Employee assistance plans notice of privacy practices

Aetna / CVS Health · agreement dated October 1, 2025 · Official agreement

70 of 82 blocks carry cards. 48 cards.

Notice of Privacy Practices

Employee Assistance Plan

Para recibir esta notificación en español por favor llamar al número provisto en este documento.

This Notice of Privacy Practices applies to Aetna Resources For Living (EAP Program) offered in California. If your EAP Program is offered outside of California, you may want to ask for a copy of your employer’s privacy notice.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Please review it carefully.

Aetna Resources For Living1 considers personal information confidential. We protect the privacy of that information in accordance with federal and state privacy laws, as well as our own company privacy policies.

This notice describes how we may use and disclose information about you in administering your EAP Program services, and it explains your legal rights regarding the information.

When we use the term “personal information,” we mean information that identifies you as an individual, such as your name and Social Security Number, as well as financial, health and other information about you that is nonpublic, and that we obtain so we can provide you with EAP Program services. By “health information,” we mean information that identifies you and relates to your medical history (i.e., the health care you receive or the amounts paid for that care).

This notice became effective on October 1, 2025.

How EAP uses and discloses personal information

In order to provide you with service under the EAP Program, we need personal information about you, and we obtain that information from many different sources – particularly your employer or benefits plan sponsor, other insurers, HMOs or third-party administrators (TPAs) and health care providers. In administering your EAP Program, we may use and disclose personal information about you in various ways, including:

Health care operations: We may use and disclose personal information during the course of running our health business – that is, during operational activities such as quality assessment and improvement; licensing; accreditation by independent organizations; performance measurement and outcomes assessment; health services research; and preventive health, disease management, case management and care coordination. Other operational activities requiring use and disclosure include detection and investigation of fraud; administration of payments; transfer of contracts from and to other EAP vendors; facilitation of a sale, transfer, merger or consolidation of all or part of Aetna Resources For Living with another entity (including due diligence related to such activity); and other general administrative activities, including data information systems management, and customer service.

Payment: To arrange payment for your EAP services, we may use and disclose personal information in a number of ways – in conducting utilization and medical necessity reviews; coordinating care; collecting payments; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review. For example, we may use your medical history and other health information about you to decide whether a particular treatment is medically necessary and what the payment should be – and during the process, we may disclose information to your provider.

GR-68164 (2-26) EAP Privacy Notice Page 1 of 4

1 For purposes of this Notice, “Aetna Resources for Living” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer

subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information (PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

Treatment: We may disclose your Protected Health Information to health care providers for the provision, coordination or management of your healthcare.

Disclosures to other covered entities: We may disclose personal information to other covered entities, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, we may disclose personal information to other health plans maintained by your employer, if it has been arranged for us to do so, in order to have certain expenses reimbursed.

Additional reasons for disclosure

We may use or disclose personal information about you in providing you with treatment alternatives, treatment reminders or other health-related benefits and services. We also may disclose such information in support of:

Required Disclosures: We must use and disclose your personal information in the following manner:

Uses and disclosures requiring your written authorization

In all other situations other than those described above, we will ask for your written authorization before using or disclosing personal information about you. For example, we will get your authorization:

If you have given us an authorization, you may revoke it in writing at any time, if we have not already acted on it. If you have questions regarding this notice or requests related to your information, please contact us by using the toll-free EAP number provided by your benefits department. PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

Additional Restrictions on Use and Disclosure

Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:

We will follow the law that is stricter (or more protective of your PHI), where it applies to us. If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.

Substance Use Disorder Information

We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:

You or Aetna must also receive notice and a chance to be heard.

Your legal rights

The federal privacy regulations give you several rights regarding your health information.

  • You have the right to ask us to communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits (EOB) and other claim information) to a different address from that of your subscriber. We will accommodate reasonable requests.
  • You have the right to ask us to restrict the way we use or disclose health information about you in connection with health care operations, payment and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care.
  • You have the right to ask us to obtain a copy of health information that is contained in a “designated record set” – medical records and other records maintained and used in making payment, medical management and other decisions. We may ask you to make your request in writing, may charge a reasonable fee for producing and mailing the copies and, in certain cases, may deny the request.
  • You have the right to ask us to amend health information that is in a “designated record set.” Your request must be in writing and must include the reason for the request. If we deny the request, you may file a written statement of disagreement.
  • You have the right to ask us to provide a list of certain disclosures we have made about you, such as disclosures of health information to government agencies that license us. Your request must be in writing. If you request such an accounting more than once in a 12-month period, we may charge a reasonable fee.
  • You have the right to be notified following a breach involving your health information.

You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by fax at 1-800-678-9229 or by calling the toll-free EAP number provided by your benefits department.

You also have the right to file a complaint if you think your privacy rights have been violated. To do so, please send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send your inquiry to the following address:

Resources for Living 9350 Waxie Way Suite 210

San Diego, CA 92123

Fax: 1-800-678-9229

You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com and click “Log In/Register”. Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information.

You may also write to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

EAP’s legal obligations

The federal privacy regulations require us to keep personal information about you private, to give you notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

Safeguarding your information

We guard your information with administrative, technical and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity. We comply with all applicable state and federal law pertaining to the security and confidentiality of personal information.

This notice is subject to change

We may change the terms of this notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the information that we already have about you, as well as any information that we may receive or hold in the future.

Please note that we do not destroy personal information about you when your employment terminates or services under the EAP Program end. It may be necessary to use and disclose this information for the purposes described above even after services terminate, although policies and procedures will remain in place to protect against inappropriate use or disclosure.

Aetna Resources for Living is the brand name used for products and services provided by Health and Human Resource Center, Inc.