Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

Harvard University Student Health Program is committed to protecting the privacy of our members.

We understand that medical information about you is personal and that protecting that information is important. In order to provide you with quality care, customer service, and compliance with certain legal and accreditation requirements, we create records of your enrollment, referral authorizations, and the claims generated from all the medical care you receive as a member of Harvard University Student Health Program (HUSHP) – a Blue Cross Blue Shield of Massachusetts (BCBSMA) PPO product. This notice tells you the ways in which we may use and disclose your personal, individually identifiable health information and our obligations to keep your information private. This notice also describes your privacy rights.

We are required by law to protect the privacy of individually identifiable health information about you (“Your Protected Health Information”), to give you this notice of our legal duties and our privacy practices, to follow the terms of this notice, and to notify you in the event you are affected by a breach of unsecured Protected Health Information.

How We May Use and Disclose Your Protected Health Information

The following categories show the different ways we may use and disclose to others Your Protected Health Information. For each category we give some examples, but not every use or disclosure in a category is listed. Your Protected Health Information will not be used or disclosed for purposes other than those described in this notice without your written authorization.

For Treatment: Your Protected Health Information may be used or disclosed by us to facilitate your treatment and for the coordination and management of your health care.  For example, a doctor treating you for a particular condition may need to obtain information from us about prior treatment of a similar or different condition, including the identity of the health care provider who treated you previously.

For Payment: Your Protected Health Information may be used and disclosed by HUSHP to let your health care providers know that anticipated services will be, or will not be, covered by the plan, for example, to make coverage determinations, administer claims and coordinate benefits with other coverage you may have. Your Protected Health Information may also be used and disclosed to pay for health care you have received or may be disclosed to another health plan or provider for its payment activities. For example, a doctor submits a claim to us following your hospital visit for knee surgery, and we pay the provider for that service.

For Health Care Operations: Your Protected Health Information may be used or disclosed for a variety of healthcare-related purposes that are necessary for HUSHP to function. We may use your Protected Health Information to ensure that all our plan members receive quality care and to ensure that HUSHP continues to comply with federal and state laws. For example, we may use your Protected Health Information to do business planning and conduct quality assessments and improvement activities.  We may also disclose Your Protected Health Information to another health plan or health care provider that has or had a relationship with you for it to conduct quality assessment and improvement activities, accreditation, certification, licensing, or credentialing activities; or for the purpose of health care fraud or abuse detection or compliance. In addition, we may use or disclose Your Protected Health Information to contact you to tell you about alternative treatments or health-related benefits and services that may be of interest to you.

Disclosures to the Plan Sponsor:

Your Protected Health Information may be disclosed to certain employees or other individuals under our control as necessary for them to carry out our responsibilities to administer HUSHP’s payment and health care operations activities. Except as provided by exceptions listed in this privacy notice, we are not permitted to use Your Protected Health Information disclosed by or on behalf of HUSHP for any other purpose without your authorization. The plan documents identify by position the specific employees or other individuals under our control who are authorized to have access to or receive Your Protected Health Information for plan administration purposes. We cannot use Your Protected Health Information obtained from HUSHP for any employment-related actions or to administer plans that are not subject to HIPAA without your authorization.  However, health information derived from other sources, for example in connection with an application for disability benefits or for approval of an FMLA leave, is not protected by HIPAA.

Special Situations: In addition to the above, there may be times when we use or disclose Your Protected Health Information for the following reasons:

As Required By Law: We will disclose Your Protected Health Information when required to do so by federal, state, or local law.

Third Parties: We may disclose Your Protected Health Information to third-party business associates who assist in plan administration. Third parties include third-party administrators, consultants, lawyers, and other service vendors. We will obtain assurances from our business associates that they will appropriately safeguard Your Protected Health Information.

Health Oversight and Public Health Activities:  We may disclose Your Protected Health Information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil laws. We may also disclose Your Protected Health Information to public authorities for purposes of preventing or controlling disease, reporting child abuse or neglect, or certain other public health reasons.

Lawsuits and Disputes: We may disclose Your Protected Health Information about you in response to a subpoena, discovery request, or other lawful order from a court. We will take reasonable steps to notify you or your attorney before responding to such requests.

Law Enforcement: We may release Your Protected Health Information as part of law enforcement activities: in investigations of criminal conduct or of victims of crime; in response to court orders; in emergency circumstances; or when required to do so by law.

Workers’ Compensation: We may disclose Your Protected Health Information as necessary to comply with workers’ compensation laws.

Exceptions: Federal and state law require special privacy protections for certain health information regarding drug and alcohol information, genetic testing information, and HIV test results. We will abide by all applicable state and federal laws related to the protection of this information. In order for us to disclose any information that is entitled to special restrictions, we must obtain your separate, specific consent, unless we are otherwise permitted by law to make such disclosure.

Your Rights Regarding Health Information About You

You have the following rights regarding Your Protected Health Information:

Right to Inspect and Copy: With certain exceptions, you have the right to access and/or receive a copy of your Protected Health Information maintained by HUSHP. Usually, this includes enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for HUSHP In the event we use or maintain an electronic health record with respect to Your Protected Health Information, you shall have the right to obtain a copy of such information in an electronic format and, if you choose, to direct us to transmit such copy directly to another recipient.

To inspect and copy Your Protected Health Information, you must submit your request in writing to Member Services. If you request a copy of the information, we may charge a reasonable fee for the costs of copying and postage. Under limited circumstances, HUSHP may deny you access to a portion of your records.

Right to Request Amendment: If you feel that the Protected Health Information we have about you in the set of records we maintain is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by HUSHP.

To request an amendment, your request must be made in writing and submitted to our Privacy Officer.  In addition, you must provide a reason that supports your request. You may obtain a form for this purpose from the Privacy Officer.

If we deny your request, we will provide you with a written explanation of why we did not make the amendment and explain your rights. You may then submit a written statement disagreeing with our denial.

Right to an Accounting of Disclosures: You have the right to an “accounting” (a list or report) of disclosures of Your Protected Health Information, with certain exceptions. To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer. Your request must state a time period that may not be longer than six years prior to the request date. The first list you request within a 12-month period will be free. For additional lists during the same 12-month period, we may charge you for the cost of providing the list. We will notify you of the cost involved, and you may choose to withdraw or modify your request at the time before any costs are incurred. To the extent we use or maintain an electronic health record with respect to Your Protected Health Information, you have the right to an accounting for disclosures that is also related to treatment, payment, or healthcare operations for a period of three years prior to the date on which the accounting is requested.

Right to Request Restrictions: You have the right to request a restriction or limitation on Your Protected Health Information we use or disclose for treatment, payment, or health care operations. We will comply with your restriction requests if the disclosure is not related to your treatment and the services to which Your Protected Health Information relates have been paid out of pocket and in full. You also have the right to request a limit on Your Protected Health Information we disclose to someone who is involved in your care or the payment of your care, such as a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. To request restrictions, you must make your request in writing to our Privacy Officer. In your request, you must state (1) what use or disclosure you want to limit, (2) what information you want to limit, and/or (3) to whom you want the limits to apply. No agreement to comply with a requested restriction shall be effective unless an authorized representative of HUSHP signs the agreement.

Right to Request Confidential Communications: You have the right to request, and we will accommodate any reasonable written request to our Privacy Officer to receive Your Protected Health Information by alternative means of communication or alternative locations. Please note that in certain instances such as eligibility and enrollment concerns, the health plan is obliged to communicate directly with the employee rather than a dependent member.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice at any time, even if you have agreed to receive this notice electronically. To obtain a paper copy of this notice, please request one from Member Services.

Right to Notice of Breach: In the unlikely event of a breach of unsecured Personal Health Information which causes you a significant risk of financial, reputational, or other harm, we shall notify you of such breach. We will send you written notice of the breach via first-class mail to your last known address unless you have indicated a preference for email. The notice will include, among other things, a brief description of what happened, a brief description of the types of unsecured personal health information that was disclosed in the breach, steps that you should take to protect yourself from potential harm resulting from the breach, a brief description of our actions taken to investigate the breach, mitigate the harm and protect against further breaches and contact procedures to learn additional information.

Complaints

If you believe your privacy rights have been violated or we are not in compliance with these privacy practices, you may file a complaint with the Plan’s Privacy Officer or with the Office of Civil Rights at the Department of Health and Human Services. To file a complaint with HUSHP, write to our Privacy Officer, whose address is listed below. All complaints must be submitted in writing.

The Privacy Officer and Harvard University Student Health Program will investigate all complaints. You will not be penalized in any way for making a complaint.

Complaints filed with the Secretary of Health and Human Services must be in writing and must be sent within 180 days of when you knew (or should have known) that the act or omission occurred to the Office of Civil Rights, U.S. Department of Health and Human Services, JFK Building, Room 1875, Government Center, Boston, MA 02203. Your letter must include the name of the plan, and a description of the acts or omissions that you believe are in violation of privacy requirements.

Limitations on Application of This Notice

This Notice does not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. In addition, the Plan may use or disclose “summary health information” to Harvard University, the Plan Sponsor, for purposes of obtaining premium bids or modifying, amending, or terminating the plan. Summary health information is information that summarizes claims history, claims expenses, or types of claims experienced by individuals for whom the Plan Sponsor provides benefits under the plan and from which individual identifying information, other than a zip code, has been deleted. The Plan and the Plan Sponsor may also use or disclose eligibility and enrollment information without your authorization.

Effective Date

The effective date of this policy is August 16, 2013