Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
SummaCare is dedicated to protecting the confidentiality of information we have about you. We are required by law to maintain the privacy of your protected health information and to provide you with this Notice of our legal duties and privacy practices with respect to protected health information.
This Notice of Privacy Practices describes how SummaCare may use and disclose your protected health information to facilitate treatment, carry out payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information.
"Protected health information" is:
- information about you, including demographic information, that may identify you
- information that relates to your past, present or future physical or mental health or condition
- any healthcare services you may receive and payment for those services
Examples of protected health information include but are not limited to the notes your doctor keeps that documents your physician office visits, your birth date and your social security number.
SummaCare is required by law to abide by this Notice as long as the terms remain in effect. We reserve the right to change the terms of this Notice of Privacy Practices as necessary. Any revisions to this Notice will apply to all the protected health information we maintain, including protected information received before the change was made. Except when required by law, SummaCare will not implement a material change to any of the policies or terms described in this Notice prior to the effective date of the new Notice.
All members enrolled with SummaCare at the time that changes are made will receive the revised Notice 60 days prior to the effective date of the changes. Copies of the most current Notice may be obtained at any time by calling the Customer Service Department. You can also request a current Notice in writing by mailing a request to Customer Service.
IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE OR WISH TO REQUEST A COPY, PLEASE CALL MEMBER SERVICES AT THE NUMBER LISTED ON YOUR SUMMACARE CARD, WRITE TO: CUSTOMER SERVICE, SUMMACARE INC., P.O. BOX 3620, AKRON, OH 44309-3620, OR EMAIL YOUR REQUESTS TO INFO@SUMMACARE.COM.
I. USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION
SummaCare must internally use your protected health information to conduct our business and to ensure you are provided with the care and services to which you are entitled as a SummaCare member. In some cases we may disclose or share your protected health information with external individuals or organizations. In both cases, SummaCare limits access to the protected health information used and disclosed to the minimum amount reasonably necessary. Upon your enrollment, SummaCare may use and disclose your protected health information for these purposes without your signed authorization. The purposes for which we may use and disclose your protected health information are described below:
A. FOR TREATMENT – SummaCare may use or disclose information about you to facilitate your treatment by a physician or other health care provider. This includes the coordination or management of your health care with a third party that has already obtained your permission to have access to your protected health information. For example, when you seek the services of a physician, SummaCare may provide information about you to the physician so he/she can better treat your illness or injury.
B. FOR PAYMENT – SummaCare may use or disclose your health information for payment purposes. For example, we may use information regarding your medical procedures and treatment to process and pay claims, to determine whether services are medically necessary or to otherwise pre-certify services as covered under your SummaCare plan. We may also disclose such information to another health plan, which may have an obligation to process and pay claims on your behalf or to a health care provider from whom you have received medical services.
C. FOR HEALTH CARE OPERATIONS – SummaCare will use and disclose your protected health information as necessary, and as permitted by law, for our health care operations. In limited situations, SummaCare may disclose protected health information for the operations of other health plans or health care providers with which you have or had a relationship. For example, SummaCare may share protected health information with your primary care physician’s practice for quality improvement activities.
D. INFORMATION SENT TO YOU – As a SummaCare member, you may occasionally receive information from us about the care and services we provide. Sometimes this includes your protected health information. Examples include information about the payment of your claims, appointment reminders or a case management call from a SummaCare nurse. We may also send you information about treatment alternatives or other health-related benefits and services that may be of interest to you.
E. INDIVIDUALS INVOLVED IN ARRANGING FOR YOUR CARE OR PAYMENT FOR YOUR CARE - With your approval, we may disclose your protected health information to designated family members or others who may be helping you to arrange your care or arrange payment for your care. We may also disclose your protected health information to an individual or individuals who are legally authorized to act on your behalf, such as an individual to whom you have granted durable power of attorney. We may require the individual to furnish proof of such authorization before granting them access to your information. If you are unavailable, incapacitated, or facing an emergency medical situation, and in our professional judgment we determine that a limited disclosure may be in your best interest, we may share limited protected health information with such individuals without your approval. If you have designated a person to receive information regarding payment of the premium for your policy, we will inform that person when your premium has not been paid. We may also disclose limited protected health information to a public or private entity that is authorized to assist in disaster relief efforts to locate a family member.
F. BUSINESS ASSOCIATES - Certain aspects and components of our services are performed through contracts with outside persons or organizations, such as auditing, accreditation, legal services, etc. At times it may be necessary for us to share some of your protected health information with one or more of these outside persons or organizations who assist us with our health care operations. In all cases, we require business associates to appropriately safeguard the privacy of your information and comply fully with the privacy practices described in this Notice.
G. OTHER USES AND DISCLOSURES - SummaCare is permitted or required by law to make the following additional uses or disclosures of your protected health information:
- As Required by Law – SummaCare will disclose your protected health information for any purpose when required to do so by federal, state or local law.
- To the Secretary of the U.S. Department of Health and Human Services or his/her designee for investigations of HIPAA privacy compliance.
- For Public Health Activities – SummaCare may release your protected health information for public health activities. These activities generally include the following:
- To prevent or control disease, injury or disability;
- To report births and deaths;
- To report the abuse or neglect of children, elders and dependent adults;
- To report reactions to medications or problems with products;
- To notify people of recalls of products they may be using;
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
- To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
- To the Food and Drug Administration – SummaCare may release your protected health information to the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls.
To the Plan Sponsor– Under certain limited circumstances, SummaCare may release your protected health information to your plan sponsor. The "plan sponsor" is generally your employer or the entity who has purchased or funded your group health plan. The plan sponsor may need your information for such things as obtaining premium bids from SummaCare or another health plan. Before SummaCare shares any of your protected health information with your plan sponsor, that sponsor must agree to a number of legally required conditions designed to ensure that your information remains protected. For example, your plan sponsor must certify that the information provided will be maintained in a confidential manner and not used for employment related decisions or for other employee benefit determinations. The plan sponsor must also describe in advance the need for information and limit access to the information to those employees who require it to perform the job function described. When feasible, the plan sponsor must return or destroy all copies of your protected health information when it is no longer needed.
Health Oversight Activities – SummaCare may disclose your protected health information to a health oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. For example, SummaCare may disclose information to the Ohio Department of Health for periodic audits of the quality of care provided to SummaCare members.
Lawsuits and Disputes – If you are involved in a lawsuit or a dispute, SummaCare may disclose your protected health information in response to a court or administrative order. SummaCare may also disclose your protected health information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request (which may include written Notice to you) or to obtain an order protecting the information requested.
Law Enforcement – SummaCare may release protected health information if asked to do so by a law enforcement official:
- In response to a court order, subpoena, warrant, summons or similar process;
- To identify or locate a suspect, fugitive, material witness, or missing person;
- About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
- About a death we believe may be the result of criminal conduct;
- If SummaCare believes in good faith that the information constitutes evidence of criminal conduct that occurred on the premises of any SummaCare establishment;
- As required by law to report wounds and injuries and crimes;
- In certain situations when a member is an inmate in a correctional institution.
Coroners, Medical Examiners and Funeral Directors – SummaCare may release your protected health information to a coroner or medical examiner to identify a deceased person or determine the cause of death. SummaCare may also release your protected health information to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
Organ and Tissue Donation – SummaCare may use or disclose your protected health information to organ procurement organizations for the purpose of facilitating organ, eye or tissue donation and transplantation.
Research – Under certain circumstances, SummaCare may use and disclose your protected health information for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. All research projects, however, are subject to a special approval process that evaluates a proposed research project and its use of medical information. Information for research is not disclosed until the research project is approved. We may, however, disclose your medical information to people preparing to conduct a research project to help them look for patients with specific medical needs, so long as the medical information they review does not leave the possession of SummaCare.
Military and Veterans – SummaCare may use and disclose your protected health information if you are a member of the armed forces and the use and disclosure has been deemed necessary by appropriate military command authorities. SummaCare may also release protected health information about foreign military personnel to the appropriate foreign military authority.
National Security and Intelligence – SummaCare may release your protected health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. SummaCare may disclose protected health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
Workers’ Compensation – SummaCare may release your protected health information to workers’ compensation agencies if necessary for your workers’ compensation benefit determination.
H. WITH YOUR AUTHORIZATION – SummaCare will not use or disclose your protected health information without your written authorization except as described above in this notice. You may revoke your authorization in writing at any time as provided in the regulations, except to the extent that SummaCare or one of our business associates is already taking action in reliance on the use or disclosure you approved in your authorization. Your authorization is required for: (i) marketing purposes for which we receive payment; (ii) any disclosure for which we would receive money; and (iii) any uses and disclosures not described in this document.
II. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION
A. RIGHT TO REQUEST RESTRICTIONS – You have the right to request restrictions on the uses and disclosures of your protected health information for treatment, payment, or health care operations. Restriction request forms are available from Customer Service. Mail your request to the attention of Customer Service. Your request must include (i.) the information you want to limit; (ii.) whether you want to limit our use, disclosure or both; and (iii) to whom you want the limits to apply, for example, disclosures to your spouse. You or your authorized representative must sign restrictions. We are not required to agree to your restriction request. We retain the right to terminate an agreed upon restriction if we believe such termination is appropriate. In the event of termination by us, we will notify you of such termination. You also have the right to terminate, in writing or verbally, any agreed upon restriction by sending such termination Notice to the attention of Customer Service.
B. RIGHT TO AN ACCOUNTING OF DISCLOSURES – You have the right to receive an accounting of certain disclosures of your protected health information. SummaCare is not required to track and account for the following types of disclosure:
- Disclosure made for the purposes of treatment, payment or operations
- Disclosures made to you, or your authorized representative
- Disclosures to an individual involved in arranging your care or arranging payment for your care
- Disclosures made in accordance with an authorization you had previously signed and agreed to
- Certain disclosures that we may legally be required to keep from you, such as disclosures to law enforcement officials in response to a legally obtained warrant
If you would like an accounting of any disclosures of your protected health information that does not fall into the categories listed above, you must submit a written request signed by you or your authorized representative to SummaCare Customer Service. Accounting request forms are available from Customer Service.
C. CONFIDENTIAL AND ALTERNATIVE COMMUNICATIONS – As a SummaCare member, you may occasionally receive information from us about the care and services we provide. Sometimes this includes your protected health information. You have the right to request that SummaCare make reasonable accommodations for you to receive such communications by alternative means or at alternative locations. For example, you can request to have letters sent to a particular address that may be different from your normal home mailing address. You may also request that SummaCare restrict access and disclosure of your protected health information to specific individuals involved in arranging for your care or arranging payment for your care. Forms for requesting confidential communications are available from Customer Service. Your request for confidential or alternative communications must be in writing, signed by you or your authorized representative and sent to the attention of Customer Service. We are not required to agree to your request unless you clearly state that the disclosure of all or part of the information in question could place you or someone else in danger. You also have the right to request that we not send you any future marketing materials, and we will use our best efforts to honor such requests.
D. RIGHT TO INSPECT AND COPY – You have the right to copy and/or inspect most of the protected health information that we retain on your behalf. All requests for access must be made in writing and signed by you or your authorized representative. You may obtain an access request form by calling Customer Service. Requests for access should be sent to the attention of Customer Service. We may charge you for a copy of the information. We may also charge for postage if you request a mailed copy and may charge for preparing a summary of the requested information if you request a summary.
E. RIGHT TO AMEND – If you believe that the protected health information we maintain about you is incomplete or incorrect, you have the right to ask SummaCare to amend our records. All amendment requests must be in writing and signed by you or your authorized representative. Your request for an amendment must state why you believe our records are incomplete or inaccurate. We are not obligated to make all requested amendments but will give each request careful consideration. We may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available to make the amendment, and we can confirm that the amendment is appropriate
- Is not part of the protected health information kept by or for SummaCare
- Is not part of the information which you would be permitted to inspect and copy
- Is accurate and complete
SummaCare may send a copy of the newly amended record to any business associate or other entity who may have the older, inaccurate information. You may obtain an amendment request form from Customer Service.
F. COMPLAINTS – If you believe your privacy rights have been violated, you can file a complaint. Your complaint must be in writing, and sent to the attention of the SummaCare Compliance Department at P.O. Box 3620, Akron, Ohio 44309-3620. We will investigate your complaint and send you a written response. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services in Washington D.C. in writing within 180 days of a violation of your rights. SummaCare encourages you to tell us if you believe your privacy rights were violated. By law, SummaCare may not retaliate against you for filing a complaint.
G. RIGHT TO A PAPER COPY OF THIS NOTICE – You have the right to a paper copy of this Notice even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time by calling Customer Service department at the number located on your identification card.
For any fundraising efforts, SummaCare must contact you for such purposes, and you have the right to opt out of receiving such fundraising communications.
SummaCare must provide you with notification in the event of a breach of “unsecured” PHI in the event a breach occurs.
V. GENETIC INFORMATION
SummaCare is prohibited from using or disclosing genetic information for underwriting purposes.
VII. INTERNAL PROTECTIONS
SummaCare has internal policies, processes and procedures in place all employees must follow to ensure protection of PHI whether oral, written or electronic such as:
- Employees are required to sign a confidentiality agreement annually
- Workstations are password protected
- Access, use and disclosure of PHI is limited to the minimum necessary
- Random audits are conducted to ensure adherence to policies and procedures
- Policies are in place to verify the identity of each caller
- Policies are in place to ensure compliance with regulations regarding friends and family members
- Guidelines have been established to protect information sent via FAX
- Employees are encouraged to place confidential calls in an office or conference room
- Access to the floors of the SummaCare building is limited to employees and escorted visitors
All employees participate in annual educational sessions to ensure they maintain a current knowledge of and comply with these policies.