Who "Aetna" is here: one affiliated group that shares PHI
The notice describes the privacy practices of Aetna Life Insurance Company. In the notice, "Aetna", "we", "us" and "our" mean all the HMO and licensed insurer subsidiaries of Aetna Inc., which are designated a single affiliated covered entity (the "Aetna ACE") for federal privacy purposes. Members of that group can share Protected Health Information (PHI) with each other for the treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice. A full list of group members is available by contacting the Aetna Privacy Office at PrivacyAetna@aetna.com.
Supporting quotations
This Notice of Privacy Practices (Notice) describes the privacy practices of Aetna Life Insurance Company.
For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc.
These entities have been designated as a single affiliated covered entity for federal privacy purposes.
The members of the Aetna ACE can share Protected Health Information (PHI) with each other.
We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice.
For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
Qualifications & exceptions
Sharing within the group is described as for treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice.
Not stated here
The list of Aetna ACE members is not in the document; it is available only on request from the Aetna Privacy Office.
The notice does not say which member of the group is the insurer for any particular plan or member.
Sharing & Disclosure · Company practice
Explanation of Benefits mail and claims-status access reach the subscriber and dependents
Aetna may mail Explanation of Benefits forms and other information to the address it has on file for the subscriber (the primary insured). It also makes claims information available on its secure member website and telephone claims status sites to the subscriber and all covered dependents. PHI is also used to get payment for mail-order pharmacy services you get.
Supporting quotations
We may also mail Explanation of Benefits forms and other information to the address we have on file for the subscriber (i.e., the primary insured).
We also make claims information on our secure member website and telephonic claims status sites available to the subscriber and all covered dependents.
We also use PHI to get payment for any mail-order pharmacy services you get.
Qualifications & exceptions
The rights section lets you ask Aetna to communicate with you at a different address, and the notice says paper mailing of EOBs can be stopped by registering on Aetna.com.
Not stated here
The notice does not say whether each covered dependent can see claims information about other members of the plan.
Sharing & Disclosure · Permission or license
Treatment: sharing PHI with your providers and offering mail-order pharmacy
Aetna may share your PHI with the health care providers who take care of you, like doctors, dentists, pharmacies and hospitals, and the notice says doctors may sometimes ask Aetna for your medical information to put in their own records. Aetna may also use your information to offer you mail-order pharmacy services, and may share certain information for patient safety or other reasons linked to your treatment.
Supporting quotations
We may share your PHI with the health care providers who take care of you like your doctors, dentists, pharmacies and hospitals.
Sometimes doctors may ask for your medical information from us to put in their own records.
We may also use your information to offer you mail-order pharmacy services.
And we may also share certain information for patient safety or other reasons linked to your treatment.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say which information is "certain information" shared for patient safety, or what other reasons are "linked to your treatment".
Sharing & Disclosure · Permission or license
Sharing with other covered entities and their business associates
Aetna may share your PHI with other covered entities or their business associates for treatment, payment, or certain health care operations. As an example, if you get your health benefits through an employer, Aetna may share your PHI with other health plans your employer offers so that claims are paid the right way.
Supporting quotations
We may share your PHI with other covered entities or their business associates.
This may be for treatment, payment, or for certain health care operations.
For example, you may get your health benefits through an employer. If so, we may share your PHI with other health plans your employer offers. We do this to make sure we pay your claims the right way.
Qualifications & exceptions
The employer-plan sentence is an example, introduced with "For example", of this sharing.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
"Certain health care operations" is not defined, and the notice does not list which other covered entities or business associates may receive PHI.
Sharing & Disclosure · Permission or license
Further disclosures that need no authorization, by category
The notice says Aetna also may use or share your PHI without your authorization in support of the purposes it lists next: group plan administration, research, business associates, health oversight, workers' compensation, law enforcement, legal proceedings, public welfare matters, as required by law, decedents, organ procurement, reports of abuse, neglect or domestic violence, and specialized government functions, military and correctional institutions. Each category has its own conditions, which are described in the cards that follow.
Supporting quotations
We also may use or share your PHI without your authorization in support of:
Qualifications & exceptions
Each listed category has its own stated conditions or limits.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice describes categories, not individual recipients; the actual recipients in a given case are not named.
Sharing & Disclosure · Permission or license
Group plan administration: PHI to your employer under stated conditions
For group plans, Aetna may share PHI with your employer, as applicable, when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Supporting quotations
Plan Administration (Group Plans) – to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Qualifications & exceptions
Applies to group plans and only "as applicable".
Two alternative conditions are stated: informed plan-document language, or summary data for bidding or amending the plan.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say what "appropriate language" is or what "summary data" contains.
Sharing & Disclosure · Permission or license
Research: PHI to researchers with privacy protections
Aetna may share PHI with researchers, provided measures are taken to protect your privacy.
Supporting quotations
Research – to researchers, provided measures are taken to protect your privacy.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say what the privacy measures are, who decides they are adequate, or whether any research disclosure needs your permission.
Sharing & Disclosure · Permission or license
Business associates: PHI to service providers who promise to protect it
Aetna may share PHI with persons who provide services to it and who assure Aetna that they will protect the information.
Supporting quotations
Business Associates – to persons who provide services to us and assure us they will protect the information.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not name or categorize the service providers, or say how the assurance is given or checked.
Sharing & Disclosure · Permission or license
Health oversight agencies
Aetna may share PHI with health oversight agencies, such as agencies that oversee the health care system and government benefit programs, for oversight activities authorized by law, such as investigations, audits, and licensure or disciplinary actions.
Supporting quotations
Health Oversight – to health oversight agencies (e.g., agencies that oversee the healthcare system and government benefit programs) for purposes of oversight activities authorized by law (e.g., investigations, audits, and licensure or disciplinary actions).
Qualifications & exceptions
Limited to oversight activities authorized by law; the examples are introduced with "e.g.".
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
Public welfare matters such as public health and child abuse
Aetna may share PHI to address matters of public interest as required or permitted by law, such as child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, and product recalls.
Supporting quotations
Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, product recalls).
Qualifications & exceptions
The examples are introduced with "e.g." and are not the complete set of public-interest matters.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
Decedents and organ donation
Aetna may share PHI with a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and with funeral directors as necessary to carry out their duties. It may also share PHI with organ donation groups to facilitate donation and transplantation.
Supporting quotations
Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Qualifications & exceptions
Funeral director disclosures are limited to what is necessary to carry out their duties.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
Reports of abuse, neglect or domestic violence, with notice to you
If Aetna believes you are a victim of abuse, neglect or domestic violence, it may share PHI with government authorities, including social service or protective service agencies, that are authorized to receive such reports. Aetna says it will inform you of such a disclosure unless doing so would place you at risk of serious harm or would not be in your best interests.
Supporting quotations
Abuse, Neglect, or Domestic Violence – to government authorities, including social service or protective service agencies, authorized to receive such reports, if we believe that you are a victim of abuse, neglect, or domestic violence. We will inform you of such a disclosure, unless doing so would place you at risk of serious harm or not be in your best interests.
Qualifications & exceptions
The disclosure depends on Aetna's belief that you are a victim.
You are told about the disclosure unless it would place you at risk of serious harm or is not in your best interests.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
National security, military and correctional institutions
Aetna may share PHI with authorized government officials for national security and intelligence activities, protective services for the President, and medical suitability determinations. For members of the U.S. armed forces or the foreign military, it may disclose PHI for activities deemed necessary by appropriate command authorities or under the law. If you are in the custody of a correctional institution or a law enforcement official, Aetna may disclose your PHI to them if certain representations are made, for example that the information is necessary to provide you with health care or for the health and safety of others.
Supporting quotations
Specialized Government Functions, Military, and Correctional Institutions –
to authorized government officials for purposes of national security and intelligence activities, protective services for the President, and medical suitability determinations. If you are a member of the U.S. armed forces or the foreign military, we may disclose your PHI for activities deemed necessary by appropriate command authorities or under the law. If you are under the custody of a correctional institution or a law enforcement official, we may disclose your PHI to such parties if certain representations are made (e.g., the information is necessary to provide you with health care or the health and safety of others).
Qualifications & exceptions
Custody disclosures depend on "certain representations" being made; the examples are introduced with "e.g.".
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who makes the representations or how Aetna checks them.
Sharing & Disclosure · Company practice
Times when Aetna must share your PHI
The notice says there are times when Aetna must share your PHI. When required, it must release it to you or to someone who has the legal right to act for you (your personal representative); to the Department of Health and Human Services, which may collect this information to enforce HIPAA; and to other government authorities as required by applicable law.
Supporting quotations
There are times when we must share your PHI. When required, we must release it to:
You, or someone who has the legal right to act for you. This person is your personal representative. We do this to help manage your rights, as spelled out in this Notice.
The Department of Health and Human Services. We may do this to comply with the Health Insurance Portability and Accountability Act (HIPAA). They may collect this information to enforce HIPAA.
Other government authorities as required by applicable law.
Qualifications & exceptions
The Health and Human Services item says Aetna "may" do this to comply with HIPAA, while the lead sentence says "must"; the lead sentence limits all three to times when sharing is required.
Sharing & Disclosure · Permission or license
Sharing with people involved in your care or its payment
Aetna may share your PHI with people involved in your health care, and with those involved in paying for your care. For example, if a family member or a caregiver calls about a claim, Aetna may tell them what stage it is in.
Supporting quotations
When we may share your information with those involved in your care
We may share your PHI with people involved in your health care.
We may also share with those involved in paying for your care.
For example, if a family member or a caregiver calls us about a claim, we may tell them what stage it’s in.
Qualifications & exceptions
You can stop or limit this sharing; see the right to stop or limit it.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say whether Aetna checks that a caller is involved in your care before telling them a claim's status.
Sharing & Disclosure · User right or choice
You can stop or limit sharing with people involved in your care
You have the right to stop or limit sharing of your PHI with people involved in your care or its payment. To do so, you call the toll-free number on your member ID card.
Supporting quotations
You have the right to stop or limit this kind of sharing (disclosure).
To do so, just call the toll-free number on your member ID card.
Qualifications & exceptions
The rights section describes this as asking Aetna to restrict sharing with people involved in your health care, and says requests to limit uses and sharing for treatment, payment and operations are considered but may not be agreed to.
Not stated here
The notice does not say whether Aetna must honor a request to stop or limit this sharing, or how quickly it takes effect.
Cross-references
contrast (model-proposed): Right to ask for limits on use and sharing — contrast: One passage says you have the right to stop or limit sharing with people involved in your care by calling; the rights section describes asking Aetna to restrict that sharing and says Aetna will consider but may not agree to requests to limit uses. The notice does not say whether Aetna must honor a request to restrict sharing with people involved in care.
Sharing & Disclosure · User right or choice
Minors may be able to block parental views, if state law allows
If you are a minor, you may have the right to block parental views of your health information in certain cases, but only if state law allows it. You can call the toll-free number on your ID card, or have your provider talk to Aetna.
Supporting quotations
If you’re a minor, you may have the right to block parental views of your health information in certain cases. But you can only do so if state law allows it. You can call us at the toll-free number on your ID card. Or have your provider talk to us.
Qualifications & exceptions
The right exists only "in certain cases" and only if state law allows it.
Not stated here
The notice does not say which states allow this or which cases qualify.
Sharing & Disclosure · Permission or license
Notifying family or disaster relief groups about location, condition or death
Aetna may use or share your PHI to notify, or to help notify, a family member or any other person responsible for your care about your location, general condition or death. It may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.
Supporting quotations
We may use or share your PHI to notify or to help to notify a family member or any other person responsible for your care about your location, general condition or death. We may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · User right or choice
When Aetna needs your written okay
If Aetna has not described a use or disclosure in the notice above, it needs you to say in writing that it is okay to use or disclose your PHI. Examples where it will get your okay are marketing purposes unrelated to your benefit plan(s), before sharing any psychotherapy notes, when linked to the sale of your PHI, and for other reasons as required by law.
Supporting quotations
When we need your okay to use or share your information
If we have not described a use or disclosure above, we will need you to say it’s okay in writing to use or disclose your PHI. For example, we will get your okay:
For marketing purposes unrelated to your benefit plan(s)
Before sharing any psychotherapy notes
When linked to the sale of your PHI
For other reasons as required by law
Qualifications & exceptions
The requirement applies to uses and disclosures the notice has not described; the examples are introduced with "For example" and are not the complete set.
Marketing needs your okay only when it is unrelated to your benefit plan(s); the notice separately describes treatment alternatives and health-related benefits as uses without authorization.
Not stated here
The notice does not say what counts as marketing that is related to your benefit plan.
Sharing & Disclosure · User right or choice
You can withdraw your okay in writing at any time
Even if you gave your okay, you can withdraw it at any time by letting Aetna know in writing. If Aetna has not already acted on it, it will stop using or sharing your information for that purpose. For questions about written permission, you can call the toll-free number on your ID card.
Supporting quotations
Even if you gave us your okay, you can withdraw it anytime. You just need to let us know in writing. If we haven’t already acted on it, we’ll stop using or sharing your information for that purpose. If you have questions about written permission, just call the toll-free number on your ID card.
Qualifications & exceptions
Withdrawal must be in writing and does not undo uses or disclosures Aetna has already acted on.
Cross-references
qualifies (model-proposed): When Aetna needs your written okay — qualifies: An authorization given for an otherwise undescribed use can be withdrawn in writing, but Aetna stops only for what it has not already acted on.
Sharing & Disclosure · Restriction or exception
Recipients may pass PHI on and HIPAA may no longer protect it
The notice says that PHI disclosed as permitted by HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA.
Supporting quotations
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
Qualifications & exceptions
Applies to PHI disclosed as permitted by HIPAA.
Not stated here
The notice does not say what other protections, if any, apply once a recipient passes the information on.