Notice of Privacy Practices
Effective September 23, 2013
THIS NOTICE DESCRIBES HOW YOUR PERSONAL FINANCIAL AND HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice applies to the privacy practices of Blue Cross of Idaho Health Service, Inc. and Blue Cross of Idaho Care Plus, Inc., affiliated entities. We may share your personal financial and health information with each other as needed for our payment and healthcare operations. We are committed to protecting the privacy of your personal financial and health information in any form, whether oral, written or electronic. We keep your personal information private by maintaining physical, electronic, and procedural safeguards that comply with legal requirements. This notice explains our privacy practices, our legal duties, and yo ur rights concerning your personal information. We reserve the right to change the way your personal information is used or disclosed. However, if we make any changes, you will receive a new notice within 60 days of the change.
Uses and Disclosures of Personal Financial Information
We use certain financial information to carry out insurance activities as allowed by law. This includes information collected from you when you apply for our products or services, such as your name, address, age, and social security number. We may verify or obtain additional information through others, such as adult family members, employers, other insurers, physicians, hospitals, and other medical providers. We disclose information only to our affiliates and others who perform services within the scope of healthcare operations on our behalf. For example, information is disclosed to our affiliates and others to help us evaluate requests for insurance or benefits, perform general administrative activities, and process claims. In addition, we disclose information to law enforcement and regulatory agencies to help us prevent fraud. We do not make any disclosures of your financial information to other companies who may want to sell their products or services to you.
Uses and Disclosures of Personal Health Information
We use your personal health information for healthcare payment and operations as allowed or required by law. We must use and disclose your personal health information to provide information:
- To you or someone who has the right to act on your behalf (your legal or personal representative);
- To the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected; and
- As required by law.
We have the right to use and disclose your personal health information to pay for your healthcare and to carry out our healthcare operations. For example, we may use or disclose your personal health information:
- To pay or deny your claims, to collect your premiums, to share your benefit payment information with your other insurers, and to inform your providers regarding your eligibility for coverage under a health plan.
- To provide customer services to you, or to resolve any complaints you may have;
- To inform the policyholder about determinations made regarding claims submitted for all dependents on the policy;
- To send you a reminder to obtain preventive health services or to inform you about alternative medical treatments or other health-related benefits and services that may interest you (such as our Disease Management Programs);
- To the Idaho Health Data Exchange (IHDE), a collaboration to improve coordination and quality of care, and to other health improvement or health care cost-reduction programs;
- With others who help us conduct our business operations. However, we will not share your information with these outside groups unless they agree to protect it;
- If you are an enrollee of a group health plan, to share information with the plan sponsor (employer) or the group health plan through which you receive health benefits. However, we will not share detailed health information with your benefit plan unless they agree in writing to protect it; and
We may use or disclose personal health information for the following purposes under limited circumstances:
- To meet regulatory requirements of state and federal agencies (such as the Idaho Department of Insurance);
- For public health activities (such as reporting disease outbreaks, child abuse, neglect or domestic violence);
- For government health care oversight activities (such as fraud and abuse investigations);
- For judicial and administrative proceedings (such as in response to a court order);
- For law enforcement purposes (such as providing limited information to locate a missing person);
- For research studies that meet all privacy law requirements (such as research related to the prevention of disease or disability);
- To avoid a serious and imminent threat to health or safety;
- To a coroner, medical examiner, funeral director or organ donation organizations (for reasons such as to identify a deceased person, determine a cause of death, or as authorized by law);
- To a correctional institution or to a law enforcement official (for reasons such as the health and safety of the inmates and for the safety and security of the correctional institution);
- To specialized government functions (such as military and veteran activities, national security and intelligence activities, and the protective services for the President and others);
- To state worker compensation departments (for reasons such as to report information on job-related injuries); and
- To others involved in your health care or payment for health care (for reasons such as to inform your spouse of the status of a claim).
We may not use or disclose any genetic information for our underwriting purposes. We may not sell your personal health information, or use or disclose your personal health information for marketing communications, without your written authorization except where permitted by law.
Other Uses and Disclosures of Your Personal Health Information
By law, we must have your written authorization to use or disclose your personal health information for any purpose that is not set out in this notice. You may revoke your written authorization at any time, except if we have already acted based on your authorization.
Potential Impact of State Law
In some situations we may choose to follow state privacy or other applicable laws that provide greater privacy protections to individuals. If a state law that we follow requires that we not use or disclose protected health information (such as age of majority or parental notification restrictions), then we may not use or disclose that information.
In the event of a breach of your unsecured health information, we will provide you notification of such a breach as required by law or where we otherwise deem appropriate.
By law, you have the right to:
- Inspect and get a copy of your personal health information held by us upon your written request. An electronic copy may be available in certain circumstances upon request. There may be a fee for copies of this information;
- Have your personal health information amended if you believe (and we agree) that it is wrong or if information is missing. You must make this request in writing and the request must explain why you think the information should be amended;
- Receive, upon your written request, a list of instances in which we may have disclosed your personal health information for purposes other than those described in this notice. This list does not include disclosures made for treatment, payment or healthcare operations, certain other activities, and those authorized by you;
- Ask us to communicate with you in a different manner or at a different place (for example, by sending materials to a post office box instead of your home address) if you believe that you would be harmed if we sent your information to your current mailing address. You must make this request in writing and you must state the reason for the confidential communication;
- Ask us to restrict how your personal health information is used and disclosed in order to pay your claims and run our healthcare operations. We are not required to agree to any restriction that you may request; and
- Get a copy of this notice at any time.
Questions and Complaints
If you believe we have violated your privacy rights set out in this notice, you may file a complaint with us at the following address:
Information Privacy Officer
Blue Cross of Idaho
P.O. Box 7408
Boise, ID 83707
You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. Complaints filed directly with the Secretary must: (1) be in writing; (2) contain the name of the entity against which the complaint is lodged; (3) describe the relevant problems; and (4) be filed within 180 days of the time you became or should have become aware of the problem. We will not penalize or in any other way retaliate against you for filing a complaint with the Secretary or with us.
Please contact our Information Privacy Officer at
1-877-488-7788 for more information about this notice.