Plan and your spouse’s plan or covered by the plans covering your father and mother), we may share your PHI with the other plans to coordinate payment of your claims. • Health care Operations: The Plan may use and disclose your PHI in the course of its “health care operations.” For example, it may use your PHI in evaluating the quality of services you received or disclose your PHI to an accountant or attorney for audit purposes. In some cases, the Plan may disclose your PHI to insurance companies for purposes of obtaining various insurance coverages. However, the Plan will not disclose, for underwriting purposes, PHI that is genetic information. • Other Uses and Disclosures of Your PHI Not Requiring Authorization. The law provides that the Plan may use and disclose your PHI without authorization in the following circumstances: • To the Plan Sponsor: The Plan may disclose PHI to the employers (such as Healthcare Information and Management Systems Society) who sponsor or maintain the Plan for the benefit of employees and dependents. However, the PHI may only be used for limited purposes, and may not be used for purposes of employment-related actions or decisions or in connection with any other benefit or employee benefit plan of the employers. PHI may be disclosed to: the human resources or employee benefits department for purposes of enrollments and disenrollments, census, claim resolutions, and other matters related to Plan administration; payroll department for purposes of ensuring appropriate payroll deductions and other payments by covered persons for their coverage; information technology department, as needed for preparation of data compilations and reports related to Plan administration; finance department for purposes of reconciling appropriate payments of premium to and benefits from the Plan, and other matters related to Plan administration; internal legal counsel to assist with resolution of claim, coverage, and other disputes related to the Plan’s provision of benefits. • To the Plan’s Service Providers: The Plan may disclose PHI to its service providers (“business associates”) who perform claim payment and plan management services. The Plan requires a written contract that obligates the business associate to safeguard and limit the use of PHI. • Required by Law: The Plan may disclose PHI when a law requires that it report information about suspected abuse, neglect, or domestic violence, or relating to suspected criminal activity, or in response to a court order. It must also disclose PHI to authorities that monitor compliance with these privacy requirements. • For Public Health Activities: The Plan may disclose PHI when required to collect information about disease or injury, or to report vital statistics to the public health authority. • For Health Oversight Activities: The Plan may disclose PHI to agencies or departments responsible for monitoring the health care system for such purposes as reporting or investigation of unusual incidents. • Relating to Decedents: The Plan may disclose PHI relating to an individual’s death to coroners, medical examiners, or funeral directors, and to organ procurement organizations relating to organ, eye, or tissue donations or transplants. • For Research Purposes: In certain circumstances, and under strict supervision of a privacy board, the Plan may disclose PHI to assist medical and psychiatric research. • To Avert Threat to Health or Safety: In order to avoid a serious threat to health or safety, the Plan may disclose PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm. • For Specific Government Functions: The Plan may disclose PHI of military personnel and veterans in certain situations, to correctional facilities in certain situations, to government programs relating to eligibility and enrollment, and for national security reasons. • Uses and Disclosures Requiring Authorization: For uses and disclosures beyond treatment, payment, and operations purposes, and for reasons not included in one of the exceptions described above, the Plan is required to have your written authorization. For example, uses and disclosures of psychotherapy notes, uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI would require your authorization. Your authorization can be revoked at any time to stop future uses and disclosures, except to the extent that the Plan has already undertaken an action in reliance upon your authorization. • Uses and Disclosures Requiring You to Have an Opportunity to Object: The Plan may share PHI with your family, friend, or other person involved in your care, or payment for your care. We may also share PHI with these people to notify them about your location, general condition, or death. However, the Plan may disclose your PHI only if it informs you about the disclosure in advance and you do not object (but if there is an emergency situation and you cannot be given your opportunity to object, disclosure may be made if it is consistent with any prior expressed wishes and disclosure is determined to be in your best interests; you must be informed and given an opportunity to object to further disclosure as soon as you are able to do so). Your Rights Regarding Your Protected Health Information 29
