Notice of Privacy Practices

This Notice Is Effective August 1, 2013.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

If you have any questions about this Notice, please contact the Office of Privacy and Compliance at P.O. Box 5307, Richmond, VA 23220-0307 or at (800) 727-7536 extension 5173.

It is the policy of the Virginia Premier Health Plan, Inc. (VPHP) to provide you with a privacy notice that explains how your health care information is being used or disclosed. VPHP is required to maintain the privacy of your information and provide a notice of duties and privacy practices pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act).

This Notice of Privacy Practices describes how VPHP may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by state or federal law. It also describes your rights to access and control your protected health information. “Protected health information” is information collected from you or created or received by VPHP that relate to your past, present or future physical or mental health or condition and related health care services, including demographics that may identify you.

VPHP is required to abide by the terms of this Notice of Privacy Practices currently in effect. We may change the terms of our notice, at any time. The new notice will be effective for all protected health information that we maintain at that time and will be sent to you within 60 days of the change. We retain prior versions of the Notice of Privacy Practices for six (6) years from the revision date.

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

This Notice of Privacy Practices will tell you the ways in which VPHP may use and disclose medical information about you. We will also describe your rights and certain obligations we have regarding the use and disclosure of medical information.

For Treatment: We may use medical information about you to provide you with medical treatment or services and to work with your doctors to plan for quality care. For example, in a case of diabetes, we would work with your provider to get and give you dietary education and/or home health nursing as needed. Different departments of VPHP also may share medical information about you in order to coordinate the different things you need, such as authorization review. We also may disclose medical information about you to people outside VPHP who may be involved with your medical care.
For Payment: We may use and disclose medical information about you so that the treatment and services you receive at a treatment facility may be billed and payment made. For example, we may use your medical information from a surgery you received at the hospital so that the hospital can be paid. We may also use your information to approve or decline your eligibility for treatment you may receive.
For Health Care Operations: We may use and disclose medical information about you for medical operations. These uses and disclosures are necessary to make sure all patients receive quality care. For example, we may use medical information to review your treatment and services and to evaluate the performance of the staff caring for you. We may also combine medical information about many patients to decide what additional services should be covered, what services are not needed and whether certain new treatments are effective.

Other Permitted and Required Uses and Disclosures That May Be Made Without Your Consent, Authorization or Opportunity to Object

We may also use or disclose your protected health information in the following situations without your consent or authorization:

Abuse or Neglect: We may disclose your protected health information to a public health authority that is authorized by law to receive reports of abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
Business associates: We may use or disclose your protected health information to the business associates that provide services to our organization. Examples include legal services, financial auditing and administrators of health plan subcontracts (prescriptions, vision, dental). When these services are contracted, we may disclose your protected health information to our business associates so that they can perform the job we have asked them to do and file your claims for services rendered. To protect your health information, however, we require the business associates to agree in writing to appropriately safeguard your information.
Communicable Diseases: We may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Coroners, Medical Examiners and Funeral Directors: We may disclose protected health information to a coroner or medical examiner for identification purposes, cause of death determinations or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose protected health information to funeral directors, as authorized by law, in order to carry out funeral-related duties. We may disclose such information in reasonable anticipation of death.
Organ and Tissue Donation: Protected health information may be used and disclosed for cadaver organ, eye or tissue donation purposes.
Criminal Activity: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
Food and Drug Administration: We may disclose your protected health information to a person or company required by the Food and Drug Administration to report adverse events, biologic product deviations, product defects or problems; to track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.
Health Oversight: We may disclose protected health information to a health oversight agency, such as the Virginia Department of Health, for activities authorized by law, such as audits, investigations and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
Inmates: We may use or disclose your protected health information if you are an inmate of a correctional facility and we created or received your protected health information in the course of providing and coordinating services to you.
Law Enforcement: We may also disclose protected health information, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and purposes otherwise required by law; (2) limited information requests for identification and location purposes; (3) treating victims of a crime; and (4) suspicion that death has occurred as a result of criminal conduct.
Legal Proceedings: We may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and in certain conditions in response to a subpoena, discovery request or other lawful process.
Military Activity and National Security: When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits; or (3) to foreign military authority if you are a member of that foreign military services. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Public Health: We may disclose your protected health information for public health activities and purposes to a public health authority, such as the Centers for Disease Control (CDC), which is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.
Required Uses and Disclosures: Under the law, we must make disclosures when required by the Secretary of the U.S. Department of Health and Human Services to investigate or determine our compliance with the requirements of 45 C.F.R Section 164.500 et. seq.
Research: We may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information.
Required By Law: We may use or disclose your protected health information to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.
Workers’ Compensation: We may disclose your protected health information as authorized to comply with workers’ compensation laws and other similar legally established programs.

MEMBERSHIPS

VPHP is solely owned by Virginia Commonwealth University Health System (VCUHS). The Medical College of Virginia Hospitals (MCV-H) and the Medical College of Virginia Physicians (MCV-P) are also owned by VCUHS. These three groups participate together in an organized health care arrangement for payment activities, utilization review, and quality assessment activities. Additionally, VPHP functions as a business partner of the Virginia Department of Medical Assistance Services (DMAS). Members of VCUHS and DMAS may also use your protected health information solely for your treatment, payment and/or for the health care operations permitted by HIPAA.

YOUR RIGHTS

You have the following rights regarding medical information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and copy certain protected health information that may be used to make decisions about your benefits. Usually, this includes medical and billing records but does not include behavioral health management notes.

To inspect and copy your medical information, you must submit your request in writing to the VPHP Office of Privacy and Compliance at the address on the front of this Notice. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, and other supplies associated with your request. If the information you request is maintained electronically, and you request an electronic copy, we will provide a copy in the electronic form and format you request. If the information cannot be readily produced in that form and format, we will work with you to come to an agreement on form and format. If we cannot agree on an electronic form and format, we will provide you with a paper copy.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request the denial be reviewed by submitting a written request to the address on the front of this Notice. For more information, call the VPHP Office of Privacy and Compliance at (800) 727 7536 extension 5173.

Right to Amend. If you feel that medical information about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment as long as the information is kept by or for VPHP. To request an amendment, your request must be made in writing and submitted to the VPHP Office of Privacy and Compliance at the address on the front of this Notice. In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
Is not part of the medical information kept by or for VPHP;
Is not part of the information that you would be permitted to inspect and copy; or
Is already accurate and complete.

If we deny your request, you have a right to file a statement of disagreement with us and any future disclosures of the disputed information will include your statement.

Right to an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your protected health information. This is a list of the disclosures we made of medical information about you. To request this list, you must submit your request in writing to the VPHP Office of Privacy and Compliance at the address on the front of this Notice. Your request must state a time period for the disclosures, which may not be longer than six (6) years before the date of the request. Your request should indicate in what form you want the list (for example, on paper, or electronically). The first accounting you request within a 12-month period will be provided free of charge. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limit on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care, like a family member or friend. For example, you can ask that we not use or disclose information about a surgery you had.

We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request restrictions, you must make your request in writing to the VPHP Office of Privacy and Compliance at the address on the front of this Notice. In your request you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the VPHP Office of Privacy and Compliance at the address on the front of this Notice. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Be Notified of a Breach. You have the right to be notified in the event that we (or our business associates) discover a breach of your unsecured protected health information.

Right to a Paper Copy of this Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. To obtain a copy of this notice, call the VPHP Office of Privacy and Compliance at (800) 727-7536 extension 5173. This notice is posted on our website and can be downloaded at: www.virginiapremier.com.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with VPHP or with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

All complaints must be submitted in writing. To file a complaint with VPHP, send an e-mail to [email protected] or U.S. mail to the address on the front of this Notice.

To file a complaint with the Secretary, send an e-mail to [email protected] or U.S. mail to: The U.S. Department of Health and Human Services 150 S. Independence Mall West, Suite 372 Philadelphia, PA 19106-3499

OTHER USES OF MEDICAL INFORMATION

Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care we provided to you.

CHANGES TO THIS NOTICE