HIPAA Privacy Policy

NOTICE OF PRIVACY PRACTICES FOR THE USE AND DISCLOSURE OF HEALTH INFORMATION

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective April 14, 2003

The Williams College Group Insurance Plan (the Plan) is committed to protecting the confidentiality of your health information in a responsible and professional manner. Under federal legislation known as “HIPAA” (“Health Insurance Portability and Accountability Act“), certain components of the Plan that use or disclose individually identifiable health information are subject to HIPAA’s privacy rules. Those components are the medical and dental benefits, the Medical Expense Reimbursement Account, and the employee assistance program.

HIPAA refers to this individually identifiable information as “protected health information,” also known as “PHI.” PHI means information that is created or received by a health care provider or health plan that relates to your past, present or future physical or mental health or condition and related health care services, including payment for those services.

This notice informs you about your rights with respect to your PHI and how you can exercise these rights. The Plan is required to maintain the privacy of your PHI, to follow the standards described in this notice, and to provide you with
this notice upon your request (and to send you this notice automatically if you participate in the Medical Expense Reimbursement Account or the dental program).

How the Plan Uses or Shares Your PHI

The following are ways that the Plan may use or share your PHI without your authorization:

• The Plan may use or share your PHI to help pay your medical bills that have been submitted to it by doctors and hospitals for payment. For example, the Plan may ask a hospital emergency department for details about your treatment before the Plan pays the bill for your care.
• The Plan may use or may share your PHI with others for its general business operations. For example, the Plan may use or share your PHI in conducting quality assessment and improvement activities.
• The Plan may share your PHI with others who help it conduct its business operations. For example, the Plan may share your PHI with a business associate who provides it with administrative, consulting, or accounting services.
• The Plan may share your PHI with doctors or hospitals to help them provide medical care to you. For example, if your primary care physician or your treating medical provider refers you to a specialist for treatment, the Plan can disclose your PHI to the specialist to whom you have been referred so he or she can become familiar with your medical condition.
• The Plan may share your PHI with the Human Resources Office (the plan sponsor) in order for Benefits to assist in the administration of the Plan.
• The Plan may share your PHI for public health activities. For example, the Plan may report PHI to the Food and Drug Administration for investigating or tracking of prescription drug and medical device problems.
• The Plan may report your PHI to a government authority regarding child abuse, neglect or domestic violence.
• The Plan may provide PHI to state and federal agencies to whom the Plan reports, such as the US Department of Health and Human Services.
• The Plan may share your PHI with a health oversight agency for certain oversight activities (for example, audits, inspections, and administrative proceedings).
• The Plan may provide your PHI to a court or administrative agency (for example, pursuant to a court order, search warrant or subpoena).
• The Plan may report your PHI for law enforcement purposes. For example, the Plan may give PHI to a law enforcement official for purposes of identifying or locating a suspect, fugitive, material witness or missing person.
• The Plan may share your PHI with a coroner or medical examiner to identify a deceased person, determine a cause of death, or as otherwise authorized by law. The Plan may also share PHI with funeral directors as necessary to carry out their duties.
• The Plan may report PHI for approved research purposes.
• The Plan may report your PHI to public health agencies if the Plan believes there is a serious health or safety threat.
• The Plan may share PHI for specialized government functions. For example, the Plan may disclose your PHI if it relates to military and veteran activities, national security and intelligence activities, and protective services for the President and others.
• The Plan may report PHI relating to job-related injuries because of requirements of state workers’ compensation laws.
• The Plan may use and share PHI for other reasons required by law.

Generally speaking, if one of the above reasons does not apply, the Plan must get your written authorization to use or disclose your PHI. If you give the Plan written authorization and change your mind, you may revoke your authorization at any time. Once you give the Plan authorization to release your PHI, the Plan cannot guarantee that the person to whom the information is provided will not disclose the PHI, because the Plan has no control over that third party.

Other Laws

The Plan’s use and disclosure of PHI must comply with relevant Massachusetts law in addition to HIPAA. In some instances Massachusetts law provides different and sometimes more stringent protections of PHI than does HIPAA. Examples of more strict Massachusetts state law include those that limit: 1) the disclosure of mental health records in court proceedings, 2) the disclosure of PHI of those infected with HIV, and 3) the admissibility of records relating to domestic violence in court proceedings.

If you have questions about this, you may contact the Plan’s HIPAA Privacy Official (contact information at the end of this notice).

Your Rights

The following are your rights with respect to your PHI maintained by the Plan. If you would like to exercise the following rights, please contact the Plan’s HIPAA Privacy Official (contact information at the end of this notice) by submitting a written request.

• You have the right to ask the Plan to restrict how it uses or discloses your PHI for treatment, payment or health care operations. Please note that while the Plan will try to honor your request, the Plan is not required to agree to these restrictions.
• You have the right to ask to receive confidential communications of PHI. For example, if you believe that you would be harmed if the Plan sends your PHI to your current mailing address (for example in situations involving domestic disputes or violence), you can ask the Plan to send the information by alternative means (for example by fax) or to an alternative address. The Plan will accommodate your requests if they are reasonable.
• You have the right to inspect and obtain a copy of PHI that the Plan maintains about you in your designated record set. A “designated record set” is a group of PHI records that the Plan uses to make decisions about you, including enrollment, payment, claims adjudication, and case or medical management records of the plan.
  
  However, you do not have the right to access certain types of information, and the Plan may decide not to provide you with copies of:

  • information contained in psychotherapy notes; and
  • information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding

  Additionally, in certain other situations, the Plan may deny your request to inspect or obtain a copy of your PHI. If the Plan denies your request, the Plan will notify you in writing and may provide you with a right to have the denial reviewed.

• You have the right to ask the Plan to amend PHI the Plan maintains about you in your designated record set. The Plan may require that your request be in writing and that you provide a reason for your request. The Plan will respond to your request no later than 60 days after the Plan receives it. If the Plan is unable to act within 60 days, the Plan may extend that time by no more than an additional 30 days. If the Plan needs to extend this time, the Plan will notify you of the delay and the date by which the Plan will complete action on your request.
  
  If the Plan makes the amendment, the Plan will notify you that it was made. In addition, the Plan will provide the amendment to any person that the Plan knows has received your PHI. The Plan will also provide the amendment to other persons that you identify.
  
  If the Plan denies your request to amend, the Plan will notify you in writing of the reason for the denial. The denial will explain your right to file a written statement of disagreement. The Plan has a right to rebut your statement. However, you have the right to request that your written request, the Plan’s written denial, and your statement of disagreement be included with your PHI for any future disclosures.
• You have the right to receive an accounting of certain disclosures of your PHI made by the Plan during the six years prior to your request. Please note that the Plan is not required to provide you with an accounting of the following information:
  

  • Any information collected prior to April 14, 2003;
  • Information disclosed or used for treatment, payment, and health care operations;
  • Information disclosed to you or pursuant to your authorization;
  • Information that is incident to a use or disclosure otherwise permitted;
  • Information disclosed to persons involved in your care or other notification purposes;
  • Information disclosed for national security or intelligence purposes;
  • Information disclosed to correctional institutions and law enforcement officials in certain situations; and
  • Information that was disclosed or used as part of a limited data set for health care operations, public health, or research purposes.

  The Plan will require that your request be in writing. The Plan will act on your request for an accounting within 60 days. The Plan may need additional time to act on your request, and therefore may take up to an additional 30 days. Your first accounting will be free, and the Plan will continue to provide to you one free accounting upon request every 12 months. However, if you request an additional accounting within 12 months of receiving your free accounting, the Plan may charge you a fee. The Plan will inform you in advance of the fee and provide you with an opportunity to withdraw or modify your request.

Exercising Your Rights

• You have a right to receive a copy of this notice upon request at any time. You can also view a copy of the notice on the Williams College web site. This notice and the Plan’s HIPAA privacy policies are subject to change. If you participate in the Medical Expense Reimbursement Account, the Plan will notify you of any changes to this notice by mail. The Plan will also post a revised notice on the Williams College web site. When material changes are made to this notice or to the Plan’s HIPAA privacy policies, the changes will affect practices with respect to all the Plan’s PHI, including PHI collected prior to the changes.
• If you have any questions about this notice or about how the Plan uses or shares PHI, or want a paper copy of this notice, please contact Megan Childers, Benefits Specialist or call (413) 597-4355.
• If you believe your privacy rights have been violated, you may file a complaint by contacting the Plan’s Privacy Official (Vice President for Finance & Operations and Treasurer) or call (413) 597-4421. You may also notify the Secretary of the U.S. Department of Health and Human Services of your complaint.

The Plan will not take any action against you for filing a complaint.