Purposes: quotes, onboarding, premiums, managing the policy and claims
Aetna says it uses personal data to provide a quotation to a plan sponsor for a group plan (such as an employer) or to determine eligibility and provide a quotation to you or your broker; to onboard you onto your individual or group plan and register you for benefits; to process payments or premiums under the plan you have requested; to manage, administer and improve the policy you belong to; and to process and complete claims you make under the policy.
Supporting quotations
We use your personal data for the following purposes:
providing a quotation to a plan sponsor for group plans
determining eligibility and providing a quotation to your or your broker
onboarding you onto the individual or group plan to which you belong and registering you for its benefits
processing payments/premiums under the plan which you have requested
managing, administering and improving the policy of which are a member
processing and completing any claims you make under the policy
Qualifications & exceptions
The purposes are introduced as the purposes for which personal data is used; the list is presented without "including" or "such as" language.
Use & Processing · Company practice
Purposes: contacting you about your plan and offering wellness advice
Aetna says it uses personal data to contact you with information about your plan and to contact you to provide healthcare or wellness advice and information.
Supporting quotations
We use your personal data for the following purposes:
contacting you with information about your plan
contacting you for the purposes of providing healthcare or wellness advice and information
Not stated here
The notice does not say through which channels Aetna contacts you for these purposes.
Use & Processing · Company practice
Purposes: fraud prevention, IT security, complaints and legal rights
Aetna says it uses personal data for fraud prevention together with any other required regulatory checks; to manage its information technology and ensure the security of its systems; to investigate, respond to and deal with complaints or incidents relating to it or its business, maintain service quality and train staff; and to establish, exercise or defend legal claims or rights and protect, exercise and enforce its rights, property or safety.
Supporting quotations
We use your personal data for the following purposes:
fraud prevention together with any other required regulatory checks
managing our information technology and to ensure the security of our systems
investigating, responding to and dealing with complaints or incidents relating to us or our business and maintaining service quality and training staff
establishing, exercising and/or defending legal claims or rights and protecting, exercising and enforcing our rights, property or safety
Use & Processing · Company practice
Group plan data processed on Aetna's legitimate interest
When Aetna receives personal data about you from a plan sponsor for a group plan, it says it processes that data because it has a legitimate interest. That interest includes providing the plan sponsor with a quotation for insurance cover and, if the quotation is accepted, onboarding you as a member and administering the group insurance plan. Aetna says it has considered and balanced the potential impact on you and your rights and will process only the minimal personal data necessary for those actions.
Supporting quotations
Where we receive personal data from a plan sponsor for a group plan (i.e. the company applying to cover you under a group insurance plan), we will process your personal data as we have a legitimate interest in processing it.
Our legitimate interest includes processing for the purposes of providing the plan sponsor with a quotation for insurance cover, and where that quotation is accepted for the purposes of onboarding you as a member and administering the group insurance plan.
In any processing on this basis we have considered and balanced any potential impact on you and your rights and will only process the minimal personal data necessary for carrying out those actions.
Qualifications & exceptions
Applies where Aetna receives the data from a plan sponsor for a group plan.
The "minimal personal data necessary" limit is stated for processing on this legitimate-interest basis.
Not stated here
The notice does not describe how the balancing was done or how a member can see it.
Use & Processing · Company practice
Individual plan data processed to perform a contract with you
When Aetna receives personal data from you for individual cover, it says it processes that data for the performance of a contract with you. That includes pre-contractual discussions with you or your broker (if you have one), later performance of the insurance plan, and processing any benefits to which you are contractually entitled.
Supporting quotations
Where we receive personal data from you for individual cover, we will process your personal data for the performance of a contract with you including pre-contractual discussions with either you or your broker (if you have one), and subsequent contractual performance of the insurance plan together with processing any benefits to which you are contractually entitled.
Qualifications & exceptions
Applies where the data comes from you for individual cover.
Use & Processing · Company practice
Claims are administered in the United States, relying on your consent
Aetna says that when you submit a claim, the claim will be administered in the United States. To administer the claim it says it will rely on your consent to process your medical information.
Supporting quotations
Where you submit a claim, the administration of that claim will be conducted in the United States.
In order to administer the claim we will rely on your consent to process your medical information.
Qualifications & exceptions
Applies where you submit a claim.
Not stated here
This section does not say how the consent is given or withdrawn. Safeguards for sending data outside the EEA are addressed separately in the "Sending Your Personal Data Abroad" section.
Use & Processing · Company practice
Health care operations: service quality, research, disease management and similar
Aetna says it may use and disclose your information while running its health business: assessing the standard of its services and making improvements, performance measurement and outcomes assessment, licensing, accreditation by independent organizations, health services research, and preventive health, disease management, case management and care coordination. Its example is using the information to provide disease management programs for members with conditions such as diabetes, asthma or heart failure.
Supporting quotations
Health Care Operations: We may use and disclose your Information during the course of running our health business
assessing the standard of our services and implementing service enhancements and improvements; performance measurement and outcomes assessment; licensing; accreditation by independent organizations; health services research; and preventive health, disease management, case management and care coordination.
For example, we may use the Information to provide disease management programs for members with specific conditions, such as diabetes, asthma or heart failure.
Qualifications & exceptions
Described as operational activities, stated with "may."
Use & Processing · Company practice
Other operations: reinsurance, underwriting, fraud checks and general administration
Beyond the operational activities above, Aetna says other activities requiring use and disclosure of your information include administering reinsurance and stop loss; underwriting and rating; detecting and investigating fraud; administering pharmaceutical programs and payments; transferring policies or contracts from and to other health plans; and other general administrative activities such as data and information systems management and customer service.
Supporting quotations
Other operational activities requiring use and disclosure including administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans;
and other general administrative activities, including data and information systems management, and customer service.
Qualifications & exceptions
The list is introduced as "other operational activities" and ends with "other general administrative activities," so it is open-ended.
Use & Processing · Company practice
Payment: reviews, eligibility, premiums, appeals and disclosure to your provider
To help pay for covered services, Aetna says it may use and disclose your information in conducting utilization and medical necessity reviews, coordinating care, determining eligibility and formulary compliance, collecting premiums, calculating cost-sharing amounts, and responding to complaints, appeals and requests for external review. For example, it may use your medical history to decide whether a treatment is medically necessary and what the payment should be, and may disclose information to your provider during that process. It also says it uses information to obtain payment for any health care provider in the world for services provided to you.
Supporting quotations
Payment: To help pay for your covered services, we may use and disclose your Information in a number of ways
in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review.
we may use your medical history and other health personal information about you to decide whether a particular treatment is medically necessary and what the payment should be - and during the process, we may disclose Information to your provider.
We also use Information to obtain payment for any health care provider in the world for services provided to you.
Qualifications & exceptions
Stated with "may" and "in a number of ways"; the list is illustrative.
Use & Processing · Company practice
Treatment alternatives, reminders and other health-related benefits
Aetna says it may use or disclose personal information about you in providing treatment alternatives, treatment reminders, or other health-related benefits and services. This heading introduces further reasons for disclosure, listed next.
Supporting quotations
We may use or disclose personal information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
We also may disclose such Information in support of:
Qualifications & exceptions
Stated with "may."
Use & Processing · Company practice
Substance use disorder information received under a 42 CFR Part 2 consent
Aetna says it is not a substance use disorder treatment program but may receive or keep information about you that comes from one. If such a program provides the information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment and health care operations, Aetna will use or share it in accordance with both the consent and HIPAA. In limited situations where it may disclose this information without your permission, such as medical emergencies and government audits, Aetna says it will follow the law that is more protective of your information.
Supporting quotations
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program.
If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA.
In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information.
Qualifications & exceptions
Applies to information that comes from a substance use disorder program.
The notice cites 42 CFR Part 2 without supplying its text.
Not stated here
The notice does not list every situation in which this information may be disclosed without permission; it gives medical emergencies and government audits as examples.
Use & Processing · User right or choice
Data protection rights: access, correction, erasure, restriction, transfer, objection
The notice says that under certain circumstances you have the right to request access to your information, request correction of information Aetna holds about you, request erasure, request restriction of processing, request transfer of the personal information you provided in a commonly used electronic format, and object to processing where Aetna relies on a legitimate interest and your particular situation gives you grounds to object.
Supporting quotations
Under certain circumstances you have the right to:
Request access to your Information
Request correction of the Information that we hold about you.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of personal information that you have provided to us in a commonly used electronic format.
Object to us processing your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Qualifications & exceptions
All of these rights are stated to apply "under certain circumstances."
Erasure is described as asking Aetna to delete or remove information "where there is no good reason" for continuing to process it.
Restriction is described as asking Aetna to suspend processing, for example while its accuracy or the reason for processing is established.
The right to object is tied to processing based on a legitimate interest and your particular situation.
Not stated here
The notice does not say what the circumstances are, how quickly Aetna responds, or whether a fee may apply to these requests.
Use & Processing · User right or choice
HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse
You may ask Aetna to restrict how it uses or discloses information about you in connection with health care operations, administration, payment and treatment. Aetna says it will consider, but may not agree to, such requests. You also have the right to ask Aetna to restrict disclosures to persons involved in your health care.
Supporting quotations
Restrict the way we use or disclose Information about you in connection with health care operations, administration, payment and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care.
Qualifications & exceptions
Aetna "may not agree" to restriction requests.
Not stated here
The notice does not say whether Aetna may decline a request to restrict disclosures to persons involved in your care, which is stated as a separate sentence.
Use & Processing · User right or choice
Right to opt out of advertising and marketing campaigns
The notice lists, among your HIPAA rights, the right to opt out of advertising and marketing campaigns.
Supporting quotations
Opt out of advertising and marketing campaigns.
Not stated here
The notice does not say how to opt out or which campaigns this covers, and earlier text separately requires written authorization for marketing unrelated to your benefit plan(s).
Use & Processing · User right or choice
Reasons for unfavorable underwriting decisions; genetic information not used
You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future ones unless Aetna makes an independent evaluation of the basic facts. Your genetic personal information cannot be used for underwriting purposes.
Supporting quotations
Know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic personal information cannot be used for underwriting purposes.
Qualifications & exceptions
An earlier unfavorable decision can be relied on only if Aetna makes an independent evaluation of the basic facts.