University of California Healthcare Plan Notice of Privacy Practices – Self-Funded Plans

UC’S COMMITMENT

The University of California is committed to protecting the privacy of your PHI as required by law. The Plans:

• Are required by law to maintain the privacy and security of your PHI
• Must provide you with this Notice of our legal duties and privacy practices
• Must follow the terms of the Notice currently in effect
• Will notify you in the event of a breach of your unsecured PHI

How We May Use and Disclose Your Health information

We typically use and disclose your health information in the following ways.

– Treatment. A Self-Funded Plan may use and disclose your PHI to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records.

– Payment. A Self-Funded Plan may use and disclose your PHI in the course of activities that involve reimbursement for healthcare, such as determination of eligibility for coverage, claims processing, billing, obtaining, and payment of premium, and utilization review.

– Healthcare Operations. Most Plan administration activities and duties are handled by third parties called Third Party Administrators, which must be fully compliant with HIPAA. The Plans operate a Health Care Facilitator (HCF) function which may assist enrollees with resolving issues with TPAs and help to navigate benefit coverage and appeals processes. The HCF function may only access PHI solely for health care operations of the Plan and only as permitted by HIPAA. As required by HIPAA, the HCF function may not share PHI with the Plan Sponsor functions.

– Plan Sponsor. The Plan Sponsor employee benefits administration function may receive certain limited PHI from the Plans or the health insurance issuer (e.g., Elevance/Anthem) for two very narrow purposes:

1. Summary Health Information as defined by HIPAA [45 CFR 164.504(f)(1)] for the purpose of:
   • Obtaining Plan premium bids from health plans for future Plan coverage years, or
   • Modifying amending, or terminating the Plan; or
2. Whether an individual Plan enrollee is participating on the Plan , or is enrolled or had disenrolled from the Plan.
   • Obtaining Plan premium bids from health plans for future Plan coverage years, or
   • Modifying amending, or terminating the Plan; or

– As Required By Law. A Self-Funded Plan will disclose your PHI if required to do so by federal, state, or local law, or regulation.

– To Avert a Serious Threat to Health or Safety. A Self-Funded Plan may disclose your PHI when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

– Disaster Relief Efforts. A Self-Funded Plan may share your health information to an entity assisting in a disaster relief effort so that others can be notified about your condition, status and location.

– Military and Veterans. If you are or were a member of the armed forces, a Self-Funded Plan may release your PHI to military command authorities as authorized or required by law. A Self-Funded Plan may also release medical information about foreign military personnel to the appropriate military authority as authorized or required by law.

– Research. In limited circumstances, a Self-Funded Plan may use and disclose PHI for research purposes, subject to the confidentiality provisions of state and federal law. Your PHI may be important to further research efforts and the development of new knowledge. All research projects conducted by the University of California must be approved through a special review process to protect member safety, welfare, and confidentiality.

– Workers’ Compensation. A Self-Funded Plan may release PHI for workers’ compensation or similar programs as permitted or required by law. These programs provide benefits for work-related injuries or illness.

– Health Oversight Activities. A Self-Funded Plan may disclose PHI to governmental, licensing, auditing, and accrediting agencies as authorized or required by law.

– Legal Proceedings. A Self-Funded Plan may disclose PHI to courts, attorneys, and court employees in the course of conservatorship and certain other judicial or administrative proceedings.

– Lawsuits and Disputes. If you are involved in a lawsuit or other legal proceeding, a Self-Funded Plan may disclose your PHI in response to a court or administrative order, or in response to a subpoena, discovery request, warrant, summons, or other lawful process.

– Law Enforcement. If authorized or required by law, a Self-Funded Plan may disclose your PHI under limited circumstances to a law enforcement official in response to a warrant or similar process, to identify or locate a suspect, or to provide information about the victim of a crime.

– Department of Health and Human Services. A Self-Funded Plan may be required to disclose your PHI to the Department of Health and Human Services if the Secretary is conducting a compliance audit.

– National Security and Intelligence Activities. If authorized or required by law, a Self-Funded Plan may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities.

– Protective Services for the United States President and Others. A Self-Funded Plan may disclose your PHI to authorized federal and state officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or conduct special investigations as authorized or required by law.

– Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, a Self-Funded Plan may release your PHI to the correctional institution or law enforcement official, as authorized or required by law. This release would be necessary for the institution to provide you with healthcare; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

– Marketing or Sale of Health information. Most uses and sharing of your health information for marketing purposes or any sale of your health Information are strictly limited and require your written authorization.

– Separation Between Covered Functions and Non-Covered Functions. To comply with the requirements of HIPAA, the University must maintain separation between covered functions (including the University’s Group Health Plans), and non-covered functions (such as employer-related functions not associated with the University’s Group Health Plans). The University prohibits the use or disclosure of member PHI for employment-related actions or decisions; nor may it be used or disclosed in connection with any other benefit or employee benefit plan of the University. A disclosure of PHI from the Single Health Plan Component to a non-covered function or unit may require written authorization.

– Other Uses and Disclosures of Health Information. Other ways we share and use your health information not covered by this Notice will be made only with your written authorization. If you authorize us to use or disclose your health information, you may cancel that authorization, in writing, at any time. However, the cancellation will not apply to information we have already used and disclosed based on the earlier authorization.

Special laws apply to certain kinds of health information considered particularly private or sensitive to a patient. This sensitive information includes psychotherapy notes, sexually transmitted diseases, drug and alcohol abuse treatment records, mental health records, and HIV/AIDS information. When required by law, we will not share this type of information without your written permission. In certain circumstances, a minor’s health information may receive additional protections.

– Genetic Information is Protected Health Information. In accordance with the Genetic Information Nondiscrimination Act (GINA), a Self-Funded Plan will not use or disclose genetic information for underwriting purposes, which includes eligibility determinations, premium computations, applications of any pre-existing condition exclusions, and any other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

Your Rights

You have the following rights regarding the PHI that a Self-Funded Plan maintains about you:

– Right to Inspect and Copy. With certain exceptions you have the right to inspect and obtain a copy of your PHI that is maintained by or for a Self-Funded Plan. To inspect and obtain a copy of the PHI you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street
Oakland, CA 94607, Attention: Privacy Officer. You may be charged a fee for the costs of copying mailing or other supplies associated with your request.

A Self-Funded Plan may deny your request to inspect and/or obtain a copy in certain limited circumstances. For example, HIPAA does not permit you to access or obtain copies of psychotherapy notes. If your request is denied, you will be informed in writing, and you may request that the denial be reviewed. The person conducting the review will not be the person who denied your request. The plan will comply with the outcome of the review.

– Right to Request an Amendment. If you believe that the PHI maintained by a Self-Funded Plan is incorrect or incomplete, you may request that the plan amend the information. You have the right to request an amendment for as long as the information is kept by or for the plan. A request for an amendment should be made in writing and submitted to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. In addition, you must provide a reason that supports your request. If a request applies to PHI that a TPA (BA) maintains, UC may assist the enrollee with reaching TPA responsible privacy office.

A Plan may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, the plan may deny your request if you ask to amend information that was not created by the plan; is not part of the PHI maintained by or for the plan; is not part of the information that you would be permitted to inspect and copy under the law; or if the information is accurate and complete. If the request is granted, the plan will forward your request to other entities that you identify that you want to receive the corrected information.

– Right to an Accounting of Disclosures. You have the right to receive an “accounting of disclosures,” which is a list of disclosures such as those that were made of PHI about you, with the exception of certain documents, including those relating to treatment, payment, and healthcare operations and disclosures made to you or consistent with your authorization. To request an accounting of disclosures, you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer.

Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003.

Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists, the plan may charge you for the costs of providing the list. You will be notified of any costs involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

– Right to Request Restrictions. You have the right to request a restriction or limitation on the use and disclosure of your PHI for treatment, payment or healthcare operations, or to request a restriction on the PHI that the plan may disclose about you to someone who is involved in your care, or the payment for your care such as a family member or friend. The plan is not required to agree to your request. If the plan agrees to your request, it will comply with the requested restriction unless the information is needed to provide you emergency treatment or to assist in disaster relief efforts.

To request a restriction you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. Your request should state the information you want to limit; whether you want to limit the plan’s use or disclosure or both; and to whom you want the limits to apply for example disclosures to your spouse.

– Right to Request Confidential Communications. You have the right to request that a Self-Funded Plan communicate with you about Plan matters in a certain way or at a certain location. For example, you can ask that the plan only contact you at work or by mail to a specific address. To request confidential communications, you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street
Oakland, CA 94607, Attention: Privacy Officer. The plan will accommodate all reasonable requests and will not ask you the reason for your request. Your request must specify how or where you wish to be contacted.

– Right to a Paper Copy of This Notice. You may ask the Planto give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, contact the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer.

– Breach. You have the right to be notified, and your Self-Funded Plan has the duty to notify you, of the discovery of a breach of unsecured PHI.

– Right to Choose Someone to Act for You.  If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. The plan will make sure the person has this authority and can act for you before the plan takes any action.

Changes to this Notice

The Self-Funded Plans are required to abide by the terms of the Notice of Privacy Practices currently in effect. However, the Self-Funded Plans reserve the right to change this notice and to make the revised or changed notice effective for PHI your plan already maintains on you as well as any information the plan receives or creates in the future.

A copy of the current notice will be posted at the UC website at  https://ucnet.universityofcalifornia.edu/forms/pdf/uc-healthcare-plan-notice-of-privacy-practices-self-funded-plans.pdf. The notice will contain the effective date on the first page in the top right-hand corner. In addition, a copy of the notice that is currently in effect will be given to new health plan members and thereafter, available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

• UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94612, Attention: Privacy Officer. Email will not be accepted; all complaints must be submitted in writing.
• The Secretary of the Department of Health and Human Services for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201. 

You will not be retaliated against for filing a complaint.

Questions

If you have questions or for further information regarding this privacy notice, contact the UC Healthcare Plan Privacy Officer at 1-800-888-8267, press 1.