Notice of privacy practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
At Providence Health Plans, we respect the privacy and confidentiality of your protected health information (PHI). We are sincere in our promise to ensure the confidentiality of your information in a responsible and professional manner. We are required by law to maintain the privacy of your protected health information, provide you with this notice, abide by the terms of this notice, and to notify you if a breach of your unsecured PHI occurs. Should any of our privacy practices change, we reserve the right to change the terms of this notice and to make the new notice effective for all PHI we maintain. Once revised, we will post the notice on our website and notify you if a material change has been made. You also may request the new notice be mailed to you.
This notice explains how we use information about you and when we can share that information with others. It also informs you about your rights as our valued member. Finally, this notice provides you with information about exercising these rights.
How we share your information
We use PHI and may share it with others as part of your treatment, payment for your treatment or for our business operations. The following are ways we may use or share information about you:
We will use the information to administer your plan benefits, including but not limited to making claims determinations and coordinating your benefits with other coverage you may have. We will use the information to help pay your medical bills that have been submitted to us by doctors and hospitals for payment. We may also use and disclose PHI to collect premiums, calculate cost-sharing amounts, respond to complaints, appeals and requests for external review. We may share the minimum necessary amount of PHI with the subscriber of your plan for payment purposes. We may share information with the Health Insurance Exchange if you signed up on a Qualified Health Plan.
We do not provide treatment. This is the role of a healthcare provider, such as your doctor or a hospital. We may share your information with your doctors or hospitals to help them provide medical care to you. For example, if you are in the hospital, we may give them access to any medical records sent to us by your doctor. We may use or share your information with others to help manage your health care. For example, we might talk to your doctor to suggest a disease management or wellness program that could help improve your health.
Health care operations
We may use and disclose PHI during the course of running our health business – that is, during operational activities such as quality assessment and improvement, performance measurement and outcomes assessment; health services research; and preventative health, disease management, case management and care coordination. We may use your information to give you information about alternative medical treatments and programs or about health-related products and services that you may be interested in. For example, we sometimes send out newsletters that let you know about “healthy living” alternatives, such as smoking cessation or weight-loss programs. Other operational activities requiring use and disclosure of health information include underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; and other general administrative activities, including data and information systems management, and customer service. If we use or disclose health information for underwriting purposes, we are prohibited from using or disclosing health information that is genetic information of an individual for such purposes. We may share your information with individuals who perform business functions for us. We will only share your information if there is a business need to do so and if our business partner agrees to protect the information.
If you are enrolled with Providence Health Plans through an employer-sponsored group health plan, Providence Health Plans may share PHI with your group health plan. We may share your information with your plan sponsor if requested so that your plan sponsor can obtain premium bids or modify, amend, or terminate the plan. If your employer pays your premium or part of your premium, but does not pay your health insurance claims, your employer is not allowed to receive your PHI for purposes other than obtaining premium bids or to modify, amend, or terminate the plan, unless your employer promises to protect your PHI and makes sure the PHI will be used for legal reasons only.
State and federal laws may require us to release your health information to others for the following reasons:
- We may have to give information to law enforcement agencies. For example, we are required to report when we believe there has been child abuse or neglect, or an act of domestic violence.
- We may also share your information when needed to lessen a serious and imminent threat to health or safety.
- We may be required by a court or administrative agency to provide information because of a search warrant or subpoena.
- We may report health information to public health agencies if we believe there is a serious health or safety threat.
- We may report health information on job-related injuries because of requirements of your state worker compensation laws.
- We may report information to the Food and Drug Administration. They are responsible for investigation or tracking of prescription drug and medical device problems.
- We may have to report information to state and federal agencies that regulate us, such as the U.S. Department of Health and Human Services, Oregon Insurance Division and the Washington Office of Insurance Commissioner.
Uses and disclosures requiring your written authorization
If we use or disclose your information for any reasons other than the above, we will first get your written permission. For example, we will get your authorization:
- For marketing purposes that are unrelated to your benefit plan(s);
- Before most disclosures of psychotherapy notes if we have them (exceptions exist such as disclosures required by law or disclosures in the defense of a legal proceeding brought by you);
- Related to the sale of your health information;
- For other reasons as required by law;
- To allow us to give PHI to your family member, friend or other person.
- If there is an emergency or you’re not able to give verbal or written permission to Providence Health Plans we may give your PHI to family member, friend or other person if sharing your PHI is in your best interest. For example, if you are unconscious, we may share your information with the person calling if we believe doing so is in your best interest.
If you give us written permission and change your mind, you may revoke your written permission at any time. We will honor the revocation except to the extent that we have already relied on your permission.
NOTE: If we disclose information as a result of your written permission, it may be re-disclosed by the receiving party and may no longer be protected by state and federal privacy rules. However, federal or state law may restrict re-disclosure of additional information such as HIV/AIDS information, mental health information, genetic information and drug/alcohol diagnosis, treatment or referral information.
What are your rights?
You have certain rights with respect to your PHI including:
Request to restrict information
You have the right to ask us to restrict how we use or disclose your information for treatment, payment, or health care operations. You also have the right to ask us to restrict information we may give to persons involved in your care. While we may honor your request for restrictions, we are not required to agree to these restrictions.
Request to send your PHI to an alternative location
You have the right to submit a request for Confidential Communication to us in writing regarding how we send plan information to you that contains protected health information. For example, you may request that we send your information by a specific means (for example, U.S. mail only) or to a specified address. Methods of requesting confidential communications are:
- All Providence Health Plans members have the right to request that their PHI be sent to a different address if sending PHI to your current address might put you in danger. Providence Health Plans will accommodate reasonable request of this nature. We will not ask you to explain why you believe you are in danger. We require that these requests be made in writing. Please call customer service for more information.
- All Washington Providence Health Plans members have the right to limit disclosures of any information including health information. The member must clearly state in writing that disclosures to specified individuals of all or part of that information could jeopardize the safety of the member. Please call customer service for more information. (WAC 284-04-510)
- Some Providence Health Plans members have the right to request that their plan information that contains PHI be sent to another address other than your home and to refrain from disclosing such information to the policyholder/subscriber. We require that these requests be made in writing. Get additional information (OR HB 2758)
Request for information
You have the right to inspect and obtain a copy of information that we maintain about you in a designated record set. However, you may not be permitted to inspect or obtain a copy of information that is:
- Contained in psychotherapy notes
- Compiled in reasonable anticipation of, or for use in a civil criminal or administrative action or proceeding
- Members may request to see their medical records. Call your physician's or provider's office to ask how to schedule a visit for this purpose.
Additionally, in certain other situations, we may deny your request to inspect or obtain a copy of your information. If we deny your request, we will notify you in writing and will provide you with a right to have the denial reviewed. We may require that your request for information be made in writing. We will respond to your request no later than 30 days after we receive it. If we need additional time, we will inform you of the reasons for the delay and the date that we will be able to complete action on your request, which will be no more than 30 additional days. If you request a copy, it will be provided to you in the form and format requested by you if the information is readily producible in that format. We will charge you a reasonable fee based on copying and postage costs. You may request a copy of the portion of your enrollment and claim record related to an appeal or grievance, free of charge.
Request for amendment
You have the right to ask us to amend information we maintain about you in a designated record set. We may require that your request be in writing and that you provide a reason for your request. We will respond to your request no later than 60 days after we receive it. If we are unable to act within 60 days, we may extend that time by no more than an additional 30 days. If we need to extend this time, we will notify you of the delay and the date by which we will complete action on your request. If we make the amendment, we will notify you that it was made, and we will obtain your agreement to have us notify the relevant persons you have identified with whom the amendment needs to be shared. We will notify these persons, including their business associates, of the amendment. If we deny your request to amend, we will notify you in writing of the reason for the denial. The denial will explain your right to file a written statement of disagreement. We have a right to rebut your statement. However, you have the right to request that your written request, our written denial and your statement of disagreement be included with your information for any future disclosures.
Request for accounting
You have the right to receive an accounting of certain disclosures of your information made by us during the six years prior to your request. The accounting may not include disclosures:
- For treatment, payment, and health care operations purposes
- Made to you
- Made in connection with a use or disclosure otherwise permitted
- Made pursuant to your authorization
- For a facility's directory or to persons involved in your care or other notification purposes
- For national security or intelligence purposes
- To correctional institutions, law enforcement officials
- Made as part of a limited data set for research, public health or health care operations purposes
- Prior to April 14, 2003
Additionally, if we disclosed your information for research purposes pursuant to a waiver of authorization, we may not account for each disclosure of your information. Instead, we will provide for you:
- The name of the research protocol or activity;
- A description of the research protocol or activity including the purpose for the research and the criteria for selecting particular records;
- A description of the type of PHI that was disclosed;
- The date or period of time when such disclosure occurred; and
- The name, address and telephone number of the entity that sponsored the research and researcher to whom the information was disclosed.
We will act on your request for an accounting within 60 days. We may need additional time to act on your request, and therefore may take up to an additional 30 days. Your first accounting will be free, and we will continue to provide to you one free accounting upon request every 12 months. However, if you request an additional accounting within 12 months of receiving your free accounting, we may charge you a fee. We will inform you in advance of the fee and provide you with an opportunity to withdraw or modify your request.
Exercising your rights
You have the right to receive a new copy of this notice at any time. Even if you have agreed to get this notice by electronic means, you still have the right to a paper copy.
If you have any questions about your PHI or if you believe your privacy rights have been violated, please contact Customer Service at:
Monday through Friday, 9 a.m. to 5 p.m.
You may file a complaint with us in writing at:
Providence Health Plans
Attn: Appeals and Grievance Dept.
P.O. Box 4327
Portland, OR 97208-4327
You also can send us general privacy questions online; however, this service is currently unavailable for Medicare members.
You may notify the Office for Civil Rights, U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not take any action against you for filing a complaint. You may file the complaint at the Office for Civil Rights at:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201
OCR Hotlines-Voice: 1-800-368-1019
Website: Office for Civil Rights, www.hhs.gov/ocr/privacy/hipaa/complaints/
If you have further questions about Providence Health Plans’ privacy practices, please call our Privacy Program at 503-574-7770.
Confidentiality of member information
Providence Health Plans is dedicated to protecting your PHI. All of us need to know that information about our health care is private and confidential. We respect the privacy of our members and take great care to determine when it is appropriate to share your PHI. Providence Health Plans makes every effort to release only the amount of information necessary to meet any release requirement and only releases information on a need-to-know basis. Also, wherever feasible, identifiable information is removed from any information shared within and outside of Providence Health Plans.
Providence Health Plans has procedures in place to ensure the confidentiality of your PHI, including specific protections for oral, written, and electronic PHI. These include, but aren’t limited to:
Protection of oral PHI
- Employees are trained that they should not speak about PHI in public spaces, including health plan restrooms or hallways.
- Employees are trained that they may only speak about PHI with those that need to know the information, such as a provider or a supervisor.
Protection of written PHI
- Where appropriate, employees must lock storage areas and filing cabinets.
- Employees are required to securely dispose of written PHI.
Protection of electronic PHI
- Entries into member records are tracked for security purposes. Employees must report any security violations.
- Unique and secured log-in names and passwords are required to access the Providence Health Plans’ computer system. In addition, firewalls, encryption and data backup systems are used. Similar strategies are used for protecting confidential information on our website.
Protection of all types of PHI (oral, written, and electronic)
- To enter the health plan an ID badge must be used to open the door.
- Access to a member's medical information held by the plan is restricted to only those Providence Health Plans employees who need this information, to the member, and as outlined in this Notice.
- Providence Health Plans employees are educated about the Privacy and Security rules and sign an electronic confidentiality statement upon employment.
- Our agreements with participating providers contain confidentiality provisions that require these providers to treat your PHI with the same care as Providence Health Plans.
- Our agreements with business associates who perform functions or activities on our behalf require them to appropriately safeguard your PHI with the same care as Providence Health Plans.
Effective date of this notice
The original effective date of this Notice was April 14, 2003. The most recent revision date is indicated in the footer of this Notice.