You have the following rights relating to your protected health information: • To Request Restrictions on Uses and Disclosures: You have the right to ask that the Plan limit how it uses or discloses your PHI. The Plan will consider your request, but is not legally bound to agree to the restriction. To the extent that it agrees to any restrictions on its use or disclosure of your PHI, it will put the agreement in writing and abide by it except in emergency situations. The Plan cannot agree to limit uses or disclosures that are required by law. • To Choose How the Plan Contacts You: You have the right to ask that the Plan send you information at an alternative address or by an alternative means. To request confidential communications, you must make your request in writing to the Privacy Official. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. The Plan must agree to your request as long as it is reasonably easy for it to accommodate the request. • To Inspect and Copy Your PHI: Unless your access is restricted for clear and documented treatment reasons, you have a right to see your PHI in the possession of the Plan or its vendors if you put your request in writing. The Plan, or someone on behalf of the Plan, will respond to your request, normally within 30 days. If your request is denied, you will receive written reasons for the denial and an explanation of any right to have the denial reviewed. If you want copies of your PHI, a charge for copying may be imposed but may be waived, depending on your circumstances. You have a right to choose what portions of your information you want copied and to receive, upon request, prior information on the cost of copying. • To Request Amendment of Your PHI: If you believe that there is a mistake or missing information in a record of your PHI held by the Plan or one of its vendors you may request in writing that the record be corrected or supplemented. The Plan or someone on its behalf will respond, normally within 60 days of receiving your request. The Plan may deny the request if it is determined that the PHI is: (i) correct and complete; (ii) not created by the Plan or its vendor and/or not part of the Plan’s or vendor’s records; or (iii) not permitted to be disclosed. Any denial will state the reasons for denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to your PHI. If the request for amendment is approved, the Plan or vendor, as the case may be, will change the PHI and so inform you, and tell others that need to know about the change in the PHI. • To Find Out What Disclosures Have Been Made: You have a right to get a list of when, to whom, for what purpose, and what portion of your PHI has been released by the Plan and its vendors, other than instances of disclosure for which you gave authorization, or instances where the disclosure was made to you or your family. In addition, the disclosure list will not include disclosures for treatment, payment, or health care operations. The list also will not include any disclosures made for national security purposes, to law enforcement officials or correctional facilities, or before the date the federal privacy rules applied to the Plan. You will normally receive a response to your written request for such a list within 60 days after you make the request in writing. Your request can relate to disclosures going as far back as six years. There will be no charge for up to one such list each year. There may be a charge for more frequent requests. How to Complain About the Plan’s Privacy Practices If you think the Plan or one of its vendors may have violated your privacy rights, or if you disagree with a decision made by the Plan or a vendor about access to your PHI, you may file a complaint with the person listed in the section immediately below. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services. The law does not permit anyone to take retaliatory action against you if you make such complaints. Notification of a Privacy Breach Any individual whose unsecured PHI has been, or is reasonably believed to have been used, accessed, acquired or disclosed in an unauthorized manner will receive written notification from the Plan within 60 days of the discovery of the breach. If the breach involves 500 or more residents of a state, the Plan will notify prominent media outlets in the state. The Plan will maintain a log of security breaches and will report this information to HHS on an annual basis. Immediate reporting from the Plan to HHS is required if a security breach involves 500 or more people. Contact Person for Information, or to Submit a Complaint If you have questions about this notice please contact the Plan’s Privacy Official or Deputy Privacy Official(s) (see below). If you have any complaints about the Plan’s privacy practices, handling of your PHI, or breach notification process, please contact the Privacy Official or an authorized Deputy Privacy Official. 30
