Effective
The Plan has determined that it is a ‘group health plan’
within the meaning of the HIPAA Privacy Rule, and the Plan designates the Plan
Sponsor to take all actions required to be taken by the Plan in connection with
the HIPAA Privacy Rule (e.g., entering into business associate contracts;
accepting certification from the Plan Sponsor).
II. Definitions
All terms defined in the HIPAA
Privacy Rule, shall have the meaning set forth therein. The following
additional definitions apply to the provisions set forth in this Amendment.
A. Plan means the Cole
Pattern & Engineering Co., Inc. Group Life, AD&D and Medical Plan.
B. Plan Documents mean the Plan’s
governing documents and instruments (i.e., the documents under which the Plan
was established and is maintained), including but not limited to the Cole Pattern & Engineering Co., Inc. Group
Life, AD&D and Medical Plan Master Provision Pages, amendments and summary
plan descriptions.
C. Plan Sponsor means
"Plan Sponsor" as defined at section 3(16)(B) of ERISA, 29 U.S.C. §
1002(16)(B). The Plan Sponsor is Cole Pattern & Engineering Co., Inc.
III.
The Plan’s disclosure of Protected Health Information to the Plan Sponsor –
Required Certification of Compliance by
Plan Sponsor
Except as provided below with
respect to the Plan’s disclosure of summary health information, the Plan will
(a) disclose Protected Health Information to the Plan Sponsor or (b) provide
for or permit the disclosure of Protected Health Information to the Plan
Sponsor by a health insurance issuer with respect to the Plan, only if the
Plan has received a certification (signed on behalf of the Plan Sponsor) that:
1.
the Plan Documents have been amended to establish
the permitted and required uses and disclosures of such information by the Plan
Sponsor, consistent with the "504" provisions;
2.
the Plan Documents have been amended to incorporate
the Plan provisions set forth in this Amendment; and
3.
the Plan Sponsor agrees to comply with the
Plan provisions as modified by this Amendment
IV. Permitted disclosure of individuals'
Protected Health Information to the Plan Sponsor
A. The Plan (and
any business associate acting on behalf of the Plan), or any health insurance
issuer servicing the Plan will disclose individuals’ Protected Health
Information to the Plan Sponsor only to permit the Plan Sponsor to carry out
Plan administration functions. Such disclosure will be consistent with the
provisions of this Amendment.
B. All
disclosures of the Protected Health Information of the Plan’s individuals by
the Plan’s business associate, or health insurance issuer, to the Plan Sponsor
will comply with the restrictions and requirements set forth in this Amendment
and in the "504" provisions.
C. The Plan (and
any business associate acting on behalf of the Plan), may not, and may not
permit a health insurance issuer, to disclose individuals’ Protected Health
Information to the Plan Sponsor for employment-related actions and decisions or
in connection with any other benefit or employee benefit plan of the Plan
Sponsor.
D. The Plan Sponsor
will not use or further disclose individuals’ Protected Health Information
other than as described in the Plan Documents and permitted by the
"504" provisions.
E. The Plan Sponsor will ensure that any
agent(s), including a subcontractor, to whom it provides individuals’ Protected
Health Information received from the Plan (or from the Plan’s health insurance
issuer), agrees to the same restrictions and conditions that apply to the Plan
Sponsor with respect to such Protected Health Information.
F. The Plan Sponsor will not use or disclose
individuals’ Protected Health Information for employment-related actions and
decisions or in connection with any other benefit or employee benefit plan of
the Plan Sponsor.
G. The Plan
Sponsor will report to the Plan any use or disclosure of Protected Health
Information that is inconsistent with the uses or disclosures provided for in
the Plan Documents (as amended) and in the "504" provisions, of which
the Plan Sponsor becomes aware.
V. Disclosure of
individuals’ Protected Health Information –
Disclosure by the Plan Sponsor
A. The Plan
Sponsor will make the Protected Health Information of the individual who is the
subject of the Protected Health Information available to such individual in
accordance with 45 C.F.R. § 164.524.
B. The Plan
Sponsor will make individuals’ Protected Health Information available for
amendment and incorporate any amendments to individuals’ Protected Health
Information in accordance with 45 C.F.R. §164.526.
C. The Plan
Sponsor will make and maintain an accounting so that it can make available
those disclosures of individuals’ Protected Health Information that it must
account for in accordance with 45 C.F.R. §164.528.
D. The Plan
Sponsor will make its internal practices, books and records relating to the use
and disclosure of individuals’ Protected Health Information received from the
Plan available to the U.S. Department of Health and Human Services for purposes
of determining compliance by the Plan with the HIPAA Privacy Rule.
E. The Plan Sponsor will, if feasible, return or
destroy all individuals’ Protected Health Information received from the Plan
(or a health insurance issuer with respect to the Plan) that the Plan Sponsor
still maintains in any form after such information is no longer needed for the
purpose for which the use or disclosure was made. Additionally, the Plan
Sponsor will not retain copies of such Protected Health Information after such
information is no longer needed for the purpose for which the use or disclosure
was made. If, however, such return or destruction is not feasible, the Plan
Sponsor will limit further uses and disclosures to those purposes that make the
return or destruction of the information infeasible.
F. The Plan Sponsor will ensure that the required
adequate separation, described in paragraph VII below, is established and
maintained.
VI. Disclosures of
Summary Health Information, Enrollment and Disenrollment information to the
Plan Sponsor
A. The Plan, or a
health insurance issuer with respect to the Plan, may disclose summary health
information to the Plan Sponsor without the need to amend the Plan Documents as
provided for in the "504" provisions, if the Plan Sponsor requests
the summary health information for the purpose of:
1. Obtaining premium bids from health plans for providing health
insurance coverage under the Plan; or
2.
Modifying, amending, or terminating the Plan.
B. The Plan, or a
health insurance issuer with respect to the Plan, may disclose enrollment and
disenrollment information to the Plan Sponsor without the need to amend the
Plan Documents as provided for in the "504" provisions.
VII. Required separation
between the PLAN and the Plan Sponsor
A. In accordance
with the "504" provisions, this section describes the employees or
classes of employees or workforce members under the control of the Plan Sponsor
who may be given access to individuals’ Protected Health Information received
from the Plan or from a health insurance issuer servicing the Plan.
1. Division Insurance Coordinator(s)
2. Company Nurse(s)
3. Corporate Management responsible for Plan
administration
B. This list
reflects the employees, classes of employees, or other workforce members of the
Plan Sponsor who receive individuals’ Protected Health Information relating to
payment under, health care operations of, or other matters pertaining to Plan
administration functions that the Plan Sponsor provides for the Plan. These
individuals will have access to individuals’ Protected Health Information
solely to perform these identified functions, and they will be subject to
disciplinary action and/or sanctions (including termination of employment or
affiliation with the Plan Sponsor) for any use or disclosure of individuals’ Protected
Health Information in violation of, or noncompliance with, the provisions of
this Amendment.
C. The Plan
Sponsor will promptly report any such breach, violation, or noncompliance to
the Plan and will cooperate with the Plan to correct the violation or
noncompliance, to impose appropriate disciplinary action and/or sanctions, and
to mitigate any deleterious effect of the violation or noncompliance.
Note
- This addendum is included as a convenience and is not part of the Plan.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT
YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices describes how protected health
information may be used or disclosed by your Group Health Plan to carry out
payment, health care operations, and for other purposes that are permitted or
required by law. This Notice also sets out our legal obligations concerning
your protected health information, and describes your rights to access and
control your protected health information.
Protected health information (or "PHI") is
individually identifiable health information, including demographic
information, collected from you or created or received by a health care
provider, a health plan, your employer (when functioning on behalf of the group
health plan), or a health care clearinghouse and that relates to: (i) your
past, present, or future physical or mental health or condition; (ii) the
provision of health care to you; or (iii) the past, present, or future payment
for the provision of health care to you.
This Notice of Privacy Practices had been drafted to be
consistent with what is known as the "HIPAA Privacy Rule," and any of
the terms not defined in this Notice should have the same meaning as they have
in the HIPAA Privacy Rule.
If you have any questions or want additional information
about the Notice or the policies and procedures described in the Notice, please
contact: Underwriters Safety and Claims, Attn: Privacy Officer, P. O. Box 23507, Louisville, KY 40223; 1-800-678-1536.
EFFECTIVE DATE
This
Notice of Privacy Practices becomes effective on
OUR RESPONSIBILITIES
We are required by law to maintain the privacy of your
protected health information. We are obligated to provide you with a copy of
this Notice of our legal duties and of our privacy practices with respect to
protected health information, and we must abide by the terms of this Notice. We
reserve the right to change the provisions of our Notice and make the new
provisions effective for all protected health information that we maintain. If
we make a material change to our Notice, we will mail a revised Notice to the
address that we have on record for the contract holder for your member
contract.
The following is a description of how we are most likely to
use and/or disclose your protected health information.
We have the right to use and
disclose your protected health information for all activities that are included
within the definitions of "payment" and "health care
operations" as set out in 45 C.F.R. § 164.501 (this provision is a
part of the HIPAA Privacy Rule). We have not listed in this Notice all of the
activities included within these definitions, so please refer to 45 C.F.R.
§ 164.501 for a complete list.
·
Payment
We will use or disclose your PHI to
pay claims for services provided to you and to obtain stop-loss reimbursements
or to otherwise fulfill our responsibilities for coverage and providing
benefits. For example, we may disclose your protected health information when a
provider requests information regarding your eligibility for coverage under our
health plan, or we may use your information to determine if a treatment that
you received was medically necessary.
·
Health Care Operations
We will use or disclose your
protected health information to support our business functions. These functions
include, but are not limited to: quality assessment and improvement, reviewing
provider performance, licensing, stop-loss underwriting, business planning, and
business development. For example, we may use or disclose your protected health
information: (i) to provide you with information about one of our disease
management programs; (ii) to respond to a customer service inquiry from
you; or (iii) in connection with fraud and abuse detection and compliance
programs.
We contract with individuals and entities
(Business Associates) to perform various functions on our behalf or to provide
certain types of services. To perform these functions or to provide the
services, our Business Associates will receive, create, maintain, use, or
disclose protected health information, but only after we require the Business
Associates to agree in writing to contract terms designed to appropriately
safeguard your information. For example, we may disclose your protected health
information to a Business Associate to administer claims or to provide member
service support, utilization management, subrogation, or pharmacy benefit
management. Examples of our business associates would be our Third Party
Administrator, Underwriters Safety & Claims, which will be handling many of
the functions in connection with the operation of our Group Health Plan; the
retail pharmacy; and the mail order pharmacy; networks and brokers.
·
Other Covered Entities
We may use or disclose your
protected health information to assist health care providers in connection with
their treatment or payment activities, or to assist other covered entities in
connection with payment activities and certain health care operations. For
example, we may disclose your protected health information to a health care
provider when needed by the provider to render treatment to you, and we may
disclose protected health information to another covered entity to conduct
health care operations in the areas of quality assurance and improvement
activities, or accreditation, certification, licensing or credentialing. This
also means that we may disclose or share your protected health information with
other insurance carriers in order to coordinate benefits, if you or your family
members have coverage through another carrier.
We may disclose your protected
health information to the plan sponsor of the Group Health Plan for purposes of
plan administration or pursuant to an authorization request signed by you.
Potential Impact of State
Law
The HIPAA Privacy Regulations generally do not
"preempt" (or take precedence over) state privacy or other applicable
laws that provide individuals greater privacy protections. As a result, to the
extent state law applies, the privacy laws of a particular state, or other
federal laws, rather than the HIPAA Privacy Regulations, might impose a privacy
standard under which we will be required to operate. For example, where such
laws have been enacted, we will follow more stringent state privacy laws that
relate to uses and disclosures of protected health information concerning HIV
or AIDS, mental health, substance abuse/chemical dependency, genetic testing,
reproductive rights, etc.
Other Possible Uses and Disclosures of
Protected Health Information
The following is a description of other possible ways in
which we may (and are permitted to) use and/or disclose your protected health
information.
We may use or disclose your
protected health information to the extent that federal law requires the use or
disclosure. When used in this Notice, "required by law" is defined as
it is in the HIPAA Privacy Rule. For example, we may disclose your protected
health information when required by national security laws or public health
disclosure laws.
We may use or disclose your
protected health information for public health activities that are permitted or
required by law. For example, we may use or disclose information for the
purpose of preventing or controlling disease, injury, or disability, or we may
disclose such information to a public health authority authorized to receive
reports of child abuse or neglect. We also may disclose protected health
information, if directed by a public health authority, to a foreign government
agency that is collaborating with the public health authority.
We may disclose your protected
health information to a health oversight agency for activities authorized by
law, such as: audits; investigations; inspections; licensure or disciplinary
actions; or civil, administrative, or criminal proceedings or actions.
Oversight agencies seeking this information include government agencies that
oversee: (i) the health care system; (ii) government benefit
programs; (iii) other government regulatory programs; and (iv) compliance
with civil rights laws.
We may disclose your protected
health information to a government authority that is authorized by law to
receive reports of abuse, neglect, or domestic violence. Additionally, as
required by law, we may disclose to a governmental entity authorized to receive
such information your information if we believe that you have been a victim of
abuse, neglect, or domestic violence.
We may disclose your protected
health information: (1) in the course of any judicial or administrative
proceeding; (2) in response to an order of a court or administrative
tribunal (to the extent such disclosure is expressly authorized); and
(3) in response to a subpoena, a discovery request, or other lawful process,
once we have met all administrative requirements of the HIPAA Privacy Rule. For
example, we may disclose your protected health information in response to a
subpoena for such information, but only after we first meet certain conditions
required by the HIPAA Privacy Rule.
Under certain conditions, we also
may disclose your protected health information to law enforcement officials.
For example, some of the reasons for such a disclosure may include, but not be
limited to: (1) it is required by law or some other legal process;
(2) it is necessary to locate or identify a suspect, fugitive, material
witness, or missing person; and (3) it is necessary to provide evidence of
a crime that occurred on our premises.
We may disclose protected health
information to a coroner or medical examiner for purposes of identifying a
deceased person, determining a cause of death, or for the coroner or medical
examiner to perform other duties authorized by law. We also may disclose, as
authorized by law, information to funeral directors so that they may carry out
their duties. Further, we may disclose protected health information to
organizations that handle organ, eye, or tissue donation and transplantation.
We may disclose your protected
health information to researchers when an institutional review board or privacy
board has: (1) reviewed the research proposal and established protocols to
ensure the privacy of the information; and (2) approved the research.
Consistent with applicable federal
and state laws, we may disclose your protected health information if we believe
that the disclosure is necessary to prevent or lessen a serious and imminent
threat to the health or safety of a person or the public. We also may disclose
protected health information if it is necessary for law enforcement authorities
to identify or apprehend an individual.
Under certain conditions, we may
disclose your protected health information if you are, or were, Armed Forces
personnel for activities deemed necessary by appropriate military command
authorities. If you are a member of foreign military service, we may disclose,
in certain circumstances, your information to the foreign military authority.
We also may disclose your protected health information to authorized federal
officials for conducting national security and intelligence activities, and for
the protection of the President, other authorized persons, or heads of state.
If you are an inmate of a
correctional institution, we may disclose your protected health information to
the correctional institution or to a law enforcement official for: (1) the
institution to provide health care to you; (2) your health and safety and
the health and safety of others; or (3) the safety and security of the
correctional institution.
We may disclose your protected
health information to comply with workers’ compensation laws and other similar
programs that provide benefits for work-related injuries or illnesses.
Using our best judgment, we may make
your protected health information known to a family member, other relative,
close personal friend or other personal representative that you identify. Such
a use will be based on how involved the person is in your care, or payment that
relates to your care. We may release information to parents or guardians, if allowed
by law.
We also may disclose your
information to an entity assisting in a disaster relief effort so that your
family can be notified about your condition, status, and location.
If you are not present or able to
agree to these disclosures of your protected health information, then, using
our professional judgment, we may determine whether the disclosure is in your
best interest.
Required Disclosures of Your
Protected Health Information
The
following is a description of disclosures that we are required by law to make.
We are required to disclose your
protected health information to the Secretary of the U.S. Department of Health
and Human Services when the Secretary is investigating or determining our
compliance with the HIPAA Privacy Rule.
We are required to disclose to you
most of your protected health information in a "designated record
set" when you request access to this information. Generally, a "designated
record set" contains medical and billing records, as well as other records
that are used to make decisions about your health care benefits. We also are
required to provide, upon your request, an accounting of most disclosures of
your protected health information that are for reasons other than payment and
health care operations and are not disclosed through a signed authorization.
We will disclose your protected
health information to an individual who has been designated by you as your
personal representative and who has qualified for such designation in
accordance with relevant state law. However, before we will disclose protected
health information to such a person, you must submit a written notice of
his/her designation, along with the documentation that supports his/her
qualification (such as a power of attorney).
Even if you designate a personal
representative,
the HIPAA Privacy Rule permits us to elect not to treat the person as your
personal representative if we have a reasonable belief that: (i) you have
been, or may be, subjected to domestic violence, abuse, or neglect by such
person; (ii) treating such person as your personal representative could
endanger you; or (iii) we determine, in the exercise of our professional
judgment, that it is not in your best interest to treat the person as your
personal representative.
Other Uses and Disclosures of Your Protected
Health Information
Other uses and disclosures of your protected health
information that are not described above will be made only with your written
authorization. If you provide us with such an authorization, you may revoke the
authorization in writing, and this revocation will be effective for future uses
and disclosures of protected health information. However, the revocation will not
be effective for information that we already have used or disclosed, relying on
the authorization.
YOUR RIGHTS
The following is a description of your rights with respect
to your protected health information.
·
Right to Request a Restriction
You have the right to request a
restriction on the protected health information we use or disclose about you
for payment or health care operations.
We are not required to agree to any
restriction that you may request. If we do agree to the restriction, we will comply with the
restriction unless the information is needed to provide emergency treatment to
you.
You may request a restriction by
calling us at 1-800-678-1536 or writing to Underwriters Safety & Claims,
Attn: Privacy Officer,
We will want to receive this
information in writing and will instruct you where to send your request when
you call. In your request, please tell us: (1) the information whose
disclosure you want to limit; and (2) how you want to limit our use and/or
disclosure of the information.
·
Right to Request Confidential Communications
If you believe that a disclosure of
all or part of your protected health information may endanger you, you may
request that we communicate with you regarding your information in an
alternative manner or at an alternative location. For example, you may ask that
we only contact you at your work address or via your work e-mail.
You may request a restriction by
calling us at the number listed in the summary page of this Notice or writing
to Underwriters Safety & Claims, Attn: Privacy Officer,
We will want to receive this
information in writing and will instruct you where to send your written request
when you call. In your request, please tell us: (1) that you want us to
communicate your protected health information with you in an alternative manner
or at an alternative location; and (2) that the disclosure of all or part
of the protected health information in a manner inconsistent with your
instructions would put you in danger.
We will accommodate a request for
confidential communications that is reasonable and that states that the
disclosure of all or part of your protected health information could endanger
you. As permitted by the HIPAA Privacy Rule, "reasonableness" will
(and is permitted to) include, when appropriate, making alternate arrangements
regarding payment.
Accordingly, as a condition of
granting your request, you will be required to provide us information
concerning how payment will be handled. For example, if you submit a claim for
payment, state or federal law (or our own contractual obligations) may require
that we disclose certain financial claim information to the plan participant (e.g., an
EOB). Unless you have made other payment arrangements, the EOB (in which
your protected health information might be included) will be released to the
plan participant.
Once we receive all of the
information for such a request (along with the instructions for handling future
communications), the request will be processed usually within five business
days.
Prior to receiving the information
necessary for this request, or during the time it takes to process it,
protected health information may be disclosed (such as through an Explanation
of Benefits, "EOB"). Therefore, it is extremely important that you
contact us at the number listed in the summary page of this Notice as
soon as you determine that you need to restrict disclosures of your
protected health information.
If you terminate your request for
confidential communications, the restriction will be removed for all
your protected health information that we hold, including protected health
information that was previously protected. Therefore, you should not terminate
a request for confidential communications if you remain concerned that
disclosure of your protected health information will endanger you.
·
Right to Inspect and Copy
You have the right to inspect and
copy your protected health information that is contained in a "designated
record set." Generally, a "designated record set" contains
medical and billing records, as well as other records that are used to make
decisions about your health care benefits. However, you may not inspect or copy
psychotherapy notes or certain other information that may be contained in a
designated record set.
To inspect and copy your protected
health information that is contained in a designated record set, you must
submit your request by calling us at the number listed in the summary page of
this Notice. It is important that you call this number to request an inspection
and copying so that we can begin to process your request. Requests sent to
persons, offices, other than the one indicated might delay processing the
request. If you request a copy of the information, we may charge a fee for the
costs of copying, mailing, or other supplies associated with your request.
We may deny your request to inspect
and copy your protected health information in certain limited circumstances. If
you are denied access to your information, you may request that the denial be
reviewed. To request a review, you must contact us at the number provided in
this Notice. A licensed health care professional chosen by us will review your
request and the denial. The person performing this review will not be the same
one who denied your initial request. Under certain conditions, our denial will
not be reviewable. If this event occurs, we will inform you in our denial that
the decision is not reviewable.
·
Right to Amend
If you believe that your protected
health information is incorrect or incomplete, you may request that we amend
your information. You may request that we amend your information by calling
1-800-678-1536 or writing to Underwriters Safety & Claims, Attn: Privacy
Officer,
In certain cases, we may deny your
request for an amendment. For example, we may deny your request if the
information you want to amend is not maintained by us, but by another entity.
If we deny your request, you have the right to file a statement of disagreement
with us. Your statement of disagreement will be linked with the disputed
information and all future disclosures of the disputed information will include
your statement.
·
Right of an Accounting
You have a right to an accounting of
certain disclosures of your protected health information that are for reasons
other than treatment, payment, or health care operations. No accounting of
disclosures is required for disclosures made pursuant to a signed authorization
by you or your personal representative. You should know that most disclosures
of protected health information will be for purposes of payment or health care
operations, and, therefore, will not be subject to your right to an accounting.
There also are other exceptions to this right.
An accounting will include the
date(s) of the disclosure, to whom we made the disclosure, a brief description
of the information disclosed, and the purpose for the disclosure.
You may request an accounting by
submitting your request in writing to Underwriters Safety & Claims, Attn:
Privacy Officer,
Your request may be for disclosures
made up to 6 years before the date of your request, but not for disclosures
made before
·
Right to a Paper Copy of This Notice
You have the right to a paper copy
of this Notice, even if you have agreed to accept this Notice electronically.
COMPLAINTS
You may complain to us if you believe that we have violated
your privacy rights. You may file a complaint with us by calling us at the
number listed in this Notice. A copy of a complaint form is available from this
contact office.
You also may file a complaint with the Secretary of the U.S.
Department of Health and Human Services. Complaints filed directly with the
Secretary must: (1) be in writing; (2) contain the name of the entity
against which the complaint is lodged; (3) describe the relevant problems;
and (4) be filed within 180 days of the time you became or should have
become aware of the problem.
We will not penalize or any other way retaliate against you
for filing a complaint with the Secretary or with us.