a reason for this request.  We will accommodate reasonable requests.  We also may condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact.  Please make this request in writing to our HIPAA Privacy Officer.

This means you may request an amendment of protected health information about you that we maintain.  In certain cases, we may deny your request for an amendment.  If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal.  Please contact our HIPAA Privacy Officer if you have questions about amending your medical record.

This right applies generally to disclosures for purposes other than treatment, payment or health care operations as described in this Notice of Privacy Practices.  However, you do have the right to an accounting of disclosures for treatment, payment or health care operations if the disclosures were made from an electronic health record.

• Your right to an accounting of disclosures excludes disclosures we may have made to you, or to family members or friends involved in your care, or for notification purposes.  
• You have the right to receive specific information regarding other disclosures that occurred up to six years from the date of your request (three years in the case of disclosures from an electronic health record made for treatment, payment or health care operations).  You may request a shorter timeframe.  The first list you request within a 12-month period is free of charge, but there is a charge involved with any additional lists within the same 12-month period.  We will inform you of any costs involved with additional requests, and you may withdraw your request before you incur any costs.

You have the right to obtain a paper copy of this Notice from us.

You have the right to opt out of fundraising communications (if the Plan conducts fundraising).

You have the right to receive notice in the event of a breach of unsecured protected health information.  

This means that you will receive notice if a breach of your protected health information is discovered within 60 days of discovery.  

How to Exercise Your Legal Rights

Questions about our privacy policies and procedures and requests to exercise individual rights should be directed to the County’s Privacy Officer at (315) 366-2203. All complaints must be submitted in writing.

If you believe your privacy rights have been violated, you may file a complaint with the County’s Privacy Officer, or with the Secretary of the U.S. Department of Health and Human Services (“DHSS’). Should you choose to file a complaint with the County’s Privacy Officer, you will be given a complaint form and an overview of the complaint process. 

If you want to file a complaint with DHHS, the contact information is as follows:

Office for Civil Rights, DHHS

26 Federal Plaza - Suite 3312

New York, NY 10278

(212) 264-3313; (212) 264-2355 (TDD)

(212) 264-3039 FAX

E-mail: OCRcomplaint@hhs.gov 

Online Complaint Portal: https://ocrportal.hhs.gov/ocr/cp/complaint_frontpage.jsf 

YOU WILL NOT BE RETALIATED AGAINST, IN ANY MANNER, FOR FILING A COMPLAINT