Health Reinsurance Association

Personal Representative

HEALTH REINSURANCE ASSOCIATION

Notice of Privacy Practices for Protected Health Information

(Effective Date: April 14, 2003)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Purpose

The purpose of this Notice of Privacy Practices for Protected Health Information is to explain how personal information about you and other covered members on your policy (hereafter referred to as “you”) is used and protected by the Health Reinsurance Association (hereinafter referred to as “HRA.”) As defined by the federal Health Insurance Portability and Accountability Act (HIPAA), this personal information:

1.	Relates to your past, present, or future physical or mental health or condition; the provision of healthcare to you; or the past, present, or future payment for the provision of health care to you; and
2.	Identifies you; or
3.	Can reasonably be believed to identify you.

Policy Statement

In the process of becoming an HRA member, you (or someone representing you) provided HRA with certain personal information, such as your name, age, residence, marital status, social security number, and employment information.

In addition, HRA, or organizations acting on its behalf (“Business Associates”), receive and maintain confidential information about your health status that is necessary to process your medical claims. The health insurance companies that provide our members with coverage include:

United Healthcare Insurance Company

Health Net of the Northeast, Inc.

These are HRA's Business Associates that have access to your personal information. HRA requires that they maintain the same strict standards of confidentiality as HRA does. Employees who are working with your file are keenly aware of the need to keep your nonpublic personal information protected. Of course, HRA must comply if it is required to disclose information in connection with civil or criminal litigation. These instances are rare. HRA never sells lists of the names and addresses of its members to any vendor of goods or services. HRA’s policy of protecting personal information also extends to former insureds who no longer have coverage with HRA.

Uses and Disclosures of Personal Information

HRA may disclose personal information for treatment, payment, or health care operations purposes. Some examples are:

· Determining whether you are eligible for insurance benefits for the services you are receiving;
· Managing your treatment for a medical condition;
· Activities to monitor the quality and appropriateness of services you receive;
· Assisting in the payment of your claims.

In addition, to provide appropriate customer service to its insureds, HRA will provide to identified personal representatives of its insureds the minimum necessary information to satisfy treatment, payment, and health care operations.

HRA may also disclose, without your written consent or authorization, information:

·	That is required by law;
·	That is needed for public health activities;
·	About victims of abuse, neglect, or domestic violence;
·	For health oversight activities by public agencies;
·	In the course of any judicial or administrative proceeding;
·	For law enforcement purposes to a law enforcement official;
·	About decedents to coroners and medical examiners;
·	Concerning cadaveric organ, eye, or tissue donation;
·	For research purposes;
·	To avert a serious threat to the health or safety of a person or the public;
·	For military and veterans functions;
·	To the extent necessary to comply with workers’ compensation laws.

Other uses and disclosures will be made only with your written authorization. Although you may revoke such authorization provided that the revocation is in writing, the revocation is invalid if:

1.	HRA has already acted on the information you authorized; or
2.	You authorized HRA to obtain this information as a condition of coverage in which case HRA has the right to use this information for treatment, payment, and operations.

Your Rights

All requests must be submitted in writing to the Health Reinsurance Association Privacy Office.

You have the right to:

1.	Know how personal information about you is used and to whom it is disclosed
2.	Request restrictions on uses and disclosures of your personal information for purposes of conducting treatment, payment, or health care operations with the following limitations:
	a.	HIPAA does not require HRA to agree to the requested restrictions.
	b.	If HRA agrees to the restriction, it may disclose information
		i.	To process bills or
		ii.	As needed for emergency treatment.
	c.	If personal information that you restricted is disclosed to a healthcare provider for emergency treatment, HRA must request that this provider not use the personal information for any purpose beyond the specific needs for emergency treatment.
3.	Receive confidential communications of personal information;
4.	Inspect and copy personal information;
5.	Request amendments to your personal information, but HIPAA has granted HRA the right to deny such requests;
6.	Receive an accounting of disclosures of personal information;
7.	Obtain, if you have agreed to receive notice electronically, a paper copy of this notice upon request.
8.	Contact your insurance carrier directly for access, amendment or an accounting of disclosure for your records that the insurance carrier maintains.

HRA’s Responsibilities

HRA is required by law to:

1.	Maintain the privacy of personal information and to provide you with this notice of its legal duties and privacy practices with respect to personal information;
2.	Abide by the terms of the notice currently in effect; and
3.	Provide, within sixty days, written notification to you if HRA makes material changes to the privacy practices stated in this notice, including changes in the uses and disclosures of personal information, your rights, and HRA’s legal duties.

If you believe that your privacy rights have been violated, you may complain to HRA and the Secretary of the Department of Health and Human Services of the United States.

To file a complaint, HIPAA requires that the complaint:

·	Be filed in writing, either on paper or electronically.
·	Name Health Reinsurance Association as the subject of the complaint and describe the acts or omissions believed to be in violation of privacy regulations.
·	Be filed within 180 days of when you knew or should have known that the act or omission complained of occurred, unless this time limit is waived by the U.S. Secretary of the Department of Health and Human Services.

A complaint may be submitted to:

Health Reinsurance Association		Region 1, Office for Civil Rights
Privacy Office	or	U.S. Department of Health and Human Services
100 Great Meadow Road, Suite #704		Room 1875
Wethersfield, CT 06109		Government Center, J.F. Kennedy Federal Building
		Boston, MA 02203

Under HIPAA, HRA cannot retaliate against you for filing a complaint.

Prohibiting Use and Disclosure

If you wish to restrict or prohibit use and disclosure of your personal information, contact HRA and ask for the form, “Request to Restrict or Prohibit Use and Disclosure of Personal Information.” Additional information can be obtained by calling HRA’s Privacy Office Liaison at 1-800-842-0004.