Appendix B Privacy Policy

Putnam/Northern Westchester Health Benefits Consortium

PRIVACY POLICY
THIS APPENDIX DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU GET ACCESS TO THIS INFORMATION.

In accordance with state and federal law, this notice is provided to inform you about the Putnam/ Northern Westchester Health Benefits Consortium Health Plan’s (the Plan) policy to ensure the privacy of Protected Health Information (PHI).

PHI is individually identifiable health information (IIHI) that relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual.

The Plan uses PHI to conduct its normal and necessary health plan operations. PHI may be shared with its Business Associates (third party vendors), such as Aetna Corp., when necessary and appropriate for member care or treatment, payment of claims and adjudication of appeals. It is the Consortium’s policy that all uses and disclosures of PHI are minimized. Any party or entity to which the Consortium discloses PHI must have its own policies and procedures to ensure the privacy of PHI.

Uses and disclosures

The Plan and its Business Associates will use PHI without your consent, authorization or opportunity to agree or object to carry out treatment, payment and health care operations or if required by law. The Plan may also disclose PHI to your employer (the Plan Sponsor) if such employer has agreed to protect your PHI as required by federal law.

Treatment is the provision, coordination or management of health care and related services. It also includes but is not limited to consultations and referrals between one or more of your providers.

For example, the Plan may disclose to a pharmacist the types of medication you are taking to avoid an adverse medical reaction.

Payment includes, but is not limited to, actions to make coverage determinations and payment (including billing, claims management, subrogation, plan reimbursement, reviews for medical necessity and appropriateness of care and utilization
review and preauthorization).

For example, the Plan may tell a doctor whether you are eligible for coverage or what percentage of the bill will be paid by the Plan.

Health care operations include, but are not limited to, quality assessment and improvement, reviewing competence or qualifications of health care professionals, underwriting, premium rating and other insurance related activities. It also
includes disease management, case management, conducting or arranging for medical reviews, legal services and auditing functions including fraud and abuse detection programs, business planning and development and general administrative
activities.

For example, the Plan may use information about your claims to refer you to a disease management program, project future benefits costs or audit the accuracy of its third party administrators.

Other purposes we are permitted or required to use or disclose protected health information without written authorization include:

• Public Health Activities, such as for the purpose of preventing or controlling disease;

• Regarding abuse, neglect or domestic violence;

• Health oversight agencies, such as for criminal investigations;

• Legal proceedings, such as in response to a subpoena or court order;

• Law enforcement purposes, such as in response to a court ordered warrant or summons, or to avert a serious threat to someone’s health and safety;

• Coroners, Medical Examiners, Funeral Directors, such as for the identification of a deceased person;

• Organ procurement organizations for the purpose of cadaver organ, eye or tissue donation;

• Correctional or custodial institutions, if necessary for the provision of care, the safety of the individual, other inmates or officers/ employees of the institution;

• Workers’ compensation, if necessary to comply with applicable law.

Any other use or disclosure of your PHI will be made only with your written authorization. You may revoke such authorization in writing at any time.

Treatment, Payment and Health Care Operations may be delegated to third party administrators.

Your Rights
You have the right to request restrictions on certain uses and disclosures, however, the Plan is not required to agree.

You have the right to inspect, copy, or amend protected health information about you that is in a designated record set, subject to certain limitations.

You have the right to receive an accounting of any disclosures, except for disclosures necessary for treatment, payment or healthcare operations.

The Plan is required to abide by the terms of this notice. The Plan reserves the right to amend its policies and procedures, as necessary. If there is a material change in the Consortium’s Privacy Policy, a revised notice will be distributed to employees and retirees via newsletter.

If you have any questions about this policy or believe that your rights have been violated, you may contact the Consortium’s Privacy Contact Person by writing to:

Privacy Official
Putnam/ Northern Westchester Health Benefits Consortium
200 BOCES Drive
Yorktown Heights, NY 10598

You will not be retaliated against in any way for filing a complaint.

Effective date of notice: April 14, 2003