Aetna International U.S.-based plans notice of privacy practices
105 of 125 blocks carry cards. 64 cards.
Aetna International Notice of Privacy Practices
Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.
- Spanish copy available through Member Services Account & Service Control
This Notice of Privacy Practices (the “Notice”) applies to EU residents who have plans underwritten or administered by Aetna International, Inc., Aetna Life Insurance Company. For purposes of this notice, “Aetna International” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information
- Notice covers EU residents on Aetna International plans Legal Rights & Agreement Rules
- "We" means Aetna subsidiaries that share PHI as one covered entity Sharing & Disclosure
(PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
- "We" means Aetna subsidiaries that share PHI as one covered entity Sharing & Disclosure
Aetna International, Inc., Aetna Life Insurance Company are considered the data controller for personal data processed in relation to health plans written under its insurance policies.
- Named Aetna companies are data controller for their insurance policies Legal Rights & Agreement Rules
This Notice describe show personal data about you may be used and disclosed and how you can get access to this information.
- Notice covers EU residents on Aetna International plans Legal Rights & Agreement Rules
Please review it carefully.
Aetna considers personal information to be confidential (personal data and personal information are considered to mean the same for the purposes of this Privacy Notice). We protect the privacy of that information in accordance with applicable privacy laws and regulations, as well as our own privacy policies.
- Aetna treats personal information as confidential under applicable laws Security & Safeguards
- What "personal information" means and why Aetna obtains it Data Access & Collection
These laws and regulations may include where applicable, the General Data Protection Regulation and the U.S. Health Insurance Portability and Accountability Act Privacy Rules (HIPAA Privacy Rules). When we use the terms “personal information,” “personal data,” or “Information”, we mean any information that can directly or indirectly identify, or be related to, you as an individual, including health information that relates to, among other things, your medical history (i.e., the health care you receive or the amounts paid for that care). We obtain this Information in order to provide you with, or administer, your healthcare plan.
- Aetna treats personal information as confidential under applicable laws Security & Safeguards
- What "personal information" means and why Aetna obtains it Data Access & Collection
This Notice will become effective October 1, 2025.
- Notice effective October 1, 2025 Legal Rights & Agreement Rules
Why Aetna Processes Your Personal Information
We use your personal data for the following purposes:
- Purposes: quotes, onboarding, premiums, managing the policy and claims Use & Processing
- Purposes: contacting you about your plan and offering wellness advice Use & Processing
- Purposes: fraud prevention, IT security, complaints and legal rights Use & Processing
- providing a quotation to a plan sponsor for group plans (e.g. the organization who has taken out insurance under which you will be provided insurance cover as part of a group plan, for example your employer) or determining eligibility and providing a quotation to your or your broker
- fraud prevention together with any other required regulatory checks,
- Purposes: fraud prevention, IT security, complaints and legal rights Use & Processing
- onboarding you onto the individual or group plan to which you belong and registering you for its benefits,
- processing payments/premiums under the plan which you have requested
- managing, administering and improving the policy of which are a member,
- managing our information technology and to ensure the security of our systems,
- Purposes: fraud prevention, IT security, complaints and legal rights Use & Processing
- investigating, responding to and dealing with complaints or incidents relating to us or our business and maintaining service quality and training staff,
- Purposes: fraud prevention, IT security, complaints and legal rights Use & Processing
- contacting you with information about your plan,
- contacting you for the purposes of providing healthcare or wellness advice and information,
- processing and completing any claims you make under the policy,
- establishing, exercising and/or defending legal claims or rights and protecting, exercising and enforcing our rights, property or safety.
- Purposes: fraud prevention, IT security, complaints and legal rights Use & Processing
GR-67806-5 AI (2-26)
Where we receive personal data from a plan sponsor for a group plan (i.e. the company applying to cover you under a group insurance plan), we will process your personal data as we have a legitimate interest in processing it. Our legitimate interest includes processing for the purposes of providing the plan sponsor with a quotation for insurance cover, and where that quotation is accepted for the purposes of onboarding you as a member and administering the group insurance plan. In any processing on this basis we have considered and balanced any potential impact on you and your rights and will only process the minimal personal data necessary for carrying out those actions. Where we receive personal data from you for individual cover, we will process your personal data for the performance of a contract with you including pre-contractual discussions with either you or your broker (if you have one), and subsequent contractual performance of the insurance plan together with processing any benefits to which you are contractually entitled.
- Group plan data processed on Aetna's legitimate interest Use & Processing
- Individual plan data processed to perform a contract with you Use & Processing
It will be necessary to receive and hold your health personal information for dealing with your insurance for example:
- Aetna says it must receive and hold health information to deal with insurance Data Access & Collection
- arranging, underwriting, administering the insurance contract under which you benefit,
- Aetna says it must receive and hold health information to deal with insurance Data Access & Collection
- administering a claim under the insurance contract, or
- Aetna says it must receive and hold health information to deal with insurance Data Access & Collection
- exercising a right or complying with an obligation.
- Aetna says it must receive and hold health information to deal with insurance Data Access & Collection
Where you submit a claim, the administration of that claim will be conducted in the United States. In order to administer the claim we will rely on your consent to process your medical information. Where the claims administration involves invoices received from US medical providers (for example where you have received treatment in the United States), we may administer your claim using automated processing. This could include the automated processing of your health data, for which we will acquire your consent.
- Claims are administered in the United States, relying on your consent Use & Processing
- Claims from US medical providers may be processed automatically Inference & Profiling
- No profiling or automated decisions, except US provider claims or when you are told Inference & Profiling
How Aetna Obtains Your Personal Information
Group Plans: we get some personal data from your plan sponsor when they request an insurance quote from us, and we retain that information after any quote has been accepted and they start the group plan with us. This Information includes your name, date of birth and country of residence. We do not process your Information for any other purpose unless you submit a claim under the policy.
- Group plan: data comes from the plan sponsor and is kept after a quote Data Access & Collection
Individual Plans: where you have taken out an individual insurance plan with us, we will have received your personal data either directly from you or from an insurance broker that you instructed. We may also receive some personal data from other insurers, brokers, third-party administrators (TPAs), and health care providers. Please see above for the type of personal data received.
- Individual plan: data from you, your broker, insurers, TPAs and providers Data Access & Collection
How Long Aetna Retains Personal Data
We retain your personal data for as long as necessary to provide you the benefits under your insurance plan, until such time as any claim under the insurance policy is concluded, until the limitation for exercising any legal rights has expired or for compliance with any legal or regulatory requirements. All personal data that we retain is subject to this Privacy Notice together with our internal Retention Policy and guidelines.
- Personal data kept as long as needed for benefits, claims, legal and regulatory reasons Retention & Deletion
How Aetna Uses and Discloses Personal Information
In order to administer your insurance cover, and/or any related services in connection with your contract, we need to collect Information about you. We obtain this Information from many different sources - particularly your employer or benefits plan sponsor, other insurers, brokers, third-party administrators (TPAs), and health care providers. In administering your health benefits, we may use and disclose Information about you in various ways, including, but not limited to:
- Information comes from many sources; uses and disclosures are not limited to those listed Data Access & Collection
Group and Individual Plans: We may disclose Information about you in various ways, including, but not limited to:
- Information comes from many sources; uses and disclosures are not limited to those listed Data Access & Collection
GR-67806-5 AI (2-26) 2
Health Care Operations: We may use and disclose your Information during the course of running our health business — that is, during operational activities such as assessing the standard of our services and implementing service enhancements and improvements; performance measurement and outcomes assessment; licensing; accreditation by independent organizations; health services research; and preventive health, disease management, case management and care coordination. For example, we may use the Information to provide disease management programs for members with specific conditions, such as diabetes, asthma or heart failure. Other operational activities requiring use and disclosure including administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans; facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity); and other general administrative activities, including data and information systems management, and customer service.
- Health care operations: service quality, research, disease management and similar Use & Processing
- Other operations: reinsurance, underwriting, fraud checks and general administration Use & Processing
- Information may be used to facilitate a sale, merger or transfer of Aetna Sharing & Disclosure
Payment: To help pay for your covered services, we may use and disclose your Information in a number of ways - in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review. For example, we may use your medical history and other health personal information about you to decide whether a particular treatment is medically necessary and what the payment should be - and during the process, we may disclose Information to your provider. We also mail Explanation of Benefits forms and other Information to the address we have on record for the subscriber (i.e., the primary insured). This may be the address of the subscriber’s Employer, as applicable. In addition, we make claims Information available to the subscriber (the primary insured) and all covered dependents on our member health and telephonic claims status websites, including Aetna NavigatorTM. We also use Information to obtain payment for any health care provider in the world for services provided to you.
- Payment: reviews, eligibility, premiums, appeals and disclosure to your provider Use & Processing
- EOBs go to the subscriber's address and claims show online to dependents Sharing & Disclosure
Treatment: We may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records. We also may use personal information in providing mail order pharmacy services and by sending certain Information to doctors for patient safety or other treatment-related reasons.
- Treatment: information to doctors, pharmacies and hospitals; mail order pharmacy Sharing & Disclosure
Disclosures to Other Covered Entities: We may disclose Information to other insurers, healthcare providers, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, we may disclose Information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.
- Disclosure to other insurers, providers and their business associates Sharing & Disclosure
Additional Reasons for Disclosure
We may use or disclose personal information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services. We also may disclose such Information in support of:
- Treatment alternatives, reminders and other health-related benefits Use & Processing
- Plan Administration (Group Plans) – to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
- Group plans: information to your employer for plan administration Sharing & Disclosure
- Research – to researchers, provided measures are taken to protect your privacy.
- Research and business associates Sharing & Disclosure
- Business Associates – to persons who provide services to us and assure us they will protect the Information.
- Research and business associates Sharing & Disclosure
- Industry Regulation – to Government agencies that regulate us (different countries and U.S. state insurance departments).
- Disclosure to government regulators in different countries and U.S. states Sharing & Disclosure
- Workers’ Compensation – to comply with workers’ compensation laws.
- Law Enforcement – to Government law enforcement officials.
- Legal Proceedings – in response to a court order or other lawful process.
- Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).
- As Required by Law – to comply with legal obligations and requirements.
Continued
- Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
- Disclosures about decedents and for organ donation Sharing & Disclosure
- Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.
- Disclosures about decedents and for organ donation Sharing & Disclosure
Required Disclosures: We must use and disclose your personal information in the following manner:
- Required disclosures: to you or your representative and to the U.S. HHS Secretary Legal Rights & Agreement Rules
- To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
- Required disclosures: to you or your representative and to the U.S. HHS Secretary Legal Rights & Agreement Rules
- To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.
- Required disclosures: to you or your representative and to the U.S. HHS Secretary Legal Rights & Agreement Rules
Disclosure to Others Involved in Your Health Care
We may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the Information is directly relevant to that person’s involvement with your health care or payment for that care. For example, if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.
- Information may go to relatives, friends or others involved in your care or payment Sharing & Disclosure
If you are a minor, you also may have the right to block parental access to your health personal information in certain circumstances, if permitted by the country or U.S. state law. You can contact us using the Member Services number on your ID card - or have your provider contact us.
- Minors may be able to block parental access in some circumstances Account & Service Control
Uses and Disclosures Requiring Your Written Authorization
In all situations other than those described above, we will ask for your written authorization before using or disclosing Information about you. For example, we will get your authorization:
- Written authorization needed outside the described uses and disclosures Legal Rights & Agreement Rules
- For marketing purposes that are unrelated to your benefit plan(s),
- Written authorization needed outside the described uses and disclosures Legal Rights & Agreement Rules
- Before disclosing any psychotherapy notes, and
- Written authorization needed outside the described uses and disclosures Legal Rights & Agreement Rules
- For other reasons as required by law.
- Written authorization needed outside the described uses and disclosures Legal Rights & Agreement Rules
If you have given us an authorization, you may revoke it at any time, if we have not already acted on it. If you have questions regarding authorizations, please call the Member Services number on your ID card.
- You can revoke an authorization unless Aetna has already acted on it Account & Service Control
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
- Recipients may redisclose PHI and HIPAA may no longer protect it Sharing & Disclosure
Additional Restrictions on Use and Disclosure
Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Alcohol or substance use disorder
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Biometric Information
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Child or adult abuse or neglect, including sexual assault
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Communicable diseases
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Genetic information
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- HIV/AIDs
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Mental health
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Minors
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Reproductive health
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
- Sexually transmitted diseases
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
We will follow the law that is stricter (or more protective of your PHI), where it applies to us. If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.
- Stricter laws may limit use of sensitive health information Legal Rights & Agreement Rules
Substance Use Disorder Information
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:
- Substance use disorder information received under a 42 CFR Part 2 consent Use & Processing
- SUD information is not used against you in a legal case without consent or court order Legal Rights & Agreement Rules
- You give us written consent, or
- SUD information is not used against you in a legal case without consent or court order Legal Rights & Agreement Rules
- A court orders us with a subpoena or other legal requirement. You or Aetna must also receive notice and a chance to be heard.
- SUD information is not used against you in a legal case without consent or court order Legal Rights & Agreement Rules
Sending Your Personal Data Abroad
If we collected personal data about you in the European Economic Area (EEA), there are occasions where we may need to send your personal data, including health personal information, outside of the
- Data collected in the EEA may be sent outside it to other Aetna group companies Sharing & Disclosure
EEA. Organizations that we may send your personal data to include:
- Data collected in the EEA may be sent outside it to other Aetna group companies Sharing & Disclosure
- Data may go to health care providers overseas when you make a claim Sharing & Disclosure
- Other organizations within the Aetna group for the purposes of corporate administrative, regulatory reporting, dealing with complaints or seeking legal advice. We have appropriate contractual protections (known as model contract clauses) in place with other group companies that receive your personal data.
- Data collected in the EEA may be sent outside it to other Aetna group companies Sharing & Disclosure
- Providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you when you are overseas.
- Data may go to health care providers overseas when you make a claim Sharing & Disclosure
Profiling and Automated Decisions
We do not conduct any profiling or automated decision-making other than where a United States medical provider submits a claim on your behalf for treatment the provider has rendered or in circumstances where you are expressly informed.
- No profiling or automated decisions, except US provider claims or when you are told Inference & Profiling
Your Rights in Connection with Your Personal Information Under certain circumstances you have the right to:
- Data protection rights: access, correction, erasure, restriction, transfer, objection Use & Processing
- Request access to your Information (commonly known as “data subject access request’)
- Request correction of the Information that we hold about you.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of personal information that you have provided to us in a commonly used electronic format.
- Object to us processing your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact PrivacyInternational@CVSHealth.com.
- Exercise data protection rights by emailing PrivacyInternational@CVSHealth.com Account & Service Control
Pursuant to HIPAA, you have the right to:
- HIPAA right: ask Aetna to communicate with you a certain way or place Account & Service Control
- Ask us to communicate with you in a certain way or at a certain location. We will accommodate reasonable requests. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits (EOB) and other claim information to a different address from that of your subscriber. We will accommodate reasonable requests. Restrict the way we use or disclose Information about you in connection with health care operations, administration, payment and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care. Continued
- Information may go to relatives, friends or others involved in your care or payment Sharing & Disclosure
- HIPAA right: ask Aetna to communicate with you a certain way or place Account & Service Control
- HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse Use & Processing
- Request Information held about you that is contained in a “designated record set” - medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management and other decisions. We may ask you to make your request in writing and may charge a reasonable fee for producing and mailing the copies.
- HIPAA right: request your records in a designated record set Account & Service Control
- Request to amend Information that is incorrect. We may require that this request be in writing, validated, and include the reason for the request. If we deny the request, you may file a written statement of disagreement.
- HIPAA right: ask to amend incorrect information Account & Service Control
- Obtain a list of certain disclosures we have made about you, such as disclosures of health personal information to government agencies that license us, where permitted by law. Your request must be in writing.
- HIPAA right: obtain a list of certain disclosures (in writing) Account & Service Control
- Opt out of advertising and marketing campaigns.
- Right to opt out of advertising and marketing campaigns Use & Processing
- Be notified following a breach involving your health personal information.
- Right to be notified of a breach involving your health information Security & Safeguards
- Know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic personal information cannot be used for underwriting purposes.
- You have the right with very limited exceptions, not to be subjected to pretext interviews.1 You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by calling the Member Services number on your ID card. You also have the right to file a complaint if you think your privacy rights under HIPAA have been violated. To do so, please send your inquiry to the HIPAA Member Rights Team by using the contact details below.
- Right not to be subjected to pretext interviews, with very limited exceptions Data Access & Collection
- Request a paper copy or make requests by phone; file a HIPAA complaint Account & Service Control
- Footnote: Aetna does not participate in pretext interviews Data Access & Collection
Contact Us:
For any questions about this Privacy Policy, to exercise any of your rights listed above, or for any questions or complaints regarding the manner in which we handle or protect personal data, we can be contacted as follows:
- Contact Aetna by email or mail for questions, rights requests and complaints Account & Service Control
Email: PrivacyInternational@CVSHealth.com
- Contact Aetna by email or mail for questions, rights requests and complaints Account & Service Control
HIPAA Member Rights Team Contact: HIPAA Member Rights Team P.O. Box 14079 Lexington, KY 40512-4079
- Contact Aetna by email or mail for questions, rights requests and complaints Account & Service Control
You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com and click “Log In/Register”. Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information.
- Stop paper EOB mailings by registering at aetna.com Account & Service Control
You may also have the right to take your complaint to the applicable data protection agency. You will not be penalized for filing a complaint.
- You may complain to the data protection agency without penalty Legal Rights & Agreement Rules
Aetna’s Legal Obligations
Privacy regulations require us to keep Information about you private, confidential, and secure, to give you notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.
- Privacy regulations require Aetna to keep information private and follow the notice Legal Rights & Agreement Rules
- Aetna may change this notice and its policies at any time, for all information it holds Legal Rights & Agreement Rules
Safeguarding Your Information
We guard your Information with administrative, technical, and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity.
- Administrative, technical and physical safeguards Security & Safeguards
This Notice is Subject to Change
We may change the terms of this Notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the Information that we already have about you, as well as any Information that we may receive or hold in the future.
- Aetna may change this notice and its policies at any time, for all information it holds Legal Rights & Agreement Rules
Please note that we do not destroy Information about you when you terminate your coverage with us. It may be necessary to use and disclose this information, for legal and regulatory reasons, for the purposes described above even after your coverage terminates, although policies and procedures will remain in place to protect against inappropriate use or disclosure.
- Aetna does not destroy information when your coverage ends Retention & Deletion
1 We do not participate in pre-text interviews.
- Footnote: Aetna does not participate in pretext interviews Data Access & Collection