RIVERSPRING HEALTH PLANS
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL/HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
Effective Date: September 23, 2013
We are required by law to maintain the privacy of your health information. We are also required to provide you with this detailed Notice of Privacy Practices (“Notice”) describing our legal duties and privacy practices relating to your health information, as well as the rights you have with regard to your health information. Additionally, we are required to abide by the terms of the Notice that are currently in effect. This Notice applies to our uses and disclosures of your health information in connection with RiverSpring Health Plans.
- HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION WITHOUT YOUR WRITTEN AUTHORIZATION
We may use and disclose your health information and share it with others to help treat your condition, coordinate payment for that treatment, and run our business operations. The following are situations where we do not need your written authorization to use or disclose your health information:
- Uses and Disclosures for Treatment, Payment and Health Care Operations
The following are various ways in which we may use or disclose your health information for purposes of treatment, payment and health care operations.
For Treatment. We may use your health information or share it with others to provide treatment to you and coordinate such treatment. We may disclose your health information to other providers involved in your care, such as doctors, nurses, home health aides, physical therapists, social workers, and personal care attendants. These providers may, in turn, use that information to treat you. For example, members of a multidisciplinary team (including your primary care physician, a registered nurse, a social worker, physical and occupational therapists, and other caregivers) may discuss your treatment plan and contact any specialists regarding your care.
For Payment. We may use your health information or share it with others for billing and payment purposes. For example, we may disclose your health information to your personal representative, or to an insurance or managed care company, Medicare, Medicaid or the state agency charged with administering health care programs. This may help us obtain reimbursement after we have treated you, or help us determine your continued eligibility for program services.
For Health Care Operations. We may use your health information or share it with others in connection with our health care operations. For example, we may use your health information for the purposes of management, personnel evaluation, education and training, as well as to conduct quality assessment activities. We may also disclose your health information to other health care providers to help them with their health care operations.
Appointment Reminders. We may use your health information or share it with others to remind you that you have an appointment for treatment or services.
Treatment Alternatives and Health-Related Benefits and Services. Subject to certain limitations, we may use your health information or share it with others to inform you about possible treatment alternatives and health-related benefits and services that may be of interest to you.
Business Associates. We may disclose your health information to our business associates who require the information to carry out functions or activities on our behalf, including services for the MLTC program. We will disclose your health information to a business associate only if we have a written contract in place to ensure that the business associate protects the privacy of your health information.
Fundraising Activities. As part of our business operations, we may use or disclose certain limited information for fundraising purposes and may provide certain information to a foundation affiliated with our programs, provided that any fundraising communications explain clearly and conspicuously your right to opt out of future fundraising communications. We must honor your request to opt out.
- Uses and Disclosures for the Public Need
The following are ways in which we may use and disclose your health information for the public need:
Emergencies. We may use or disclose your health information as necessary in emergency situations.
As Required By Law. We may use or disclose your health information when required by law to do so.
Public Health Activities. We may disclose your health information to authorized public health officials for public health activities. These activities may include, for example, reporting to a public health authority for preventing or controlling disease, injury or disability; reporting elderly abuse or neglect; or reporting deaths.
Reporting Victims of Abuse, Neglect or Domestic Violence. We may disclose your health information to appropriate authorities if we believe that you have been a victim of abuse, neglect or domestic violence or the possible victim of other crimes.
Health Oversight Activities. We may disclose your health information to health oversight agencies for health oversight activities authorized by law, such as audits, investigations, inspections and licensure actions or for activities involving government oversight of the health care system.
To Avert a Serious Threat to Health or Safety. We may use or disclose your health information as necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person. In such cases, we will limit disclosures to someone able to help lessen or prevent the threatened harm.
Product Monitoring, Repair and Recall. We may disclose your health information to a person or company regulated by the Food and Drug Administration for (i) reporting or tracking product defects or problems, (ii) repairing, replacing or recalling defective or dangerous products, or (iii) monitoring the performance of a product after it has been approved for use by the general public.
Judicial and Administrative Proceedings. We may disclose your health information in response to a court or administrative order. We may also disclose your health information in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to contact you about the request or to obtain a court order or agreement protecting your health information from further disclosure.
Law Enforcement. We may disclose your health information for certain law enforcement purposes, including, for example, complying with a court order, warrant, or similar legal process, assisting with identifying or locating a suspect, fugitive, witness or missing person, and responding to certain requests for information concerning crimes.
Military, Veterans. If you are a member of the United States or foreign armed forces we may disclose your health information as required by military command authorities.
National Security. We may disclose your health information to authorized federal officials for national security purposes or as needed to protect the President of the United States or certain other officials.
Inmates/Law Enforcement Custody. If you are under the custody of a law enforcement official or a correctional institution, we may disclose your health information to the institution or official for certain purposes, including the health and safety of you and others.
Workers’ Compensation. We may disclose your health information to comply with laws relating to workers’ compensation or similar programs.
Coroners, Medical Examiners, Funeral Directors, Organ Procurement Organizations. In the unfortunate event of your death, we may disclose your health information to a coroner, medical examiner, funeral director or, if you are an organ donor, to an organization involved in the donation of organs and tissue.
- Other Uses and Disclosures
Patient Roster/ Individuals Involved in Your Care or Payment for Your Care. We may use your health information in our Patient Roster, and, if you do not object, we may share it with a family member, relative or close personal friend involved in your care or payment for your care. We may also notify a family member, personal representative or another person responsible for your care about your location and general condition. In some cases, we may need to share your information with a disaster relief organization that will help us notify these persons.
Research. In most cases, we will ask for your written authorization before using your health information or sharing it with others in order to conduct research. However, under some circumstances, we may use or disclose your health information without your written authorization. To do this, we are required to obtain approval through a special process to ensure that research without your written authorization poses minimal risk to your privacy. We may also release your health information without your written authorization to people preparing a future research project. In the unfortunate event of your death, we may share your health information with people who are conducting research using the information of deceased persons.
De-Identified Information. We may use or disclose your health information if we have removed any information that has the potential to identify you so that the health information is “completely de-identified.” We may also use or disclose “partially de-identified” information for certain purposes. Partially de-identified information will not contain any information that would directly identify you.
Marketing. We may not disclose your health information for purposes of marketing without your prior authorization. Marketing is a communication about a product or service that encourages recipients of the communication to purchase or use the service. However, we may inform you about products or services during face-to-face communications with you without your authorization, including providing related written materials to you. We may also, without your authorization, provide to you promotional gifts of nominal value that may encourage you to use or purchase a product or service.
- USES AND DISCLOSURES OF YOUR HEALTH INFORMATION REQUIRING AUTHORIZATION
Except as described above in this Notice, we will not use or disclose your health information without your written authorization. You may revoke, or cancel, your authorization in writing at any time. If you revoke an authorization, we will no longer use or disclose your health information for the purposes covered by that authorization, except where we have already relied on the authorization. Your revocation will not affect any uses and disclosures we have already made prior to the date we receive notice of your revocation. To revoke your authorization, please write to the contact person listed on the last page of this Notice.
III. YOUR RIGHTS TO ACCESS AND CONTROL YOUR HEALTH INFORMATION
We want you to know that you have the following rights to access and control your health information. Each of these rights may be subject to certain requirements, limitations and exceptions. To exercise any of these rights, you may direct your written request to the contact person listed on the last page of this Notice. We will respond to your request in writing as described below or provide you with a form to complete.
Access Your Health Information. You have the right to inspect and obtain a copy of your clinical and billing records and other health information that we maintain about you, subject to some exceptions. If the information you request is stored electronically, we will provide the information in the form and format you request if the information is readily producible in that format, or, if not, we will reach an agreement with you as to alternative readable electronic format. We may also charge you a reasonable fee to cover the costs of copying, mailing or other supplies we may use to fulfill your request.
A written request to obtain your health information should include your contact information and describe the information to which the request applies, as well as the desired form or format of access. We ordinarily will respond to your request within 30 days. If we need additional time to respond to your request, we will notify you in writing within 30 days to explain the reason for the delay and when you can expect to have a final answer to your request. We may not give you access to your health information in very limited circumstances. If you are denied access, you are entitled to a review by a health care professional, designated by us, who was not involved in the decision to deny access. If access is ultimately denied, you will be entitled to a written explanation of the reasons for the denial.
Additional Privacy Protections. You have the right to request that we place additional restrictions on our use and disclosure of your health information. A written request for additional privacy protections should include the information you want to restrict; whether you want us to restrict our use of the information, how we share it with others, or both; and to whom the restrictions apply. We will grant your request if it is reasonable and can be accommodated, but we do not need to agree to the restriction unless (i) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law, and (ii) the health information relates only to a health care item or service that you or someone on your behalf has paid for out of pocket and in full. If we do agree to your request, we will put these restrictions in place except as needed to provide you emergency treatment or in accordance with applicable law.
Amend Your Health Information. You have the right to request that we amend your health information if you believe this information is incorrect or incomplete. A written request to amend your health information should include a description of the amendment requested and should include the reasons why you think we should make the amendment. We ordinarily will respond to your request within 60 days. If we need additional time to respond, we will notify you in writing within 60 days to explain the reason for the delay and when you can expect to have a final answer to your request. If we did not create your health information, if your health information is not part of our records, or if your health information is already accurate and complete, we can deny your request and notify you of our decision in writing. You can submit a statement that you disagree with our decision, which we can rebut. You have the right to request that your original request, our denial, your statement of disagreement and our rebuttal be included in future disclosures of your health information.
Receive an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your health information. An accounting of disclosures will not include disclosures for treatment, payment and health care operations, disclosures made pursuant to your authorization, and certain other disclosures. A written request for an accounting of disclosures should specify the time period within the past six years for the disclosures you want us to include. You will receive one accounting annually for free, but we may charge you a reasonable, cost-based fee for providing an additional accounting within the same 12 month period. We ordinarily will respond to your request within 60 days. If we need additional time to respond to your request, we will notify you in writing within 60 days to explain the reason for the delay and when you can expect to have a final answer to your request.
Request Confidential Communications. You have the right to request that we communicate with you about your health information by alternative means or via alternative locations. For example, you may ask us to send mail to your work address rather than your home address. A written request for confidential communications should specify where and/or how we should contact you, and how payment for your health care is handled if we communicate with you through this alternative method or location. We will accommodate all reasonable requests.
Paper Copy of This Notice. You have the right at any time to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. In addition, you may obtain a copy of this Notice at our website: www.riverspringhealthplans.org.
Notification of Breach. We are required by law to maintain the privacy of your health information. We are required to notify you in the event that there is a breach of your unencrypted health information.
- FOR FURTHER INFORMATION OR TO FILE A COMPLAINT
Contact. If you have any questions about this Notice or would like to exercise any of your individual rights listed above, please contact Jenny Ling, Privacy Officer, at (800) 362-2266.
Complaints. If you believe that your privacy rights have been violated, you may complain to us or to the Office for Civil Rights in the U.S. Department of Health and Human Services (“OCR”). You may complain to us by contacting Jenny Ling, Privacy Officer, by calling (800) 771-0088 or by writing to her at:
RiverSpring Health Plans
Attn: Jenny Ling, Privacy Officer
80 West 225th Street
Bronx, NY 10463
You may complain to OCR by emailing them at OCRComplaint@hhs.gov or by writing them at:
Office for Civil Rights, U.S. Department of Health and Human Services
200 Independence Avenue
S.W., Room 509F HHH Bldg
Washington, D.C. 20201
- ADDITIONAL RIGHTS
This Notice explains the rights you have with respect to your health information under federal law. Some states provide even greater rights, including more favorable access and amendment rights, as well as protection for particularly sensitive information. For instance, in New York we are not able to disclose HIV/AIDS related information without your consent unless that disclosure is pursuant to a court order, for care or treatment purposes, otherwise required by law or to a government agency involved in collecting relevant data. We must also obtain your consent before disclosing your genetic information except when such disclosure is pursuant to a court order or legal proceeding or otherwise permitted or required under applicable law. In certain instances you also have the right to restrict disclosure of your mental health and alcohol and drug abuse information. To the extent the law in New York affords you greater rights than described in this Notice, we will comply with these laws.
- CHANGES TO THIS NOTICE
We may change our privacy practices from time to time. If we do, we will revise this Notice, which will apply to all health information. If we make materials revisions to this Notice, we will provide you with a copy of the revised Notice. We will also post a copy of this Notice at www.riverspringhealthplans.org.