Uses and sharing described here do not need your authorization
Under the heading "How we use and share your information without your authorization", the notice says that in providing your health benefits Aetna may use and share PHI about you in varied ways, and gives examples. These are uses and sharing that the notice says it may do without asking for your written permission; the list is introduced with "For instance", so it is not the only set of uses.
Supporting quotations
How we use and share your information without your authorization
In providing your health benefits, we may use and share PHI about you in varied ways. For instance:
Qualifications & exceptions
The examples follow "For instance", so they illustrate rather than exhaust the uses.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Use & Processing · Permission or license
Health care operations: running the plan
Aetna may use and share your PHI for its health care operations, which the notice describes as actions it needs to take to run its health business. The first group listed is quality assessment and improvement, licensing, accreditation by independent organizations, performance measurement and outcomes assessment, health services planning and development activities, and preventive health, disease and case management, and care coordination. As an example, your PHI may be used to offer programs for certain conditions, such as diabetes, asthma or heart failure.
Supporting quotations
Health care operations: We may use and share your PHI for our health care operations.
Those are actions we need to do to run our health business, including:
Quality assessment and improvement
Licensing
Accreditation by independent organizations
Performance measurement and outcomes assessment
Health services planning and development activities
Preventive health, disease and case management, and care coordination
For example, we may use your PHI to offer programs for certain conditions, such as diabetes, asthma, or heart failure.
Qualifications & exceptions
The list says "including", so it is not the complete set of health care operations.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who receives PHI for accreditation or performance measurement, or how programs for specific conditions are offered to members.
Use & Processing · Permission or license
Other operations: underwriting, fraud, sale or merger, administration
The notice says PHI may also be used for other operations requiring use and disclosure, such as administering reinsurance and stop loss, underwriting and rating, investigating fraud, running pharmaceutical programs and payments, moving policies or contracts to and from other health plans, facilitating a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including related due diligence), and general administrative activities including data and information systems management and customer service.
Supporting quotations
We may also use it for other operations requiring use and disclosure, such as:
Administering reinsurance and stop loss
Underwriting and rating
Investigating fraud
Running pharmaceutical programs and payments
Moving policies or contracts from and to other health plans
Facilitating a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including related due diligence)
Performing other general administrative activities (including data and information systems management and customer service)
Qualifications & exceptions
The list is introduced with "such as", so it is illustrative.
Underwriting is limited elsewhere in the notice: the rights section says Aetna cannot use your genetic information to decide whether to issue you a policy or for other underwriting purposes.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who would receive PHI in a sale, transfer, merger or consolidation, or what protections apply to that recipient beyond what HIPAA requires.
Use & Processing · Permission or license
De-identified data may be used or shared for analytics and business planning
Among other operations, Aetna may create de-identified data, which the notice describes as data that no longer identifies you. The notice says Aetna may use or share de-identified data for analytics, business planning or other reasons.
Supporting quotations
Creating de-identified data (this is data that no longer identifies you. We may use it or share it for analytics, business planning or other reasons).
Qualifications & exceptions
The notice defines de-identified data only as data that "no longer identifies you".
Not stated here
The notice does not state the de-identification method, who may receive the data, or what "other reasons" covers.
Use & Processing · Permission or license
Payment: using and disclosing PHI to pay for covered services
Aetna may use and disclose PHI to help pay for your covered services, for example when doing utilization and medical necessity reviews, coordinating care, deciding eligibility, deciding drug list (formulary) compliance, getting premium payments from you, calculating cost-sharing amounts, and responding to complaints, appeals and requests for external reviews. The notice says it does this to make sure it pays for your care the right way, and may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be. During that process it may share information with your health care provider.
Supporting quotations
Payment: We may use and disclose PHI to help pay for your covered services when:
Doing utilization and medical necessity reviews
Coordinating care
Deciding eligibility
Deciding on drug list (formulary) compliance
Getting premium payments from you
Calculating cost-sharing amounts
Responding to complaints, appeals and requests for external reviews
We carry out these tasks to make sure we pay for your care the right way.
We may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be.
During this process, we may share information with your health care provider.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say how much of your health history is used in a medical-necessity decision.
Use & Processing · Permission or license
Treatment alternatives, reminders and health-related benefits
Aetna may use or share PHI about you to provide treatment alternatives, treatment reminders, or other health-related benefits and services.
Supporting quotations
Additional Reasons for Use and Disclosure without Your Authorization
We may use or share PHI about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who delivers these reminders or services or whether third parties receive PHI to do so.
Use & Processing · Company commitment
Substance use disorder information received under 42 CFR Part 2 consent
Aetna says it is not a substance use disorder treatment program but may receive or keep information about you that comes from one. If a substance use disorder program gives Aetna this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment and health care operations, Aetna will use or share it in accordance with both the consent and HIPAA. In limited situations where it may disclose this information without your permission, such as medical emergencies and government audits, Aetna will follow the law that is more protective of your information.
Supporting quotations
Substance Use Disorder Information
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program.
If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA.
In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information.
Qualifications & exceptions
The examples of disclosures without permission (medical emergencies, government audits) are introduced with "such as".
Not stated here
The notice does not describe what a consent for future uses and disclosures covers beyond treatment, payment and health care operations, or how to revoke it.