"We" means Aetna subsidiaries that share PHI as one covered entity
In this notice, "Aetna International" and "we," "us" and "our" mean all of the HMO and licensed insurer subsidiaries of Aetna Inc. Those entities are designated as a single affiliated covered entity for federal privacy purposes (the Aetna ACE). The members of the Aetna ACE can share protected health information (PHI) with each other for the treatment, payment and health care operations of the Aetna ACE, and as allowed by HIPAA and this notice.
Supporting quotations
refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information
(PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
Qualifications & exceptions
Sharing among ACE members is for treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this notice.
The "single affiliated covered entity" designation is stated to be "for federal privacy purposes."
Not stated here
The notice does not list the members of the Aetna ACE; it directs members to contact the Aetna Privacy Office at PrivacyAetna@aetna.com for the full list.
Sharing & Disclosure · Permission or license
Information may be used to facilitate a sale, merger or transfer of Aetna
Aetna lists, among its operational activities, facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity, including due diligence related to that activity. The notice treats this as a use and disclosure of your information that it may make.
Supporting quotations
facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity)
Qualifications & exceptions
Covers a sale, transfer, merger or consolidation of "all or part of Aetna," including due diligence.
Not stated here
The notice does not say what safeguards or limits apply to the other entity receiving information in such a transaction.
Sharing & Disclosure · Company practice
EOBs go to the subscriber's address and claims show online to dependents
Aetna says it mails Explanation of Benefits forms and other information to the address it has on record for the subscriber (the primary insured), which may be the subscriber's employer address, as applicable. It also makes claims information available to the subscriber and all covered dependents on its member health and telephonic claims status websites, including Aetna Navigator.
Supporting quotations
We also mail Explanation of Benefits forms and other Information to the address we have on record for the subscriber (i.e., the primary insured).
we make claims Information available to the subscriber (the primary insured) and all covered dependents on our member health and telephonic claims status websites, including Aetna Navigator
Qualifications & exceptions
Mailing goes to the subscriber's address on record, which "may be" the employer's address "as applicable."
Online claims information is available to the subscriber and all covered dependents.
Not stated here
The paper mailing can be stopped through online registration, described later in the notice; this section does not say that.
Sharing & Disclosure · Company practice
Treatment: information to doctors, pharmacies and hospitals; mail order pharmacy
Aetna says it may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you. For example, doctors may request medical information from Aetna to supplement their records. Aetna also may use personal information in providing mail order pharmacy services and may send certain information to doctors for patient safety or other treatment-related reasons.
Supporting quotations
Treatment: We may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you.
doctors may request medical information from us to supplement their own records.
We also may use personal information in providing mail order pharmacy services and by sending certain Information to doctors for patient safety or other treatment-related reasons.
Qualifications & exceptions
Disclosures go to providers who "take care of you."
Sharing & Disclosure · Company practice
Disclosure to other insurers, providers and their business associates
Aetna says it may disclose your information to other insurers, health care providers, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, it may disclose information to other health plans maintained by your employer if it has been arranged for Aetna to do so in order to have certain expenses reimbursed.
Supporting quotations
Disclosures to Other Covered Entities: We may disclose Information to other insurers, healthcare providers, or business associates of those entities for treatment, payment and certain health care operations purposes.
we may disclose Information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.
Qualifications & exceptions
Limited to treatment, payment and "certain" health care operations purposes.
The employer-plan example applies only if it "has been arranged for us to do so."
Not stated here
The notice does not say which health care operations purposes are covered.
Sharing & Disclosure · Permission or license
Group plans: information to your employer for plan administration
For group plans, Aetna says it may disclose information to your employer, as applicable, for plan administration when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Supporting quotations
Plan Administration (Group Plans)
to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Qualifications & exceptions
Applies to group plans.
Two conditions: appropriate language in the plan documents, or summary data to assist in bidding or amending the plan.
Not stated here
The notice does not say what the required plan-document language is.
Sharing & Disclosure · Company practice
Research and business associates
Aetna says it may disclose information to researchers, provided measures are taken to protect your privacy, and to persons who provide services to Aetna and assure Aetna they will protect the information (business associates).
Supporting quotations
Research – to researchers, provided measures are taken to protect your privacy.
Business Associates – to persons who provide services to us and assure us they will protect the Information.
Qualifications & exceptions
Research disclosures are conditioned on measures being taken to protect your privacy.
Business associates must assure Aetna they will protect the information.
Not stated here
The notice does not say what privacy measures are required for research or how the assurance is documented.
Sharing & Disclosure · Company practice
Disclosure to government regulators in different countries and U.S. states
Aetna says it may disclose information to government agencies that regulate it, described as agencies in different countries and U.S. state insurance departments.
Supporting quotations
Industry Regulation – to Government agencies that regulate us (different countries and U.S. state insurance departments).
Not stated here
The notice does not name the countries or agencies.
Sharing & Disclosure · Company practice
Disclosures for workers' compensation, law enforcement, court orders and public welfare
Aetna says it may disclose information to comply with workers' compensation laws, to government law enforcement officials, in response to a court order or other lawful process, to address matters of public interest as required or permitted by law (for example child abuse and neglect, threats to public health and safety, and national security), and to comply with legal obligations and requirements. These items are part of a list that continues in the next section of the notice.
Supporting quotations
Workers’ Compensation – to comply with workers’ compensation laws.
Law Enforcement – to Government law enforcement officials.
Legal Proceedings – in response to a court order or other lawful process.
Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).
As Required by Law – to comply with legal obligations and requirements.
Qualifications & exceptions
The notice does not attach conditions to the law enforcement item itself.
Public interest disclosures are stated as "as required or permitted by law."
The notice separately says that stricter laws protecting some sensitive information can limit use and disclosure, and that information from a substance use disorder program is not used or shared in a legal case against you unless you give written consent or a court orders it.
Not stated here
The notice does not say how the sensitive-information protections apply to each disclosure on this list.
Sharing & Disclosure · Company practice
Disclosures about decedents and for organ donation
Continuing the list of additional reasons for disclosure, Aetna says it may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and to funeral directors as necessary to carry out their duties. It may also disclose information to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Supporting quotations
to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Qualifications & exceptions
Coroner and medical examiner disclosures are for the listed purposes or "as authorized by law."
Funeral director disclosures are limited to what is "necessary to carry out their duties."
Sharing & Disclosure · Company practice
Information may go to relatives, friends or others involved in your care or payment
Aetna says it may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person's involvement with your health care or payment for that care. For example, if a family member or caregiver calls with prior knowledge of a claim, Aetna may confirm whether the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.
Supporting quotations
We may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the Information is directly relevant to that person
involvement with your health care or payment for that care.
if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid.
You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.
You also have the right to ask us to restrict disclosures to persons involved in your health care.
Qualifications & exceptions
Only information "directly relevant" to the person's involvement in your care or payment for it.
Recipients include the employer and the plan subscriber, as well as relatives, friends and other people you identify.
Not stated here
A later list of rights says Aetna "will consider, but may not agree to" requests to restrict uses and disclosures, and separately says you may ask to restrict disclosures to persons involved in your care; this section does not say whether Aetna may decline a request to stop or limit this kind of disclosure.
Cross-references
contrast (model-proposed): HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse — contrast: One passage says you have the right to stop or limit disclosures to relatives and others involved in your care; the rights list says Aetna will consider but may not agree to restriction requests. The notice does not say whether Aetna may refuse the persons-involved case.
Sharing & Disclosure · Restriction or exception
Recipients may redisclose PHI and HIPAA may no longer protect it
The notice warns that protected health information disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.
Supporting quotations
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
Qualifications & exceptions
Stated as "may be subject to" redisclosure.
Sharing & Disclosure · Company practice
Data collected in the EEA may be sent outside it to other Aetna group companies
If Aetna collected personal data about you in the European Economic Area, it says there are occasions where it may need to send your personal data, including health personal information, outside the EEA. Recipients may include other organizations within the Aetna group for corporate administrative purposes, regulatory reporting, dealing with complaints or seeking legal advice. Aetna says it has appropriate contractual protections, known as model contract clauses, with the group companies that receive the data.
Supporting quotations
If we collected personal data about you in the European Economic Area (EEA), there are occasions where we may need to send your personal data, including health personal information, outside of the
EEA. Organizations that we may send your personal data to include:
Other organizations within the Aetna group for the purposes of corporate administrative, regulatory reporting, dealing with complaints or seeking legal advice. We have appropriate contractual protections (known as model contract clauses) in place with other group companies that receive your personal data.
Qualifications & exceptions
Applies if the data was collected in the EEA.
Stated as "occasions where we may need to" send data, and recipients as organizations it "may" send data to.
Not stated here
The model contract clauses are mentioned only for group companies; the notice does not name a safeguard for the other recipients, including the United States claims administration described earlier.
Sharing & Disclosure · Company practice
Data may go to health care providers overseas when you make a claim
Aetna says the organizations it may send EEA-collected personal data to outside the EEA include providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you while you are overseas.
Supporting quotations
Organizations that we may send your personal data to include:
Providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you when you are overseas.
Qualifications & exceptions
Applies where you make a claim under the insurance.
Stated as what the data "may" include.
Not stated here
The notice does not say what safeguards apply to these provider disclosures.