Medical, dental, pharmacy, managed behavioral health and vision plans notice of privacy practices

Aetna / CVS Health · Official agreement

129 of 148 blocks carry cards. 54 cards.

Notice of Privacy Practices

Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.

To receive this Notice in Spanish, please call the toll-free number on your member ID card.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (Notice) describes the privacy practices of Aetna Life Insurance Company. For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information (PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

This Notice applies to insured plans

This Notice of Privacy Practices is for Aetna insured health benefit plans. It does not apply to any plans that are self-funded by an employer. If you have coverage where you work, ask your employer if your plan is insured or self-funded. If it’s self-funded, ask for a copy of your employer’s Privacy Notice.

Effective date: This Notice took effect on October 1, 2025.

In this Notice, we describe:

  • Information we collect about you
  • How we use and share your information
  • Times when we must share your information
  • When we may share your information with those involved in your care
  • When we need your okay to use or share your information
  • Your rights under the law
  • How we keep your information safe
  • How we comply with the law
  • When this Notice may change

GR-67806 (2-26) R-POD B

Information we collect about you

We get information about you from many sources, including from you. But we also can get it from your employer or benefits plan sponsor (if applicable), other insurers, HMOs or third-party administrators, and health care providers such as doctors.

This is called Protected Health Information (PHI). It includes personal information that may identify you that is not public information. And it includes information about your health, medical conditions, prescriptions, and payment for health care products or services.

It may include:

How we use and share your information without your authorization

In providing your health benefits, we may use and share PHI about you in varied ways. For instance:

Health care operations: We may use and share your PHI for our health care operations.

Those are actions we need to do to run our health business, including:

For example, we may use your PHI to offer programs for certain conditions, such as diabetes, asthma, or heart failure. We may also use it for other operations requiring use and disclosure, such as:

GR-67806 (2-26) B 2

Payment: We may use and disclose PHI to help pay for your covered services when:

We carry out these tasks to make sure we pay for your care the right way. We may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be. During this process, we may share information with your health care provider.

We may also mail Explanation of Benefits forms and other information to the address we have on file for the subscriber (i.e., the primary insured). We also make claims information on our secure member website and telephonic claims status sites available to the subscriber and all covered dependents. We also use PHI to get payment for any mail-order pharmacy services you get.

Treatment: We may share your PHI with the health care providers who take care of you like your doctors, dentists, pharmacies and hospitals. Sometimes doctors may ask for your medical information from us to put in their own records.

We may also use your information to offer you mail-order pharmacy services. And we may also share certain information for patient safety or other reasons linked to your treatment.

Disclosures to other covered entities: We may share your PHI with other covered entities or their business associates. This may be for treatment, payment, or for certain health care operations.

For example, you may get your health benefits through an employer. If so, we may share your PHI with other health plans your employer offers. We do this to make sure we pay your claims the right way.

Additional Reasons for Use and Disclosure without Your Authorization

We may use or share PHI about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services. We also may use or share your PHI without your authorization in support of:

Continued on next page.

to authorized government officials for purposes of national security and intelligence activities, protective services for the President, and medical suitability determinations. If you are a member of the U.S. armed forces or the foreign military, we may disclose your PHI for activities deemed necessary by appropriate command authorities or under the law. If you are under the custody of a correctional institution or a law enforcement official, we may disclose your PHI to such parties if certain representations are made (e.g., the information is necessary to provide you with health care or the health and safety of others).

Times when we must share your information

There are times when we must share your PHI. When required, we must release it to:

  • You, or someone who has the legal right to act for you. This person is your personal representative. We do this to help manage your rights, as spelled out in this Notice.
  • The Department of Health and Human Services. We may do this to comply with the Health Insurance Portability and Accountability Act (HIPAA). They may collect this information to enforce HIPAA.
  • Other government authorities as required by applicable law.

When we may share your information with those involved in your care

We may share your PHI with people involved in your health care. We may also share with those involved in paying for your care. For example, if a family member or a caregiver calls us about a claim, we may tell them what stage it’s in. You have the right to stop or limit this kind of sharing (disclosure). To do so, just call the toll-free number on your member ID card.

If you’re a minor, you may have the right to block parental views of your health information in certain cases. But you can only do so if state law allows it. You can call us at the toll-free number on your ID card. Or have your provider talk to us.

We may use or share your PHI to notify or to help to notify a family member or any other person responsible for your care about your location, general condition or death. We may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.

When we need your okay to use or share your information

If we have not described a use or disclosure above, we will need you to say it’s okay in writing to use or disclose your PHI. For example, we will get your okay:

Even if you gave us your okay, you can withdraw it anytime. You just need to let us know in writing. If we haven’t already acted on it, we’ll stop using or sharing your information for that purpose. If you have questions about written permission, just call the toll-free number on your ID card.

PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

Additional Restrictions on Use and Disclosure

Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:

We will follow the law that is stricter (or more protective of your PHI), where it applies to

us. If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.

Substance Use Disorder Information

We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:

You or Aetna must also receive notice and a chance to be heard.

Your rights under the law

Under federal privacy laws, you have rights when it comes to your PHI. You have the right to:

  • Ask us to communicate with you how or where you choose. For example, if you’re covered as an adult dependent, you might want us to send health information, like your Explanation of Benefits, to another address than that of your subscriber. If it’s a reasonable request, we will make this happen.
  • Ask us to limit the way we use or share your information when it comes to health care operations, payment and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict sharing with people involved in your health care.
  • Ask us for a copy of PHI that’s part of a “designated record set”. This may include medical records. It may also include other records we keep and use for: Enrollment

Payment

Claims processing

Medical management

Other decisions

We may ask you to request this in writing. And we may charge a reasonable fee for making and mailing the copies. Sometimes, we may deny the request.

You may make any of the above requests (if they apply), ask for a paper copy of this Notice, or ask questions about this Notice. You can do this by calling the toll-free number on your member ID card.

You also have the right to file a complaint if you think someone has violated your privacy rights. To do so, just send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send a letter to:

Aetna HIPAA Member Rights Team P.O. Box 14079

Lexington, KY 40512-4079

Fax: 859-280-1272

You may stop the paper mailing of your EOB and other claim information by visiting Aetna.com. Choose “Log In/Register.” Follow the prompts to complete the one-time registration. Then you can log in anytime to view your EOBs and other claim information. You also may write to the Secretary of the U.S. Department of Health and Human Services. There are no penalties for filing a complaint.

How we keep your information safe

We use administrative, technical and physical safeguards to keep your information from unauthorized access, and other threats and hazards to its security and integrity. We comply with all state and federal laws that apply related to the security and confidentiality of your PHI.

We don’t destroy your PHI even when you end your coverage with us. We may need to use and share it even after your coverage terminates. (We describe the reasons for using or sharing in this Notice). We will continue to protect your information against inappropriate use or disclosure.

How we comply with the law

Federal privacy law requires us to keep your PHI private. And we must tell you about our legal duties and privacy practices. We must also follow the terms of the Notice in effect.

When this Notice may change

We may change the terms of this Notice and our privacy policies anytime. If we do, the new terms and policies will be effective for all the information we now have about you. And they’ll apply to any information that we may get or hold in the future.

If we make material or important changes to our privacy policies, we will promptly revise our Notice.

We will also post the revised Notice on our website, and if you are enrolled in an Aetna insurance plan at that time we will send you a new notice, as required.

You can ask for a copy of the revised Notice, just ask the Aetna Privacy Office at the email above.

Aetna is the brand name used for products and services provided by one or more of the Aetna group of companies, including Aetna Life Insurance Company and its affiliates (Aetna).