What this notice is for and how to get it in Spanish
The notice says it describes how medical information about you may be used and disclosed and how you can get access to that information, and it asks you to review it carefully. To get the notice in Spanish, you call the toll-free number on your member ID card.
Supporting quotations
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
To receive this Notice in Spanish, please call the toll-free number on your member ID card.
Qualifications & exceptions
The Spanish copy is obtained by calling the toll-free number on your member ID card (the Spanish line in the source is only the instruction to call).
Not stated here
The Spanish-language version of the notice is not part of the text supplied, so this analysis cannot say whether it matches the English text.
Sharing & Disclosure · Company practice
Who "Aetna" is here: one affiliated group that shares PHI
The notice describes the privacy practices of Aetna Life Insurance Company. In the notice, "Aetna", "we", "us" and "our" mean all the HMO and licensed insurer subsidiaries of Aetna Inc., which are designated a single affiliated covered entity (the "Aetna ACE") for federal privacy purposes. Members of that group can share Protected Health Information (PHI) with each other for the treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice. A full list of group members is available by contacting the Aetna Privacy Office at PrivacyAetna@aetna.com.
Supporting quotations
This Notice of Privacy Practices (Notice) describes the privacy practices of Aetna Life Insurance Company.
For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc.
These entities have been designated as a single affiliated covered entity for federal privacy purposes.
The members of the Aetna ACE can share Protected Health Information (PHI) with each other.
We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice.
For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
Qualifications & exceptions
Sharing within the group is described as for treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice.
Not stated here
The list of Aetna ACE members is not in the document; it is available only on request from the Aetna Privacy Office.
The notice does not say which member of the group is the insurer for any particular plan or member.
Legal Rights & Agreement Rules · Restriction or exception
Covers Aetna insured plans, not employer self-funded plans
The notice is for Aetna insured health benefit plans. It does not apply to plans that an employer self-funds. If you have coverage through work, you are told to ask your employer whether your plan is insured or self-funded, and if it is self-funded to ask for a copy of your employer's own privacy notice.
Supporting quotations
This Notice of Privacy Practices is for Aetna insured health benefit plans.
It does not apply to any plans that are self-funded by an employer.
If you have coverage where you work, ask your employer if your plan is insured or self-funded.
If it’s self-funded, ask for a copy of your employer’s Privacy Notice.
Qualifications & exceptions
The reader has to find out from their employer whether their plan is insured or self-funded; the notice does not tell them.
Not stated here
The notice text does not name the plan types it covers beyond "insured health benefit plans", so whether a given dental, pharmacy, behavioral health or vision plan is insured must be confirmed outside this document.
An employer's own privacy notice for a self-funded plan is not supplied.
Legal Rights & Agreement Rules · Context
Effective date: October 1, 2025
The notice states that it took effect on October 1, 2025.
Supporting quotations
Effective date: This Notice took effect on October 1, 2025.
Not stated here
A form code near the end of the contents list reads "GR-67806 (2-26)"; the notice does not explain it, so no later revision date is assumed.
Data Access & Collection · Company practice
Where Aetna gets information about you
Aetna gets information about you from many sources, including from you. It can also get it from your employer or benefits plan sponsor (if applicable), other insurers, HMOs or third-party administrators, and health care providers such as doctors.
Supporting quotations
We get information about you from many sources, including from you.
But we also can get it from your employer or benefits plan sponsor (if applicable), other insurers, HMOs or third-party administrators, and health care providers such as doctors.
Qualifications & exceptions
An employer or benefits plan sponsor is a source only "if applicable".
The sources named are examples of "many sources"; the list is not stated to be complete.
Data Access & Collection · Context
What counts as Protected Health Information
The notice calls the information it collects Protected Health Information (PHI). It includes personal information that may identify you and is not public, and information about your health, medical conditions, prescriptions, and payment for health care products or services. The notice says PHI may include demographic data (such as name or address), health details (such as medical history), test results (such as a lab test), insurance information (such as your member ID), and other information used to identify you or linked to your health care or health care coverage.
Supporting quotations
This is called Protected Health Information (PHI).
It includes personal information that may identify you that is not public information.
And it includes information about your health, medical conditions, prescriptions, and payment for health care products or services.
Demographic data (like your name or address)
Health details (like a medical history)
Test results (like a lab test)
Insurance information (like your member ID)
Other information used to identify you or that’s linked to your health care or health care coverage
Qualifications & exceptions
The list of examples is introduced with "It may include", so it is illustrative; the last item is a catch-all for other information used to identify you or linked to your health care or coverage.
Use & Processing · Permission or license
Uses and sharing described here do not need your authorization
Under the heading "How we use and share your information without your authorization", the notice says that in providing your health benefits Aetna may use and share PHI about you in varied ways, and gives examples. These are uses and sharing that the notice says it may do without asking for your written permission; the list is introduced with "For instance", so it is not the only set of uses.
Supporting quotations
How we use and share your information without your authorization
In providing your health benefits, we may use and share PHI about you in varied ways. For instance:
Qualifications & exceptions
The examples follow "For instance", so they illustrate rather than exhaust the uses.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Use & Processing · Permission or license
Health care operations: running the plan
Aetna may use and share your PHI for its health care operations, which the notice describes as actions it needs to take to run its health business. The first group listed is quality assessment and improvement, licensing, accreditation by independent organizations, performance measurement and outcomes assessment, health services planning and development activities, and preventive health, disease and case management, and care coordination. As an example, your PHI may be used to offer programs for certain conditions, such as diabetes, asthma or heart failure.
Supporting quotations
Health care operations: We may use and share your PHI for our health care operations.
Those are actions we need to do to run our health business, including:
Quality assessment and improvement
Licensing
Accreditation by independent organizations
Performance measurement and outcomes assessment
Health services planning and development activities
Preventive health, disease and case management, and care coordination
For example, we may use your PHI to offer programs for certain conditions, such as diabetes, asthma, or heart failure.
Qualifications & exceptions
The list says "including", so it is not the complete set of health care operations.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who receives PHI for accreditation or performance measurement, or how programs for specific conditions are offered to members.
Use & Processing · Permission or license
Other operations: underwriting, fraud, sale or merger, administration
The notice says PHI may also be used for other operations requiring use and disclosure, such as administering reinsurance and stop loss, underwriting and rating, investigating fraud, running pharmaceutical programs and payments, moving policies or contracts to and from other health plans, facilitating a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including related due diligence), and general administrative activities including data and information systems management and customer service.
Supporting quotations
We may also use it for other operations requiring use and disclosure, such as:
Administering reinsurance and stop loss
Underwriting and rating
Investigating fraud
Running pharmaceutical programs and payments
Moving policies or contracts from and to other health plans
Facilitating a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including related due diligence)
Performing other general administrative activities (including data and information systems management and customer service)
Qualifications & exceptions
The list is introduced with "such as", so it is illustrative.
Underwriting is limited elsewhere in the notice: the rights section says Aetna cannot use your genetic information to decide whether to issue you a policy or for other underwriting purposes.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who would receive PHI in a sale, transfer, merger or consolidation, or what protections apply to that recipient beyond what HIPAA requires.
Use & Processing · Permission or license
De-identified data may be used or shared for analytics and business planning
Among other operations, Aetna may create de-identified data, which the notice describes as data that no longer identifies you. The notice says Aetna may use or share de-identified data for analytics, business planning or other reasons.
Supporting quotations
Creating de-identified data (this is data that no longer identifies you. We may use it or share it for analytics, business planning or other reasons).
Qualifications & exceptions
The notice defines de-identified data only as data that "no longer identifies you".
Not stated here
The notice does not state the de-identification method, who may receive the data, or what "other reasons" covers.
Use & Processing · Permission or license
Payment: using and disclosing PHI to pay for covered services
Aetna may use and disclose PHI to help pay for your covered services, for example when doing utilization and medical necessity reviews, coordinating care, deciding eligibility, deciding drug list (formulary) compliance, getting premium payments from you, calculating cost-sharing amounts, and responding to complaints, appeals and requests for external reviews. The notice says it does this to make sure it pays for your care the right way, and may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be. During that process it may share information with your health care provider.
Supporting quotations
Payment: We may use and disclose PHI to help pay for your covered services when:
Doing utilization and medical necessity reviews
Coordinating care
Deciding eligibility
Deciding on drug list (formulary) compliance
Getting premium payments from you
Calculating cost-sharing amounts
Responding to complaints, appeals and requests for external reviews
We carry out these tasks to make sure we pay for your care the right way.
We may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be.
During this process, we may share information with your health care provider.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say how much of your health history is used in a medical-necessity decision.
Sharing & Disclosure · Company practice
Explanation of Benefits mail and claims-status access reach the subscriber and dependents
Aetna may mail Explanation of Benefits forms and other information to the address it has on file for the subscriber (the primary insured). It also makes claims information available on its secure member website and telephone claims status sites to the subscriber and all covered dependents. PHI is also used to get payment for mail-order pharmacy services you get.
Supporting quotations
We may also mail Explanation of Benefits forms and other information to the address we have on file for the subscriber (i.e., the primary insured).
We also make claims information on our secure member website and telephonic claims status sites available to the subscriber and all covered dependents.
We also use PHI to get payment for any mail-order pharmacy services you get.
Qualifications & exceptions
The rights section lets you ask Aetna to communicate with you at a different address, and the notice says paper mailing of EOBs can be stopped by registering on Aetna.com.
Not stated here
The notice does not say whether each covered dependent can see claims information about other members of the plan.
Sharing & Disclosure · Permission or license
Treatment: sharing PHI with your providers and offering mail-order pharmacy
Aetna may share your PHI with the health care providers who take care of you, like doctors, dentists, pharmacies and hospitals, and the notice says doctors may sometimes ask Aetna for your medical information to put in their own records. Aetna may also use your information to offer you mail-order pharmacy services, and may share certain information for patient safety or other reasons linked to your treatment.
Supporting quotations
We may share your PHI with the health care providers who take care of you like your doctors, dentists, pharmacies and hospitals.
Sometimes doctors may ask for your medical information from us to put in their own records.
We may also use your information to offer you mail-order pharmacy services.
And we may also share certain information for patient safety or other reasons linked to your treatment.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say which information is "certain information" shared for patient safety, or what other reasons are "linked to your treatment".
Sharing & Disclosure · Permission or license
Sharing with other covered entities and their business associates
Aetna may share your PHI with other covered entities or their business associates for treatment, payment, or certain health care operations. As an example, if you get your health benefits through an employer, Aetna may share your PHI with other health plans your employer offers so that claims are paid the right way.
Supporting quotations
We may share your PHI with other covered entities or their business associates.
This may be for treatment, payment, or for certain health care operations.
For example, you may get your health benefits through an employer. If so, we may share your PHI with other health plans your employer offers. We do this to make sure we pay your claims the right way.
Qualifications & exceptions
The employer-plan sentence is an example, introduced with "For example", of this sharing.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
"Certain health care operations" is not defined, and the notice does not list which other covered entities or business associates may receive PHI.
Use & Processing · Permission or license
Treatment alternatives, reminders and health-related benefits
Aetna may use or share PHI about you to provide treatment alternatives, treatment reminders, or other health-related benefits and services.
Supporting quotations
Additional Reasons for Use and Disclosure without Your Authorization
We may use or share PHI about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who delivers these reminders or services or whether third parties receive PHI to do so.
Sharing & Disclosure · Permission or license
Further disclosures that need no authorization, by category
The notice says Aetna also may use or share your PHI without your authorization in support of the purposes it lists next: group plan administration, research, business associates, health oversight, workers' compensation, law enforcement, legal proceedings, public welfare matters, as required by law, decedents, organ procurement, reports of abuse, neglect or domestic violence, and specialized government functions, military and correctional institutions. Each category has its own conditions, which are described in the cards that follow.
Supporting quotations
We also may use or share your PHI without your authorization in support of:
Qualifications & exceptions
Each listed category has its own stated conditions or limits.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice describes categories, not individual recipients; the actual recipients in a given case are not named.
Sharing & Disclosure · Permission or license
Group plan administration: PHI to your employer under stated conditions
For group plans, Aetna may share PHI with your employer, as applicable, when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Supporting quotations
Plan Administration (Group Plans) – to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Qualifications & exceptions
Applies to group plans and only "as applicable".
Two alternative conditions are stated: informed plan-document language, or summary data for bidding or amending the plan.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say what "appropriate language" is or what "summary data" contains.
Sharing & Disclosure · Permission or license
Research: PHI to researchers with privacy protections
Aetna may share PHI with researchers, provided measures are taken to protect your privacy.
Supporting quotations
Research – to researchers, provided measures are taken to protect your privacy.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say what the privacy measures are, who decides they are adequate, or whether any research disclosure needs your permission.
Sharing & Disclosure · Permission or license
Business associates: PHI to service providers who promise to protect it
Aetna may share PHI with persons who provide services to it and who assure Aetna that they will protect the information.
Supporting quotations
Business Associates – to persons who provide services to us and assure us they will protect the information.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not name or categorize the service providers, or say how the assurance is given or checked.
Sharing & Disclosure · Permission or license
Health oversight agencies
Aetna may share PHI with health oversight agencies, such as agencies that oversee the health care system and government benefit programs, for oversight activities authorized by law, such as investigations, audits, and licensure or disciplinary actions.
Supporting quotations
Health Oversight – to health oversight agencies (e.g., agencies that oversee the healthcare system and government benefit programs) for purposes of oversight activities authorized by law (e.g., investigations, audits, and licensure or disciplinary actions).
Qualifications & exceptions
Limited to oversight activities authorized by law; the examples are introduced with "e.g.".
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Legal Rights & Agreement Rules · Permission or license
Workers' compensation, law enforcement, legal proceedings and legal requirements
Aetna may share PHI to comply with workers' compensation laws; with government law enforcement officials as permitted or required by law; in response to a court order or other lawful process; and to comply with legal obligations and requirements.
Supporting quotations
Workers’ Compensation – to comply with workers’ compensation laws.
Law Enforcement – to Government law enforcement officials as permitted or required by law.
Legal Proceedings – in response to a court order or other lawful process.
As Required by Law – to comply with legal obligations and requirements.
Qualifications & exceptions
Law enforcement disclosures are tied to what the law permits or requires, and legal-proceeding disclosures to a court order or other lawful process.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not list which laws or processes qualify, or say whether you are told about these disclosures.
Sharing & Disclosure · Permission or license
Public welfare matters such as public health and child abuse
Aetna may share PHI to address matters of public interest as required or permitted by law, such as child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, and product recalls.
Supporting quotations
Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, product recalls).
Qualifications & exceptions
The examples are introduced with "e.g." and are not the complete set of public-interest matters.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
Decedents and organ donation
Aetna may share PHI with a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and with funeral directors as necessary to carry out their duties. It may also share PHI with organ donation groups to facilitate donation and transplantation.
Supporting quotations
Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Qualifications & exceptions
Funeral director disclosures are limited to what is necessary to carry out their duties.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
Reports of abuse, neglect or domestic violence, with notice to you
If Aetna believes you are a victim of abuse, neglect or domestic violence, it may share PHI with government authorities, including social service or protective service agencies, that are authorized to receive such reports. Aetna says it will inform you of such a disclosure unless doing so would place you at risk of serious harm or would not be in your best interests.
Supporting quotations
Abuse, Neglect, or Domestic Violence – to government authorities, including social service or protective service agencies, authorized to receive such reports, if we believe that you are a victim of abuse, neglect, or domestic violence. We will inform you of such a disclosure, unless doing so would place you at risk of serious harm or not be in your best interests.
Qualifications & exceptions
The disclosure depends on Aetna's belief that you are a victim.
You are told about the disclosure unless it would place you at risk of serious harm or is not in your best interests.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · Permission or license
National security, military and correctional institutions
Aetna may share PHI with authorized government officials for national security and intelligence activities, protective services for the President, and medical suitability determinations. For members of the U.S. armed forces or the foreign military, it may disclose PHI for activities deemed necessary by appropriate command authorities or under the law. If you are in the custody of a correctional institution or a law enforcement official, Aetna may disclose your PHI to them if certain representations are made, for example that the information is necessary to provide you with health care or for the health and safety of others.
Supporting quotations
Specialized Government Functions, Military, and Correctional Institutions –
to authorized government officials for purposes of national security and intelligence activities, protective services for the President, and medical suitability determinations. If you are a member of the U.S. armed forces or the foreign military, we may disclose your PHI for activities deemed necessary by appropriate command authorities or under the law. If you are under the custody of a correctional institution or a law enforcement official, we may disclose your PHI to such parties if certain representations are made (e.g., the information is necessary to provide you with health care or the health and safety of others).
Qualifications & exceptions
Custody disclosures depend on "certain representations" being made; the examples are introduced with "e.g.".
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say who makes the representations or how Aetna checks them.
Sharing & Disclosure · Company practice
Times when Aetna must share your PHI
The notice says there are times when Aetna must share your PHI. When required, it must release it to you or to someone who has the legal right to act for you (your personal representative); to the Department of Health and Human Services, which may collect this information to enforce HIPAA; and to other government authorities as required by applicable law.
Supporting quotations
There are times when we must share your PHI. When required, we must release it to:
You, or someone who has the legal right to act for you. This person is your personal representative. We do this to help manage your rights, as spelled out in this Notice.
The Department of Health and Human Services. We may do this to comply with the Health Insurance Portability and Accountability Act (HIPAA). They may collect this information to enforce HIPAA.
Other government authorities as required by applicable law.
Qualifications & exceptions
The Health and Human Services item says Aetna "may" do this to comply with HIPAA, while the lead sentence says "must"; the lead sentence limits all three to times when sharing is required.
Sharing & Disclosure · Permission or license
Sharing with people involved in your care or its payment
Aetna may share your PHI with people involved in your health care, and with those involved in paying for your care. For example, if a family member or a caregiver calls about a claim, Aetna may tell them what stage it is in.
Supporting quotations
When we may share your information with those involved in your care
We may share your PHI with people involved in your health care.
We may also share with those involved in paying for your care.
For example, if a family member or a caregiver calls us about a claim, we may tell them what stage it’s in.
Qualifications & exceptions
You can stop or limit this sharing; see the right to stop or limit it.
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Not stated here
The notice does not say whether Aetna checks that a caller is involved in your care before telling them a claim's status.
Sharing & Disclosure · User right or choice
You can stop or limit sharing with people involved in your care
You have the right to stop or limit sharing of your PHI with people involved in your care or its payment. To do so, you call the toll-free number on your member ID card.
Supporting quotations
You have the right to stop or limit this kind of sharing (disclosure).
To do so, just call the toll-free number on your member ID card.
Qualifications & exceptions
The rights section describes this as asking Aetna to restrict sharing with people involved in your health care, and says requests to limit uses and sharing for treatment, payment and operations are considered but may not be agreed to.
Not stated here
The notice does not say whether Aetna must honor a request to stop or limit this sharing, or how quickly it takes effect.
Cross-references
contrast (model-proposed): Right to ask for limits on use and sharing — contrast: One passage says you have the right to stop or limit sharing with people involved in your care by calling; the rights section describes asking Aetna to restrict that sharing and says Aetna will consider but may not agree to requests to limit uses. The notice does not say whether Aetna must honor a request to restrict sharing with people involved in care.
Sharing & Disclosure · User right or choice
Minors may be able to block parental views, if state law allows
If you are a minor, you may have the right to block parental views of your health information in certain cases, but only if state law allows it. You can call the toll-free number on your ID card, or have your provider talk to Aetna.
Supporting quotations
If you’re a minor, you may have the right to block parental views of your health information in certain cases. But you can only do so if state law allows it. You can call us at the toll-free number on your ID card. Or have your provider talk to us.
Qualifications & exceptions
The right exists only "in certain cases" and only if state law allows it.
Not stated here
The notice does not say which states allow this or which cases qualify.
Sharing & Disclosure · Permission or license
Notifying family or disaster relief groups about location, condition or death
Aetna may use or share your PHI to notify, or to help notify, a family member or any other person responsible for your care about your location, general condition or death. It may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.
Supporting quotations
We may use or share your PHI to notify or to help to notify a family member or any other person responsible for your care about your location, general condition or death. We may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.
Qualifications & exceptions
The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.
Sharing & Disclosure · User right or choice
When Aetna needs your written okay
If Aetna has not described a use or disclosure in the notice above, it needs you to say in writing that it is okay to use or disclose your PHI. Examples where it will get your okay are marketing purposes unrelated to your benefit plan(s), before sharing any psychotherapy notes, when linked to the sale of your PHI, and for other reasons as required by law.
Supporting quotations
When we need your okay to use or share your information
If we have not described a use or disclosure above, we will need you to say it’s okay in writing to use or disclose your PHI. For example, we will get your okay:
For marketing purposes unrelated to your benefit plan(s)
Before sharing any psychotherapy notes
When linked to the sale of your PHI
For other reasons as required by law
Qualifications & exceptions
The requirement applies to uses and disclosures the notice has not described; the examples are introduced with "For example" and are not the complete set.
Marketing needs your okay only when it is unrelated to your benefit plan(s); the notice separately describes treatment alternatives and health-related benefits as uses without authorization.
Not stated here
The notice does not say what counts as marketing that is related to your benefit plan.
Sharing & Disclosure · User right or choice
You can withdraw your okay in writing at any time
Even if you gave your okay, you can withdraw it at any time by letting Aetna know in writing. If Aetna has not already acted on it, it will stop using or sharing your information for that purpose. For questions about written permission, you can call the toll-free number on your ID card.
Supporting quotations
Even if you gave us your okay, you can withdraw it anytime. You just need to let us know in writing. If we haven’t already acted on it, we’ll stop using or sharing your information for that purpose. If you have questions about written permission, just call the toll-free number on your ID card.
Qualifications & exceptions
Withdrawal must be in writing and does not undo uses or disclosures Aetna has already acted on.
Cross-references
qualifies (model-proposed): When Aetna needs your written okay — qualifies: An authorization given for an otherwise undescribed use can be withdrawn in writing, but Aetna stops only for what it has not already acted on.
Sharing & Disclosure · Restriction or exception
Recipients may pass PHI on and HIPAA may no longer protect it
The notice says that PHI disclosed as permitted by HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA.
Supporting quotations
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
Qualifications & exceptions
Applies to PHI disclosed as permitted by HIPAA.
Not stated here
The notice does not say what other protections, if any, apply once a recipient passes the information on.
Legal Rights & Agreement Rules · Restriction or exception
Stricter laws for sensitive information; Aetna follows the stricter one
The notice says some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. The categories it lists are alcohol or substance use disorder, biometric information, child or adult abuse or neglect (including sexual assault), communicable diseases, genetic information, HIV/AIDS, mental health, minors, reproductive health, and sexually transmitted diseases. Aetna says it will follow the law that is stricter, or more protective of your PHI, where it applies to Aetna. For more information about these additional restrictions, contact the Aetna Privacy Office.
Supporting quotations
Additional Restrictions on Use and Disclosure
Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:
Alcohol or substance use disorder
Biometric Information
Child or adult abuse or neglect, including sexual assault
Communicable diseases
Genetic information
HIV/AIDs
Mental health
Minors
Reproductive health
Sexually transmitted diseases
We will follow the law that is stricter (or more protective of your PHI), where it applies to
If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.
Qualifications & exceptions
The laws are described as ones that "may" apply; the protections apply only where a law covers Aetna and the information.
The sentence about following the stricter law is split across two source blocks ("where it applies to" and "us"); the second block continues the same sentence.
Not stated here
The notice does not name the specific state or federal laws or say which jurisdictions' laws apply to a given member.
The notice does not say how the attestation requirement works.
Cross-references
qualifies (model-proposed): Further disclosures that need no authorization, by category — qualifies: Aetna says it follows the stricter or more protective law where it applies, which qualifies the further disclosures listed as allowed without authorization.
Use & Processing · Company commitment
Substance use disorder information received under 42 CFR Part 2 consent
Aetna says it is not a substance use disorder treatment program but may receive or keep information about you that comes from one. If a substance use disorder program gives Aetna this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment and health care operations, Aetna will use or share it in accordance with both the consent and HIPAA. In limited situations where it may disclose this information without your permission, such as medical emergencies and government audits, Aetna will follow the law that is more protective of your information.
Supporting quotations
Substance Use Disorder Information
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program.
If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA.
In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information.
Qualifications & exceptions
The examples of disclosures without permission (medical emergencies, government audits) are introduced with "such as".
Not stated here
The notice does not describe what a consent for future uses and disclosures covers beyond treatment, payment and health care operations, or how to revoke it.
Legal Rights & Agreement Rules · Restriction or exception
Substance use disorder information is not used in legal cases against you without consent or a court order
Aetna says it will not use or share substance use disorder program information in any legal case against you unless you give written consent, or a court orders Aetna with a subpoena or other legal requirement. The notice adds that you or Aetna must also receive notice and a chance to be heard.
Supporting quotations
We will not use or share this information in any legal case against you unless:
You give us written consent, or
A court orders us with a subpoena or other legal requirement.
You or Aetna must also receive notice and a chance to be heard.
Qualifications & exceptions
This limit applies to information that came from a substance use disorder program, and to use in a legal case "against you".
Not stated here
The notice does not say whether the notice-and-hearing requirement applies to both exceptions, or what "You or Aetna" means for who must be notified.
Cross-references
qualifies (model-proposed): Workers' compensation, law enforcement, legal proceedings and legal requirements — qualifies: The general legal-proceedings disclosure is narrowed for substance use disorder program information, which is not used in a legal case against you without your written consent or a court order, plus notice and a chance to be heard.
Account & Service Control · Context
Your rights over your PHI under federal privacy law
The notice says that under federal privacy laws you have rights when it comes to your PHI, and lists them. The sections that follow cover asking for communications in a way you choose, asking for limits on uses and sharing, getting a copy of your records, asking for corrections, getting a list of certain disclosures, being notified of a breach, and protections in insurance underwriting.
Supporting quotations
Your rights under the law
Under federal privacy laws, you have rights when it comes to your PHI. You have the right to:
Qualifications & exceptions
The rights are listed individually, each with its own conditions, in the following cards.
Account & Service Control · User right or choice
Right to ask for communications in the way or place you choose
You have the right to ask Aetna to communicate with you how or where you choose. For example, if you are covered as an adult dependent, you might ask Aetna to send health information, such as your Explanation of Benefits, to an address other than your subscriber's. If the request is reasonable, Aetna says it will make this happen.
Supporting quotations
Ask us to communicate with you how or where you choose.
For example, if you’re covered as an adult dependent, you might want us to send health information, like your Explanation of Benefits, to another address than that of your subscriber.
If it’s a reasonable request, we will make this happen.
Qualifications & exceptions
Aetna commits to honor only reasonable requests; the notice does not define "reasonable".
Not stated here
The notice does not say what makes a request unreasonable or whether it must be in writing.
You have the right to ask Aetna to limit how it uses or shares your information for health care operations, payment and treatment. Aetna says it will consider, but may not agree to, such requests. You also have the right to ask Aetna to restrict sharing with people involved in your health care.
Supporting quotations
Ask us to limit the way we use or share your information when it comes to health care operations, payment and treatment.
We will consider, but may not agree to, such requests.
You also have the right to ask us to restrict sharing with people involved in your health care.
Qualifications & exceptions
The "may not agree" sentence follows the request to limit operations, payment and treatment; the notice does not say whether it also applies to the request to restrict sharing with people involved in your care.
Not stated here
The notice does not say how Aetna decides these requests.
Account & Service Control · User right or choice
Right to a copy of PHI in your designated record set
You have the right to ask Aetna for a copy of PHI that is part of a "designated record set". This may include medical records and other records Aetna keeps and uses for enrollment, payment, claims processing, medical management and other decisions. Aetna may ask you to request this in writing and may charge a reasonable fee for making and mailing the copies. Sometimes Aetna may deny the request.
Supporting quotations
Ask us for a copy of PHI that’s part of a “designated record set”.
This may include medical records. It may also include other records we keep and use for: Enrollment
Payment
Claims processing
Medical management
Other decisions
We may ask you to request this in writing. And we may charge a reasonable fee for making and mailing the copies. Sometimes, we may deny the request.
Qualifications & exceptions
The list of record uses is split across source blocks after the words "records we keep and use for: Enrollment".
Aetna may ask for a written request and charge a reasonable fee, and may sometimes deny the request.
Not stated here
The notice does not give the fee amount, the response time, or the reasons a request may be denied.
Account & Service Control · User right or choice
Right to ask Aetna to fix your PHI
You have the right to ask Aetna to fix your PHI. You need to ask in writing and must include the reason for the request. If Aetna denies it, you may write to Aetna to let it know you disagree.
Supporting quotations
Ask us to fix your PHI. You need to ask this in writing. And you must include the reason for the request. If we deny it, you may write us, to let us know you disagree.
Qualifications & exceptions
The request must be in writing and include the reason.
Not stated here
The notice does not say how long Aetna has to respond, what happens after you write that you disagree, or whether your statement is kept with the record.
Account & Service Control · User right or choice
Right to a list of certain disclosures (an "accounting")
You have the right to ask Aetna for a list of certain disclosures it has made about you, such as PHI shared with government agencies that license it. The notice calls this an "accounting". You need to ask in writing. If you ask for this kind of list more than once in 12 months, Aetna may charge a reasonable fee.
Supporting quotations
Ask us to give you a list of certain disclosures we have made about you, such as PHI we’ve shared with government agencies that license us. (This is called an “accounting.”) You need to ask this in writing. If you ask for this kind of list more than once in 12 months, we may charge a reasonable fee.
Qualifications & exceptions
The list covers "certain" disclosures, not all of them.
A fee may apply to a request after the first in 12 months.
Not stated here
The notice does not say which disclosures appear on the list or how far back it goes.
Security & Safeguards · User right or choice
Right to be notified after a breach of your PHI
You have the right to be notified after a breach of your PHI.
Supporting quotations
Be notified after a breach of your PHI.
Not stated here
The notice does not say how soon or how you will be notified, or what counts as a breach.
Legal Rights & Agreement Rules · User right or choice
Right to know why a policy was denied; limits on past denials and genetic information
You have the right to know the reasons for denying an insurance policy or another unfavorable underwriting decision. The notice says that if you have been denied a policy in the past, Aetna cannot use that information in its decision process and must review the facts on its own. Aetna also says it cannot use your genetic information to decide whether to issue you a policy or for other underwriting purposes.
Supporting quotations
Know the reasons for denying an insurance policy or other unfavorable underwriting decision.
If you’ve been denied a policy in the past, we can’t use that information in our decision process. We must review the facts on our own.
Also, we can’t use your genetic information to decide if we should issue you a policy or for other underwriting purposes.
Qualifications & exceptions
The notice's operations list includes "Underwriting and rating"; this right limits that use for past denials and genetic information.
Not stated here
The notice does not say how you ask for the reasons or what form they take.
Cross-references
qualifies (model-proposed): Other operations: underwriting, fraud, sale or merger, administration — qualifies: The operations list includes underwriting and rating; the rights section says Aetna cannot use your genetic information to decide whether to issue a policy or for other underwriting purposes.
Legal Rights & Agreement Rules · Restriction or exception
Insurers are not allowed to take part in pretext interviews, with exceptions
The notice says insurers are not allowed to take part in pretext interviews, except in some cases, such as suspected fraud or criminal activity. It then says "We don't take part in these."
Supporting quotations
Insurers aren’t allowed to take part in pretext interviews, except in some cases, such as suspected fraud or criminal activity. We don’t take part in these.
Qualifications & exceptions
The prohibition is stated for insurers generally, with exceptions such as suspected fraud or criminal activity.
Not stated here
"These" in the last sentence could mean pretext interviews generally or only the excepted cases, so the notice is unclear on whether Aetna takes part when an exception applies. The notice does not define "pretext interview".
Account & Service Control · Procedure
How to make requests: call the toll-free number on your member ID card
You may make any of the requests above (if they apply), ask for a paper copy of this notice, or ask questions about this notice by calling the toll-free number on your member ID card.
Supporting quotations
You may make any of the above requests (if they apply), ask for a paper copy of this Notice, or ask questions about this Notice. You can do this by calling the toll-free number on your member ID card.
Qualifications & exceptions
The requests are available only "if they apply".
The request to correct PHI, the request for an accounting of disclosures and the withdrawal of an authorization are each described as requiring writing, and a copy of PHI may require a written request.
Not stated here
The notice does not say how a phone call satisfies the written-request requirements described for several rights.
Cross-references
contrast (model-proposed): Right to ask Aetna to fix your PHI — contrast: The notice says rights requests can be made by calling the toll-free number on the member ID card, while the right to ask for corrections is described as one you need to ask for in writing. The notice does not reconcile the two.
Legal Rights & Agreement Rules · User right or choice
Right to file a complaint, with Aetna or the federal government
You have the right to file a complaint if you think someone has violated your privacy rights. You can do so by emailing the Aetna Privacy Office at PrivacyAetna@aetna.com or sending a letter to the Aetna HIPAA Member Rights Team, P.O. Box 14079, Lexington, KY 40512-4079; the notice also lists a fax number, 859-280-1272. You also may write to the Secretary of the U.S. Department of Health and Human Services. The notice says there are no penalties for filing a complaint.
Supporting quotations
You also have the right to file a complaint if you think someone has violated your privacy rights. To do so, just send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send a letter to:
Aetna HIPAA Member Rights Team P.O. Box 14079
Lexington, KY 40512-4079
Fax: 859-280-1272
You also may write to the Secretary of the U.S. Department of Health and Human Services.
There are no penalties for filing a complaint.
Qualifications & exceptions
The complaint right is stated for a belief that "someone" violated your privacy rights.
Not stated here
The fax number appears under the "send a letter to" address block without saying whether complaints may be faxed.
The notice gives no address for the Secretary of Health and Human Services.
Account & Service Control · Procedure
Stop the paper mailing of EOBs by registering on Aetna.com
You may stop the paper mailing of your EOB and other claim information by visiting Aetna.com, choosing "Log In/Register", and completing the one-time registration. You can then log in at any time to view your EOBs and other claim information.
Supporting quotations
You may stop the paper mailing of your EOB and other claim information by visiting Aetna.com.
Choose “Log In/Register.” Follow the prompts to complete the one-time registration. Then you can log in anytime to view your EOBs and other claim information.
Qualifications & exceptions
Stopping paper mail requires creating an Aetna.com account through the one-time registration.
Not stated here
The notice does not say whether stopping paper mail also changes where other claim information is sent.
Aetna says it uses administrative, technical and physical safeguards to keep your information from unauthorized access and other threats and hazards to its security and integrity. It says it complies with all state and federal laws that apply to the security and confidentiality of your PHI.
Supporting quotations
How we keep your information safe
We use administrative, technical and physical safeguards to keep your information from unauthorized access, and other threats and hazards to its security and integrity. We comply with all state and federal laws that apply related to the security and confidentiality of your PHI.
Qualifications & exceptions
The compliance statement is limited to laws that apply to Aetna and relate to the security and confidentiality of PHI.
Not stated here
The notice does not describe specific security measures, certifications or breach-response steps.
Retention & Deletion · Company practice
PHI is not destroyed when your coverage ends
Aetna says it does not destroy your PHI even when you end your coverage with it. It may need to use and share the PHI even after coverage terminates, for the reasons described in the notice, and it will continue to protect your information against inappropriate use or disclosure.
Supporting quotations
We don’t destroy your PHI even when you end your coverage with us. We may need to use and share it even after your coverage terminates. (We describe the reasons for using or sharing in this Notice). We will continue to protect your information against inappropriate use or disclosure.
Qualifications & exceptions
Post-coverage use and sharing is limited to the reasons described in the notice.
Not stated here
The notice gives no retention period and no way to ask Aetna to delete PHI after coverage ends.
Legal Rights & Agreement Rules · Company commitment
Aetna must keep PHI private and follow this notice
The notice says federal privacy law requires Aetna to keep your PHI private, to tell you about its legal duties and privacy practices, and to follow the terms of the notice in effect.
Supporting quotations
How we comply with the law
Federal privacy law requires us to keep your PHI private. And we must tell you about our legal duties and privacy practices. We must also follow the terms of the Notice in effect.
Qualifications & exceptions
The duty to follow the notice applies to "the Notice in effect", which Aetna may change.
Legal Rights & Agreement Rules · Permission or license
Aetna can change the notice at any time, and changes reach information it already holds
Aetna may change the terms of the notice and its privacy policies at any time. If it does, the new terms and policies will be effective for all the information it now has about you and apply to any information it may get or hold in the future.
Supporting quotations
When this Notice may change
We may change the terms of this Notice and our privacy policies anytime. If we do, the new terms and policies will be effective for all the information we now have about you. And they’ll apply to any information that we may get or hold in the future.
Qualifications & exceptions
The change applies to information Aetna already holds as well as future information.
Not stated here
The notice sets no advance-notice period and no way to object before a change takes effect.
Cross-references
qualifies (model-proposed): Aetna must keep PHI private and follow this notice — qualifies: Aetna must follow the terms of the notice in effect, and the notice says Aetna may change its terms at any time, with new terms applying to information it already holds.
Legal Rights & Agreement Rules · Company commitment
If Aetna makes material changes: revise, post, send, and you can ask for a copy
The notice says that if Aetna makes material or important changes to its privacy policies it will promptly revise the notice. It will also post the revised notice on its website, and if you are enrolled in an Aetna insurance plan at that time it will send you a new notice, as required. You can ask for a copy of the revised notice from the Aetna Privacy Office at the email address given earlier in the notice.
Supporting quotations
If we make material or important changes to our privacy policies, we will promptly revise our Notice.
We will also post the revised Notice on our website, and if you are enrolled in an Aetna insurance plan at that time we will send you a new notice, as required.
You can ask for a copy of the revised Notice, just ask the Aetna Privacy Office at the email above.
Qualifications & exceptions
The duty to revise is triggered by "material or important changes", while the notice also says Aetna may change terms at any time.
Mailing a new notice is limited to people enrolled in an Aetna insurance plan at that time and to when sending is "required".
Not stated here
"Promptly" is not defined, and the notice does not say when sending a new notice is "required".
Legal Rights & Agreement Rules · Context
Aetna is a brand name used by a group of companies
The notice says Aetna is the brand name used for products and services provided by one or more of the Aetna group of companies, including Aetna Life Insurance Company and its affiliates.
Supporting quotations
Aetna is the brand name used for products and services provided by one or more of the Aetna group of companies, including Aetna Life Insurance Company and its affiliates (Aetna).
Qualifications & exceptions
The notice earlier defines "Aetna" for its own purposes as the HMO and licensed insurer subsidiaries of Aetna Inc.; this closing line describes the brand name more broadly.
Not stated here
The notice does not say which company in the group provides a particular plan or product, and does not mention CVS Health.