THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice describes how Blue Cross and Blue Shield of Arizona ("BCBSAZ") may use
and disclose your protected health information ("PHI"). It also describes our legal
obligations concerning your PHI and your rights to access and control your PHI.
This Notice takes effect on April 14, 2003 in accordance with the privacy regulations
issued under the federal Health Insurance Portability and Accountability Act of
1996 ("HIPAA Privacy Regulations").
PHI is individually identifiable health information, including actual medical information
as well as your name, address, phone number, identification number or other identifiers,
collected from you or created by or received by a health care provider, a health
plan, your employer, or a health care clearinghouse and that relates to: (1) your
past, present, or future physical or mental health or condition; (2) the provision
of health care to you; or (3) the past, present, or future payment for health care
provided to you.
We are required by law to maintain the privacy of your PHI. We are obligated to
provide you with a copy of this Notice and we must abide by the terms of this Notice.
We reserve the right to change this Notice at any time. If we make a material change
to our Notice, we will mail a revised Notice to the address that we have on record
for each insurance policyholder. The policyholder is the person in whose name the
policy was issued.
USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION (PHI)
The following is a description of how we are most likely to use and/or disclose
your PHI.
Payment Activities
We may use and disclose your PHI for all functions that are included within our
payment activities. For example, we will use or disclose your PHI to obtain premiums
and to pay claims for services provided to you in accordance with your policy. We
may disclose your PHI when a provider or your designated broker or agent requests
information regarding your eligibility for coverage under our health plan, or we
may use your information to determine if a treatment that you received was medically
necessary. Additionally, if you are enrolled in a group health plan, we may disclose
your PHI to your employer for it to administer the group health plan if the employer
has amended the plan document for the group health plan to limit the uses and disclosures
it may make of your PHI. Please see your plan documents for a full explanation of
the limited uses and disclosures that the employer may make of your PHI. We may
also disclose summary health information to your employer for it to obtain premium
bids for the group health plan coverage or to modify or terminate the group health
plan. Summary health information has been stripped of information which would directly
identify you.
Health Care Operations
We may use and disclose your PHI for our health care operations. These functions
include, but are not limited to, quality assessment and improvement, reviewing provider
performance, business management and administration. For example, we may use or
disclose your PHI to provide you with information about one of our wellness or care
management programs, to respond to a customer service inquiry from you or in connection
with fraud and abuse detection and compliance programs.
Business Associates
We contract with individuals and entities (business associates) to perform various
functions on our behalf which involve the use and/or disclosure of PHI. Business
associates must agree in writing to appropriately safeguard your information. For
example, we may disclose your PHI to a business associate to manage our claims processing
system, to manage certain aspects of our pharmacy benefits or to maintain certain
provider networks.
Other Entities
We may use or disclose your PHI to assist health care providers in connection with
their treatment or payment activities, or to assist other entities covered by the
HIPAA Privacy Regulations in connection with certain health care operations. For
example, we may disclose PHI to another covered entity in order to coordinate benefits,
if you or your family members have coverage through another carrier.
Potential Impact of State Law
In some situations, the HIPAA Privacy Regulations do not take the place of state
privacy or other laws that provide individuals greater privacy protections. As a
result, the privacy laws of a particular state, or other federal laws, rather than
the HIPAA Privacy Regulations, might impose a privacy standard under which we will
be required to operate. For example, certain information regarding HIV or AIDS,
communicable diseases, abortion, or records from certain drug and alcohol abuse
programs may be subject to additional restrictions.
Disclosures to You on Your Authorization
We must disclose your PHI to you as described in the Individual Rights section of
this Notice. Additionally, you may give us written authorization to use your PHI
or to disclose it to anyone for any purpose. We will disclose your PHI to an individual
you designate as your personal representative and who has qualified for such designation
in accordance with relevant state law. However, we may elect not to treat the person
as your personal representative if we have a reasonable belief that you have been,
or may be, subjected to domestic violence, abuse, or neglect by such person, treating
such person as your personal representative could endanger you, or we determine,
in the exercise of our professional judgment, that it is not in your best interest
to treat the person as your personal representative.
Others Involved in Your Health Care and Disaster Relief
Unless you object, we may disclose your PHI to a friend or family member that is
involved in your health care. We also may disclose your information to an entity
assisting in a disaster relief effort so that your family can be notified about
your condition, status, and location. If you are not present or able to agree to
these disclosures of your PHI, then we may determine in our professional judgment
if the disclosure is in your best interest.
Marketing
We may use your PHI to communicate with you face-to-face or about a promotional
gift of nominal value.
Health Oversight Activities
We may disclose your PHI to a government agency authorized to oversee health care
systems or government programs. The Arizona Department of Insurance is such an entity.
Examples would include disclosures for audits, investigations, inspections, licensure
or disciplinary actions, or civil, administrative, or criminal proceedings or actions.
Oversight agencies include government agencies that oversee the health care system,
government benefit programs and other government regulatory programs.
Legal Proceedings
We may disclose your PHI: (1) in the course of any judicial or administrative proceeding;
(2) in response to an order of a court or administrative tribunal (to the extent
such disclosure is expressly authorized); and (3) in response to a subpoena, a discovery
request, or other lawful process, once we have met any administrative requirements
of the HIPAA Privacy Regulations.
Public Health Activities
We may use or disclose your PHI to public health authorities. For example, we may
use or disclose information for the purpose of preventing or controlling disease,
injury, or disability, or we may disclose such information to a public health authority
authorized to receive reports of child abuse or neglect.
Abuse or Neglect
We may disclose your PHI to appropriate authorities that are authorized to receive
reports of abuse, neglect, or domestic violence. Additionally, as required by law,
we may disclose your information to a governmental entity authorized to receive
such information if we believe that you have been a victim of abuse, neglect, or
domestic violence.
Law Enforcement
Under certain conditions, we also may disclose your PHI to law enforcement officials.
Some examples of the reasons for such a disclosure may include that it is required
by law or some other legal process, it is necessary to locate or identify a suspect,
fugitive, material witness, or missing person or it is necessary to provide evidence
of a crime that occurred on our premises.
Coroners, Medical Examiners, Funeral Directors, and Organ Donation
We may disclose PHI to a coroner or medical examiner for purposes of identifying
a deceased person, determining a cause of death, or for the coroner or medical examiner
to perform other duties authorized by law. We also may disclose, as authorized by
law, information to funeral directors so that they may carry out their duties. Further,
we may disclose PHI to organizations that handle organ, eye, or tissue donation
and transplantation.
Research
We may disclose your PHI to researchers when an Institutional Review Board or privacy
board has reviewed the research proposal and established protocols to ensure the
privacy of the information, and approved the research, or as part of a limited data
set which includes no unique identifiers (information such as name, address, identification
number, etc. that can identify you).
To Prevent a Serious Threat to Health or Safety
We may disclose your PHI if we believe that the disclosure is necessary to prevent
or lessen a serious and imminent threat to the health or safety of a person or the
public. We also may disclose PHI if it is necessary for law enforcement authorities
to identify or apprehend an individual.
Military Activity and National Security, Protective Services
Under certain conditions, we may disclose your PHI if you are, or were, Armed Forces
personnel for activities deemed necessary by appropriate military command authorities.
If you are a member of foreign military service, we may disclose, in certain circumstances,
your information to the foreign military authority. We also may disclose your PHI
to authorized federal officials for conducting national security and intelligence
activities, and for the protection of the President, other authorized persons, or
heads of state.
Inmates
If you are an inmate of a correctional institution, we may disclose your PHI to
the correctional institution or to a law enforcement official for the institution
to provide health care to you, for your health and safety, for the health and safety
of others, or for the safety and security of the correctional institution.
Workers' Compensation
We may disclose your PHI to comply with workers' compensation laws and other similar
programs that provide benefits for work-related injuries or illnesses.
Disclosures to the Secretary of the U.S. Department of Health and Human Services
We are required to disclose your PHI to the Secretary of the U.S. Department of
Health and Human Services when the Secretary is investigating or determining our
compliance with the HIPAA Privacy Regulations.
Other Uses and Disclosures of Your Protected Health Information (PHI)
Other uses and disclosures of your PHI that are not described above will be made
only with your written authorization. If you provide us with such an authorization,
you may revoke the authorization in writing, and this revocation will be effective
for future uses and disclosures of PHI. However, the revocation will not be effective
for information that we already have used or disclosed, relying on the authorization.
YOUR INDIVIDUAL RIGHTS
The following is a description of your rights with respect to your PHI.
Right to Request a Restriction
You have the right to request that we place additional restrictions on our use and
disclosure of your PHI. We are not required to agree to any restriction that you
may request. If we do agree to the restriction, we will comply with the restriction
unless the information is needed to provide emergency treatment to you or unless
the use or disclosure is otherwise permitted or required by law.
To request a restriction, you may complete a Restriction Request Form and mail it
to the Privacy Office at the address listed in the last section of this Notice.
To obtain a Restriction Request Form, please call the BCBSAZ Customer Service number
listed on the back of your BCBSAZ identification card, or (602) 864-4400 or (800)
232- 2345. Alternatively, you may call the Privacy Office at (602) 864-2255 or (800)
232-2345, ext. 2255.
Right to Request Confidential Communications
If you believe that a disclosure of all or part of your PHI may endanger you, you
may request that we communicate your PHI to you in an alternative manner or at an
alternative location. We will accommodate a request for confidential communications
that is reasonable and that truthfully states that the disclosure of all or part
of your PHI could endanger you. Once a request for confidential communications goes
into effect, all of your PHI will be processed in accordance with your instructions
unless a particular use or disclosure is otherwise required by law. We will not
process requests on a diagnostic-specific basis. Please note that, even if you request
confidential communications, the check for services you receive from a provider
could be sent to the policyholder. Additionally, such services may alter deductible
figures, coinsurance maximums and other cost sharing items.
To make such a request, you may either call the Privacy Office at (602) 864-2255
or (800) 232-2345, ext. 2255, or mail a written request to the Privacy Office at
the address listed in the last section of this Notice. Within 30 days of any verbal
request, you must document an oral request in writing. Any written request must
include the following information: (1) your BCBSAZ identification number, (2) your
date of birth, (3) your desire that we communicate with you in an alternative manner
or at an alternative location, (4) what the manner and location are, and (5) your
belief that the disclosure of all or part of the PHI in a manner inconsistent with
your instructions would put you in danger. If you prefer, you may complete a Confidential
Communication Request Form and mail it to the Privacy Office at the address listed
in the last section of this Notice. To obtain a Confidential Communication Request
Form, please call the BCBSAZ Customer Service number listed on the back of your
BCBSAZ identification card, or (602) 864-4400 or (800) 232-2345.
Right to Access
You have the right to inspect and copy your PHI, with limited exception, that BCBSAZ
and its business associates maintain.
To request access to your PHI, you must complete a Request for Access to Protected
Health Information & Records Form and mail it to the Privacy Office at the address
listed in the last section of this Notice. To obtain a Request for Access to Protected
Health Information & Records Form, please call the BCBSAZ Customer Service number
listed on the back of your BCBSAZ identification card, or (602) 864-4400 or (800)
232-2345. If you request a copy of the information, we may charge a fee for the
costs of copying, mailing, or other supplies associated with your request.
We may deny your request to inspect and copy your PHI in certain circumstances as
set forth in the HIPAA Privacy Regulations Under certain conditions, if you are
denied access to your information, you may ask us to designate a different licensed
health care professional, who did not participate in the initial determination,
to review that determination. To make such a request, call the Privacy Office at
(602) 864-2255 or (800) 232-2345, ext. 2255. Not all denials of access are subject
to review.
Right to Amend
If you believe that your PHI is incorrect or incomplete, you may request that we
amend your information. To request that we amend your PHI you must complete an Amendment
Request Form and mail it to the BCBSAZ Privacy Office at the address listed in the
last section of this Notice. To obtain an Amendment Request Form, please call the
BCBSAZ Customer Service number listed on the back of your BCBSAZ identification
card, or (602) 864-4400 or (800) 232-2345.
In certain cases, we may deny your request for an amendment for reasons set forth
in the HIPAA Privacy Regulations. For example, we may deny your request if the information
you want to amend was not created by us, but by another entity. If we deny your
request, you have the right to file a statement of disagreement with us. Your statement
of disagreement will be linked with the disputed information and all future disclosures
of the disputed information will include your statement.
Right of a Listing of Disclosures
You have a right to a listing of certain disclosures BCBSAZ and its business associates
have made of your PHI. You are not entitled to a listing of disclosures which were
made for our payment or health care operations, pursuant to your authorization or
in certain other limited instances. Please note that most disclosures of PHI will
be for purposes of payment or health care operations. A listing will include the
date of the disclosure, to whom we made the disclosure, a brief description of the
information disclosed, and the purpose for the disclosure. Your request may be for
disclosures made up to 6 years before the date of your request, but may not include
disclosures made before April 14, 2003.
To request a listing of disclosures, you must complete an Accounting Request Form
and mail it to the BCBSAZ Privacy Office at the address listed in the last section
of this Notice. To obtain the Accounting Request Form, please call the BCBSAZ Customer
Service number listed on the back of your BCBSAZ identification card, or (602) 864-4400
or (800) 232-2345. The first list you request within a 12-month period will be provided
free of charge. For any additional lists within that 12-month period, we may charge
you for the costs of providing the list.
Right to a Paper Copy of This Notice
You have the right to a paper copy of this Notice, even if you have agreed to accept
this Notice electronically.
QUESTIONS AND COMPLAINTS
If you want more information about our privacy practices or have questions or concerns,
please contact us at:
Blue Cross Blue Shield of Arizona
Privacy Office, C105
P.O. Box 13466
Phoenix, Arizona 85002-3466
If you have concerns about our privacy policies or procedures, our compliance with
our privacy policy or procedures or our compliance with the HIPAA Privacy Regulation,
you may communicate your complaint to the BCBSAZ Privacy Office at the address listed
above. To obtain a Complaint Form, please call the BCBSAZ Customer Service number
listed on the back of your BCBSAZ identification card, or (602) 864-4400 or (800)
232-2345. You may also submit a written complaint to the Secretary of the U.S. Department
of Health and Human Services. Complaints filed directly with the Secretary must:
(1) be in writing; (2) contain the name of the entity against which the complaint
is lodged; (3) describe the relevant problems; and (4) be filed within 180 days
of the time you became or should have become aware of the problem.
We support your right to protect the privacy of your PHI. You can be assured there
will be no retaliation of any kind if you choose to file a complaint with us or
with the U.S. Department of Health and Human Services.