Notice covers EU residents on Aetna International plans
This notice says it applies to EU residents whose plans are underwritten or administered by Aetna International, Inc. and Aetna Life Insurance Company. It describes itself as explaining how personal data about the member may be used and disclosed and how the member can get access to that information.
Supporting quotations
applies to EU residents who have plans underwritten or administered by Aetna International, Inc., Aetna Life Insurance Company
This Notice describe show personal data about you may be used and disclosed and how you can get access to this information.
Qualifications & exceptions
Applies to EU residents; the notice names "plans underwritten or administered by" the two named companies.
Not stated here
The notice does not say how residency is determined, or whether a member who is not an EU resident but has an Aetna International plan is covered by this notice or a different one.
Sharing & Disclosure · Company practice
"We" means Aetna subsidiaries that share PHI as one covered entity
In this notice, "Aetna International" and "we," "us" and "our" mean all of the HMO and licensed insurer subsidiaries of Aetna Inc. Those entities are designated as a single affiliated covered entity for federal privacy purposes (the Aetna ACE). The members of the Aetna ACE can share protected health information (PHI) with each other for the treatment, payment and health care operations of the Aetna ACE, and as allowed by HIPAA and this notice.
Supporting quotations
refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information
(PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
Qualifications & exceptions
Sharing among ACE members is for treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this notice.
The "single affiliated covered entity" designation is stated to be "for federal privacy purposes."
Not stated here
The notice does not list the members of the Aetna ACE; it directs members to contact the Aetna Privacy Office at PrivacyAetna@aetna.com for the full list.
Legal Rights & Agreement Rules · Context
Named Aetna companies are data controller for their insurance policies
The notice says Aetna International, Inc. and Aetna Life Insurance Company are considered the data controller for personal data processed in relation to health plans written under its insurance policies.
Supporting quotations
Aetna International, Inc., Aetna Life Insurance Company are considered the data controller for personal data processed in relation to health plans written under its insurance policies.
Qualifications & exceptions
The controller statement refers to "health plans written under its insurance policies."
Not stated here
The scope statement covers plans "underwritten or administered" by these companies, but the controller statement mentions only plans written under insurance policies; the notice does not say who is the controller for administered plans that are not written under its policies.
The notice does not explain what being the controller means for the member beyond the rights and contact details later in the notice.
Security & Safeguards · Company commitment
Aetna treats personal information as confidential under applicable laws
Aetna says it considers personal information confidential and protects its privacy in accordance with applicable privacy laws and regulations and its own privacy policies. The notice says these laws may include, where applicable, the General Data Protection Regulation and the U.S. HIPAA Privacy Rules.
Supporting quotations
Aetna considers personal information to be confidential
We protect the privacy of that information in accordance with applicable privacy laws and regulations, as well as our own privacy policies.
These laws and regulations may include where applicable, the General Data Protection Regulation and the U.S. Health Insurance Portability and Accountability Act Privacy Rules (HIPAA Privacy Rules).
Qualifications & exceptions
The laws are described as ones that "may include where applicable" the GDPR and the HIPAA Privacy Rules; the notice does not say which law applies to which member.
Not stated here
The notice refers to Aetna's "own privacy policies" without supplying them here.
Data Access & Collection · Context
What "personal information" means and why Aetna obtains it
The notice uses "personal data," "personal information" and "Information" to mean the same thing: any information that can directly or indirectly identify you or be related to you as an individual, including health information about things such as your medical history (the health care you receive or the amounts paid for it). Aetna says it obtains this information in order to provide you with, or administer, your healthcare plan.
Supporting quotations
(personal data and personal information are considered to mean the same for the purposes of this Privacy Notice)
we mean any information that can directly or indirectly identify, or be related to, you as an individual, including health information that relates to, among other things, your medical history (i.e., the health care you receive or the amounts paid for that care). We obtain this Information in order to provide you with, or administer, your healthcare plan.
Qualifications & exceptions
"Among other things" means the health information examples are not an exhaustive list.
Legal Rights & Agreement Rules · Context
Notice effective October 1, 2025
The notice states that it becomes effective October 1, 2025.
Supporting quotations
This Notice will become effective October 1, 2025.
Not stated here
The notice does not say whether it replaces an earlier version.
Account & Service Control · Procedure
Spanish copy available through Member Services
A Spanish-language line at the top of the notice says that to receive the notice in Spanish, a member should call the toll-free Member Services number on the member ID card.
Supporting quotations
Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.
Not stated here
The notice does not give the Member Services number itself; it points to the member ID card.
Use & Processing · Company practice
Purposes: quotes, onboarding, premiums, managing the policy and claims
Aetna says it uses personal data to provide a quotation to a plan sponsor for a group plan (such as an employer) or to determine eligibility and provide a quotation to you or your broker; to onboard you onto your individual or group plan and register you for benefits; to process payments or premiums under the plan you have requested; to manage, administer and improve the policy you belong to; and to process and complete claims you make under the policy.
Supporting quotations
We use your personal data for the following purposes:
providing a quotation to a plan sponsor for group plans
determining eligibility and providing a quotation to your or your broker
onboarding you onto the individual or group plan to which you belong and registering you for its benefits
processing payments/premiums under the plan which you have requested
managing, administering and improving the policy of which are a member
processing and completing any claims you make under the policy
Qualifications & exceptions
The purposes are introduced as the purposes for which personal data is used; the list is presented without "including" or "such as" language.
Use & Processing · Company practice
Purposes: contacting you about your plan and offering wellness advice
Aetna says it uses personal data to contact you with information about your plan and to contact you to provide healthcare or wellness advice and information.
Supporting quotations
We use your personal data for the following purposes:
contacting you with information about your plan
contacting you for the purposes of providing healthcare or wellness advice and information
Not stated here
The notice does not say through which channels Aetna contacts you for these purposes.
Use & Processing · Company practice
Purposes: fraud prevention, IT security, complaints and legal rights
Aetna says it uses personal data for fraud prevention together with any other required regulatory checks; to manage its information technology and ensure the security of its systems; to investigate, respond to and deal with complaints or incidents relating to it or its business, maintain service quality and train staff; and to establish, exercise or defend legal claims or rights and protect, exercise and enforce its rights, property or safety.
Supporting quotations
We use your personal data for the following purposes:
fraud prevention together with any other required regulatory checks
managing our information technology and to ensure the security of our systems
investigating, responding to and dealing with complaints or incidents relating to us or our business and maintaining service quality and training staff
establishing, exercising and/or defending legal claims or rights and protecting, exercising and enforcing our rights, property or safety
Use & Processing · Company practice
Group plan data processed on Aetna's legitimate interest
When Aetna receives personal data about you from a plan sponsor for a group plan, it says it processes that data because it has a legitimate interest. That interest includes providing the plan sponsor with a quotation for insurance cover and, if the quotation is accepted, onboarding you as a member and administering the group insurance plan. Aetna says it has considered and balanced the potential impact on you and your rights and will process only the minimal personal data necessary for those actions.
Supporting quotations
Where we receive personal data from a plan sponsor for a group plan (i.e. the company applying to cover you under a group insurance plan), we will process your personal data as we have a legitimate interest in processing it.
Our legitimate interest includes processing for the purposes of providing the plan sponsor with a quotation for insurance cover, and where that quotation is accepted for the purposes of onboarding you as a member and administering the group insurance plan.
In any processing on this basis we have considered and balanced any potential impact on you and your rights and will only process the minimal personal data necessary for carrying out those actions.
Qualifications & exceptions
Applies where Aetna receives the data from a plan sponsor for a group plan.
The "minimal personal data necessary" limit is stated for processing on this legitimate-interest basis.
Not stated here
The notice does not describe how the balancing was done or how a member can see it.
Use & Processing · Company practice
Individual plan data processed to perform a contract with you
When Aetna receives personal data from you for individual cover, it says it processes that data for the performance of a contract with you. That includes pre-contractual discussions with you or your broker (if you have one), later performance of the insurance plan, and processing any benefits to which you are contractually entitled.
Supporting quotations
Where we receive personal data from you for individual cover, we will process your personal data for the performance of a contract with you including pre-contractual discussions with either you or your broker (if you have one), and subsequent contractual performance of the insurance plan together with processing any benefits to which you are contractually entitled.
Qualifications & exceptions
Applies where the data comes from you for individual cover.
Data Access & Collection · Company practice
Aetna says it must receive and hold health information to deal with insurance
Aetna says it will be necessary to receive and hold your health personal information for dealing with your insurance, for example to arrange, underwrite and administer the insurance contract under which you benefit, to administer a claim under the contract, or to exercise a right or comply with an obligation.
Supporting quotations
It will be necessary to receive and hold your health personal information for dealing with your insurance for example:
arranging, underwriting, administering the insurance contract under which you benefit,
administering a claim under the insurance contract, or
exercising a right or complying with an obligation.
Qualifications & exceptions
The items are introduced as examples ("for example"), so the list is not exhaustive.
Use & Processing · Company practice
Claims are administered in the United States, relying on your consent
Aetna says that when you submit a claim, the claim will be administered in the United States. To administer the claim it says it will rely on your consent to process your medical information.
Supporting quotations
Where you submit a claim, the administration of that claim will be conducted in the United States.
In order to administer the claim we will rely on your consent to process your medical information.
Qualifications & exceptions
Applies where you submit a claim.
Not stated here
This section does not say how the consent is given or withdrawn. Safeguards for sending data outside the EEA are addressed separately in the "Sending Your Personal Data Abroad" section.
Inference & Profiling · Company practice
Claims from US medical providers may be processed automatically
Where claims administration involves invoices received from US medical providers (for example, where you were treated in the United States), Aetna says it may administer your claim using automated processing. This could include automated processing of your health data, for which it says it will acquire your consent.
Supporting quotations
Where the claims administration involves invoices received from US medical providers (for example where you have received treatment in the United States), we may administer your claim using automated processing. This could include the automated processing of your health data, for which we will acquire your consent.
Qualifications & exceptions
Limited to claims involving invoices from US medical providers.
The notice says "may" use automated processing and "could include" automated processing of health data.
Not stated here
The notice does not say what the automated processing decides or how a member can ask for a person to review the result.
Group plan: data comes from the plan sponsor and is kept after a quote
For group plans, Aetna says it gets some personal data from your plan sponsor when the sponsor requests an insurance quote, and keeps that information after any quote has been accepted and the group plan starts. The information includes your name, date of birth and country of residence. Aetna says it does not process the information for any other purpose unless you submit a claim under the policy.
Supporting quotations
Group Plans: we get some personal data from your plan sponsor when they request an insurance quote from us, and we retain that information after any quote has been accepted and they start the group plan with us.
This Information includes your name, date of birth and country of residence.
We do not process your Information for any other purpose unless you submit a claim under the policy.
Qualifications & exceptions
The data named is "some" personal data, and the list says it "includes" name, date of birth and country of residence.
Not stated here
The "no other purpose" sentence sits alongside the notice's listed purposes of onboarding you and administering the group plan; the notice does not explain how the two statements fit together.
Cross-references
contrast (model-proposed): Group plan data processed on Aetna's legitimate interest — contrast: One passage says Aetna does not process group-plan data for any other purpose unless you submit a claim; the legal-basis passage says the data is processed to onboard you and administer the group plan. The notice does not reconcile them.
Data Access & Collection · Company practice
Individual plan: data from you, your broker, insurers, TPAs and providers
For individual plans, Aetna says it receives your personal data either directly from you or from an insurance broker you instructed. It may also receive some personal data from other insurers, brokers, third-party administrators (TPAs) and health care providers.
Supporting quotations
Individual Plans: where you have taken out an individual insurance plan with us, we will have received your personal data either directly from you or from an insurance broker that you instructed.
We may also receive some personal data from other insurers, brokers, third-party administrators (TPAs), and health care providers.
Please see above for the type of personal data received.
Qualifications & exceptions
The additional sources are introduced with "may" and "some."
Not stated here
The sentence refers the reader "above" for the type of personal data received. The only categories named above for any plan type are name, date of birth and country of residence for group-plan sponsor data, plus the general description of personal information.
Retention & Deletion · Company practice
Personal data kept as long as needed for benefits, claims, legal and regulatory reasons
Aetna says it keeps your personal data for as long as necessary to provide your insurance benefits, until any claim under the policy is concluded, until the time limit for exercising any legal rights has expired, or for compliance with legal or regulatory requirements. All retained personal data is subject to this privacy notice together with Aetna's internal Retention Policy and guidelines.
Supporting quotations
We retain your personal data for as long as necessary to provide you the benefits under your insurance plan, until such time as any claim under the insurance policy is concluded, until the limitation for exercising any legal rights has expired or for compliance with any legal or regulatory requirements.
All personal data that we retain is subject to this Privacy Notice together with our internal Retention Policy and guidelines.
Qualifications & exceptions
The periods are alternatives joined by "or", with no stated number of years.
See also the later statement that Aetna does not destroy information when coverage ends.
Not stated here
The internal Retention Policy and guidelines are referred to but not supplied.
Cross-references
contrast (model-proposed): Aetna does not destroy information when your coverage ends — contrast: The retention statement keeps data only as long as necessary for listed reasons; the closing statement says information is not destroyed when coverage ends. Neither gives a deletion period.
Data Access & Collection · Company practice
Information comes from many sources; uses and disclosures are not limited to those listed
Aetna says that to administer your insurance cover and related services it needs to collect information about you, from many sources: particularly your employer or benefits plan sponsor, other insurers, brokers, third-party administrators (TPAs) and health care providers. In administering your health benefits it may use and disclose information about you in various ways, "including, but not limited to" the examples that follow, for both group and individual plans.
Supporting quotations
In order to administer your insurance cover, and/or any related services in connection with your contract, we need to collect Information about you.
We obtain this Information from many different sources
particularly your employer or benefits plan sponsor, other insurers, brokers, third-party administrators (TPAs), and health care providers.
In administering your health benefits, we may use and disclose Information about you in various ways, including, but not limited to:
Group and Individual Plans: We may disclose Information about you in various ways, including, but not limited to:
Qualifications & exceptions
The sources are introduced with "particularly," so the list is not exhaustive.
Uses and disclosures are stated as "including, but not limited to" the listed examples.
Not stated here
Because the lists are not limited, the notice does not say what other uses or disclosures may occur.
Use & Processing · Company practice
Health care operations: service quality, research, disease management and similar
Aetna says it may use and disclose your information while running its health business: assessing the standard of its services and making improvements, performance measurement and outcomes assessment, licensing, accreditation by independent organizations, health services research, and preventive health, disease management, case management and care coordination. Its example is using the information to provide disease management programs for members with conditions such as diabetes, asthma or heart failure.
Supporting quotations
Health Care Operations: We may use and disclose your Information during the course of running our health business
assessing the standard of our services and implementing service enhancements and improvements; performance measurement and outcomes assessment; licensing; accreditation by independent organizations; health services research; and preventive health, disease management, case management and care coordination.
For example, we may use the Information to provide disease management programs for members with specific conditions, such as diabetes, asthma or heart failure.
Qualifications & exceptions
Described as operational activities, stated with "may."
Use & Processing · Company practice
Other operations: reinsurance, underwriting, fraud checks and general administration
Beyond the operational activities above, Aetna says other activities requiring use and disclosure of your information include administering reinsurance and stop loss; underwriting and rating; detecting and investigating fraud; administering pharmaceutical programs and payments; transferring policies or contracts from and to other health plans; and other general administrative activities such as data and information systems management and customer service.
Supporting quotations
Other operational activities requiring use and disclosure including administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans;
and other general administrative activities, including data and information systems management, and customer service.
Qualifications & exceptions
The list is introduced as "other operational activities" and ends with "other general administrative activities," so it is open-ended.
Sharing & Disclosure · Permission or license
Information may be used to facilitate a sale, merger or transfer of Aetna
Aetna lists, among its operational activities, facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity, including due diligence related to that activity. The notice treats this as a use and disclosure of your information that it may make.
Supporting quotations
facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity)
Qualifications & exceptions
Covers a sale, transfer, merger or consolidation of "all or part of Aetna," including due diligence.
Not stated here
The notice does not say what safeguards or limits apply to the other entity receiving information in such a transaction.
Use & Processing · Company practice
Payment: reviews, eligibility, premiums, appeals and disclosure to your provider
To help pay for covered services, Aetna says it may use and disclose your information in conducting utilization and medical necessity reviews, coordinating care, determining eligibility and formulary compliance, collecting premiums, calculating cost-sharing amounts, and responding to complaints, appeals and requests for external review. For example, it may use your medical history to decide whether a treatment is medically necessary and what the payment should be, and may disclose information to your provider during that process. It also says it uses information to obtain payment for any health care provider in the world for services provided to you.
Supporting quotations
Payment: To help pay for your covered services, we may use and disclose your Information in a number of ways
in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review.
we may use your medical history and other health personal information about you to decide whether a particular treatment is medically necessary and what the payment should be - and during the process, we may disclose Information to your provider.
We also use Information to obtain payment for any health care provider in the world for services provided to you.
Qualifications & exceptions
Stated with "may" and "in a number of ways"; the list is illustrative.
Sharing & Disclosure · Company practice
EOBs go to the subscriber's address and claims show online to dependents
Aetna says it mails Explanation of Benefits forms and other information to the address it has on record for the subscriber (the primary insured), which may be the subscriber's employer address, as applicable. It also makes claims information available to the subscriber and all covered dependents on its member health and telephonic claims status websites, including Aetna Navigator.
Supporting quotations
We also mail Explanation of Benefits forms and other Information to the address we have on record for the subscriber (i.e., the primary insured).
we make claims Information available to the subscriber (the primary insured) and all covered dependents on our member health and telephonic claims status websites, including Aetna Navigator
Qualifications & exceptions
Mailing goes to the subscriber's address on record, which "may be" the employer's address "as applicable."
Online claims information is available to the subscriber and all covered dependents.
Not stated here
The paper mailing can be stopped through online registration, described later in the notice; this section does not say that.
Sharing & Disclosure · Company practice
Treatment: information to doctors, pharmacies and hospitals; mail order pharmacy
Aetna says it may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you. For example, doctors may request medical information from Aetna to supplement their records. Aetna also may use personal information in providing mail order pharmacy services and may send certain information to doctors for patient safety or other treatment-related reasons.
Supporting quotations
Treatment: We may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you.
doctors may request medical information from us to supplement their own records.
We also may use personal information in providing mail order pharmacy services and by sending certain Information to doctors for patient safety or other treatment-related reasons.
Qualifications & exceptions
Disclosures go to providers who "take care of you."
Sharing & Disclosure · Company practice
Disclosure to other insurers, providers and their business associates
Aetna says it may disclose your information to other insurers, health care providers, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, it may disclose information to other health plans maintained by your employer if it has been arranged for Aetna to do so in order to have certain expenses reimbursed.
Supporting quotations
Disclosures to Other Covered Entities: We may disclose Information to other insurers, healthcare providers, or business associates of those entities for treatment, payment and certain health care operations purposes.
we may disclose Information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.
Qualifications & exceptions
Limited to treatment, payment and "certain" health care operations purposes.
The employer-plan example applies only if it "has been arranged for us to do so."
Not stated here
The notice does not say which health care operations purposes are covered.
Use & Processing · Company practice
Treatment alternatives, reminders and other health-related benefits
Aetna says it may use or disclose personal information about you in providing treatment alternatives, treatment reminders, or other health-related benefits and services. This heading introduces further reasons for disclosure, listed next.
Supporting quotations
We may use or disclose personal information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
We also may disclose such Information in support of:
Qualifications & exceptions
Stated with "may."
Sharing & Disclosure · Permission or license
Group plans: information to your employer for plan administration
For group plans, Aetna says it may disclose information to your employer, as applicable, for plan administration when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Supporting quotations
Plan Administration (Group Plans)
to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Qualifications & exceptions
Applies to group plans.
Two conditions: appropriate language in the plan documents, or summary data to assist in bidding or amending the plan.
Not stated here
The notice does not say what the required plan-document language is.
Sharing & Disclosure · Company practice
Research and business associates
Aetna says it may disclose information to researchers, provided measures are taken to protect your privacy, and to persons who provide services to Aetna and assure Aetna they will protect the information (business associates).
Supporting quotations
Research – to researchers, provided measures are taken to protect your privacy.
Business Associates – to persons who provide services to us and assure us they will protect the Information.
Qualifications & exceptions
Research disclosures are conditioned on measures being taken to protect your privacy.
Business associates must assure Aetna they will protect the information.
Not stated here
The notice does not say what privacy measures are required for research or how the assurance is documented.
Sharing & Disclosure · Company practice
Disclosure to government regulators in different countries and U.S. states
Aetna says it may disclose information to government agencies that regulate it, described as agencies in different countries and U.S. state insurance departments.
Supporting quotations
Industry Regulation – to Government agencies that regulate us (different countries and U.S. state insurance departments).
Not stated here
The notice does not name the countries or agencies.
Sharing & Disclosure · Company practice
Disclosures for workers' compensation, law enforcement, court orders and public welfare
Aetna says it may disclose information to comply with workers' compensation laws, to government law enforcement officials, in response to a court order or other lawful process, to address matters of public interest as required or permitted by law (for example child abuse and neglect, threats to public health and safety, and national security), and to comply with legal obligations and requirements. These items are part of a list that continues in the next section of the notice.
Supporting quotations
Workers’ Compensation – to comply with workers’ compensation laws.
Law Enforcement – to Government law enforcement officials.
Legal Proceedings – in response to a court order or other lawful process.
Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).
As Required by Law – to comply with legal obligations and requirements.
Qualifications & exceptions
The notice does not attach conditions to the law enforcement item itself.
Public interest disclosures are stated as "as required or permitted by law."
The notice separately says that stricter laws protecting some sensitive information can limit use and disclosure, and that information from a substance use disorder program is not used or shared in a legal case against you unless you give written consent or a court orders it.
Not stated here
The notice does not say how the sensitive-information protections apply to each disclosure on this list.
Sharing & Disclosure · Company practice
Disclosures about decedents and for organ donation
Continuing the list of additional reasons for disclosure, Aetna says it may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and to funeral directors as necessary to carry out their duties. It may also disclose information to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Supporting quotations
to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Qualifications & exceptions
Coroner and medical examiner disclosures are for the listed purposes or "as authorized by law."
Funeral director disclosures are limited to what is "necessary to carry out their duties."
Legal Rights & Agreement Rules · Company commitment
Required disclosures: to you or your representative and to the U.S. HHS Secretary
Aetna says it must use and disclose your personal information to you or someone with the legal right to act for you (your personal representative) in order to administer your rights under the notice, and to the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement.
Supporting quotations
Required Disclosures: We must use and disclose your personal information in the following manner:
To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.
Qualifications & exceptions
Disclosure to the HHS Secretary is "as necessary" for HIPAA compliance and enforcement.
Sharing & Disclosure · Company practice
Information may go to relatives, friends or others involved in your care or payment
Aetna says it may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person's involvement with your health care or payment for that care. For example, if a family member or caregiver calls with prior knowledge of a claim, Aetna may confirm whether the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.
Supporting quotations
We may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the Information is directly relevant to that person
involvement with your health care or payment for that care.
if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid.
You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.
You also have the right to ask us to restrict disclosures to persons involved in your health care.
Qualifications & exceptions
Only information "directly relevant" to the person's involvement in your care or payment for it.
Recipients include the employer and the plan subscriber, as well as relatives, friends and other people you identify.
Not stated here
A later list of rights says Aetna "will consider, but may not agree to" requests to restrict uses and disclosures, and separately says you may ask to restrict disclosures to persons involved in your care; this section does not say whether Aetna may decline a request to stop or limit this kind of disclosure.
Cross-references
contrast (model-proposed): HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse — contrast: One passage says you have the right to stop or limit disclosures to relatives and others involved in your care; the rights list says Aetna will consider but may not agree to restriction requests. The notice does not say whether Aetna may refuse the persons-involved case.
Account & Service Control · User right or choice
Minors may be able to block parental access in some circumstances
If you are a minor, the notice says you may also have the right to block parental access to your health personal information in certain circumstances, if permitted by the law of the country or U.S. state. You can contact Aetna using the Member Services number on your ID card, or have your provider contact Aetna.
Supporting quotations
If you are a minor, you also may have the right to block parental access to your health personal information in certain circumstances, if permitted by the country or U.S. state law.
You can contact us using the Member Services number on your ID card - or have your provider contact us.
Qualifications & exceptions
"May" have the right, "in certain circumstances," and only "if permitted by the country or U.S. state law."
Not stated here
The notice does not describe the circumstances or which countries' or states' laws allow it.
Legal Rights & Agreement Rules · Company commitment
Written authorization needed outside the described uses and disclosures
The notice says that in all situations other than those it describes, Aetna will ask for your written authorization before using or disclosing information about you. Its examples are marketing purposes that are unrelated to your benefit plan(s), disclosing any psychotherapy notes, and other reasons required by law.
Supporting quotations
In all situations other than those described above, we will ask for your written authorization before using or disclosing Information about you. For example, we will get your authorization:
For marketing purposes that are unrelated to your benefit plan(s),
Before disclosing any psychotherapy notes, and
For other reasons as required by law.
Qualifications & exceptions
The authorization requirement applies to situations "other than those described above," and the earlier lists of uses and disclosures are open-ended ("including, but not limited to").
The marketing example is limited to marketing "unrelated to your benefit plan(s)."
Not stated here
The notice does not list every situation that falls outside the described uses and disclosures.
Account & Service Control · User right or choice
You can revoke an authorization unless Aetna has already acted on it
If you have given Aetna an authorization, you may revoke it at any time, if Aetna has not already acted on it. For questions about authorizations, you can call the Member Services number on your ID card.
Supporting quotations
If you have given us an authorization, you may revoke it at any time, if we have not already acted on it.
If you have questions regarding authorizations, please call the Member Services number on your ID card.
Qualifications & exceptions
Revocation does not reach actions Aetna "already acted on."
Not stated here
The notice does not describe how to revoke beyond calling Member Services for questions.
Sharing & Disclosure · Restriction or exception
Recipients may redisclose PHI and HIPAA may no longer protect it
The notice warns that protected health information disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.
Supporting quotations
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
Qualifications & exceptions
Stated as "may be subject to" redisclosure.
Legal Rights & Agreement Rules · Restriction or exception
Stricter laws may limit use of sensitive health information
The notice says some state and federal laws may require special privacy protections, including requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. It lists information related to alcohol or substance use disorder, biometric information, child or adult abuse or neglect (including sexual assault), communicable diseases, genetic information, HIV/AIDS, mental health, minors, reproductive health and sexually transmitted diseases. Where it applies to Aetna, Aetna says it will follow the law that is stricter or more protective of your PHI. For more information, contact the Aetna Privacy Office.
Supporting quotations
Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information.
Alcohol or substance use disorder
Biometric Information
Child or adult abuse or neglect, including sexual assault
Communicable diseases
Genetic information
HIV/AIDs
Mental health
Minors
Reproductive health
Sexually transmitted diseases
We will follow the law that is stricter (or more protective of your PHI), where it applies to us.
please contact the Aetna Privacy Office.
Qualifications & exceptions
Stated as laws that "may" require protections; applies only where such a law applies to Aetna.
Aetna follows the stricter law "where it applies to us."
Not stated here
The notice does not identify the specific laws or say how these limits change the uses and disclosures described earlier.
Substance use disorder information received under a 42 CFR Part 2 consent
Aetna says it is not a substance use disorder treatment program but may receive or keep information about you that comes from one. If such a program provides the information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment and health care operations, Aetna will use or share it in accordance with both the consent and HIPAA. In limited situations where it may disclose this information without your permission, such as medical emergencies and government audits, Aetna says it will follow the law that is more protective of your information.
Supporting quotations
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program.
If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA.
In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information.
Qualifications & exceptions
Applies to information that comes from a substance use disorder program.
The notice cites 42 CFR Part 2 without supplying its text.
Not stated here
The notice does not list every situation in which this information may be disclosed without permission; it gives medical emergencies and government audits as examples.
Legal Rights & Agreement Rules · Restriction or exception
SUD information is not used against you in a legal case without consent or court order
Aetna says it will not use or share substance use disorder program information in any legal case against you unless you give written consent, or a court orders it with a subpoena or other legal requirement. In the court-order case, you or Aetna must also receive notice and a chance to be heard.
Supporting quotations
We will not use or share this information in any legal case against you unless:
You give us written consent, or
A court orders us with a subpoena or other legal requirement. You or Aetna must also receive notice and a chance to be heard.
Qualifications & exceptions
Two alternative conditions: your written consent, or a court order backed by a subpoena or other legal requirement.
The notice and chance to be heard applies to the court-order condition.
Not stated here
The notice says "you or Aetna" must receive notice; it does not say which of the two or how notice is given.
Data collected in the EEA may be sent outside it to other Aetna group companies
If Aetna collected personal data about you in the European Economic Area, it says there are occasions where it may need to send your personal data, including health personal information, outside the EEA. Recipients may include other organizations within the Aetna group for corporate administrative purposes, regulatory reporting, dealing with complaints or seeking legal advice. Aetna says it has appropriate contractual protections, known as model contract clauses, with the group companies that receive the data.
Supporting quotations
If we collected personal data about you in the European Economic Area (EEA), there are occasions where we may need to send your personal data, including health personal information, outside of the
EEA. Organizations that we may send your personal data to include:
Other organizations within the Aetna group for the purposes of corporate administrative, regulatory reporting, dealing with complaints or seeking legal advice. We have appropriate contractual protections (known as model contract clauses) in place with other group companies that receive your personal data.
Qualifications & exceptions
Applies if the data was collected in the EEA.
Stated as "occasions where we may need to" send data, and recipients as organizations it "may" send data to.
Not stated here
The model contract clauses are mentioned only for group companies; the notice does not name a safeguard for the other recipients, including the United States claims administration described earlier.
Sharing & Disclosure · Company practice
Data may go to health care providers overseas when you make a claim
Aetna says the organizations it may send EEA-collected personal data to outside the EEA include providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you while you are overseas.
Supporting quotations
Organizations that we may send your personal data to include:
Providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you when you are overseas.
Qualifications & exceptions
Applies where you make a claim under the insurance.
Stated as what the data "may" include.
Not stated here
The notice does not say what safeguards apply to these provider disclosures.
Inference & Profiling · Company commitment
No profiling or automated decisions, except US provider claims or when you are told
Aetna says it does not conduct any profiling or automated decision-making other than where a United States medical provider submits a claim on your behalf for treatment the provider has rendered, or in circumstances where you are expressly informed. Elsewhere the notice says that for claims involving invoices from US medical providers Aetna may administer the claim using automated processing.
Supporting quotations
We do not conduct any profiling or automated decision-making other than where a United States medical provider submits a claim on your behalf for treatment the provider has rendered or in circumstances where you are expressly informed.
we may administer your claim using automated processing
Qualifications & exceptions
The two exceptions are US provider claims and "circumstances where you are expressly informed."
Not stated here
The notice does not say what decisions are made automatically on those claims, or what the "expressly informed" circumstances are.
Use & Processing · User right or choice
Data protection rights: access, correction, erasure, restriction, transfer, objection
The notice says that under certain circumstances you have the right to request access to your information, request correction of information Aetna holds about you, request erasure, request restriction of processing, request transfer of the personal information you provided in a commonly used electronic format, and object to processing where Aetna relies on a legitimate interest and your particular situation gives you grounds to object.
Supporting quotations
Under certain circumstances you have the right to:
Request access to your Information
Request correction of the Information that we hold about you.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of personal information that you have provided to us in a commonly used electronic format.
Object to us processing your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Qualifications & exceptions
All of these rights are stated to apply "under certain circumstances."
Erasure is described as asking Aetna to delete or remove information "where there is no good reason" for continuing to process it.
Restriction is described as asking Aetna to suspend processing, for example while its accuracy or the reason for processing is established.
The right to object is tied to processing based on a legitimate interest and your particular situation.
Not stated here
The notice does not say what the circumstances are, how quickly Aetna responds, or whether a fee may apply to these requests.
Account & Service Control · Procedure
Exercise data protection rights by emailing PrivacyInternational@CVSHealth.com
To review, verify, correct or request erasure of your personal information, object to processing, or request that Aetna transfer a copy of your personal information to another party, the notice says to contact PrivacyInternational@CVSHealth.com.
Supporting quotations
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact PrivacyInternational@CVSHealth.com.
Qualifications & exceptions
A later sentence says you may make "any of the requests described above" by calling the Member Services number, so a second route is also described.
Not stated here
The notice does not describe identity checks or a response deadline.
Account & Service Control · User right or choice
HIPAA right: ask Aetna to communicate with you a certain way or place
Under HIPAA you have the right to ask Aetna to communicate with you in a certain way or at a certain location. Aetna says it will accommodate reasonable requests. For example, an adult dependent might ask Aetna to send health information such as Explanation of Benefits and other claim information to a different address than the subscriber's.
Supporting quotations
Pursuant to HIPAA, you have the right to:
Ask us to communicate with you in a certain way or at a certain location. We will accommodate reasonable requests. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits (EOB) and other claim information to a different address from that of your subscriber.
Qualifications & exceptions
Aetna accommodates "reasonable" requests.
Use & Processing · User right or choice
HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse
You may ask Aetna to restrict how it uses or discloses information about you in connection with health care operations, administration, payment and treatment. Aetna says it will consider, but may not agree to, such requests. You also have the right to ask Aetna to restrict disclosures to persons involved in your health care.
Supporting quotations
Restrict the way we use or disclose Information about you in connection with health care operations, administration, payment and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care.
Qualifications & exceptions
Aetna "may not agree" to restriction requests.
Not stated here
The notice does not say whether Aetna may decline a request to restrict disclosures to persons involved in your care, which is stated as a separate sentence.
Account & Service Control · User right or choice
HIPAA right: request your records in a designated record set
You have the right to request information held about you that is contained in a "designated record set," described as medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management and other decisions. Aetna may ask you to make the request in writing and may charge a reasonable fee for producing and mailing the copies.
Supporting quotations
Request Information held about you that is contained in a
medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management and other decisions.
We may ask you to make your request in writing and may charge a reasonable fee for producing and mailing the copies.
Qualifications & exceptions
Aetna "may" require a written request and "may" charge a reasonable fee for copies and mailing.
Account & Service Control · User right or choice
HIPAA right: ask to amend incorrect information
You have the right to request that incorrect information be amended. Aetna may require the request to be in writing, validated, and to include the reason for the request. If Aetna denies the request, you may file a written statement of disagreement.
Supporting quotations
Request to amend Information that is incorrect. We may require that this request be in writing, validated, and include the reason for the request. If we deny the request, you may file a written statement of disagreement.
Qualifications & exceptions
Aetna "may require" the request to be in writing, validated and to state a reason.
Not stated here
The notice does not say what happens to the statement of disagreement.
Account & Service Control · User right or choice
HIPAA right: obtain a list of certain disclosures (in writing)
You have the right to obtain a list of certain disclosures Aetna has made about you, such as disclosures of health personal information to government agencies that license it, where permitted by law. The request must be in writing.
Supporting quotations
Obtain a list of certain disclosures we have made about you, such as disclosures of health personal information to government agencies that license us, where permitted by law. Your request must be in writing.
Qualifications & exceptions
Covers "certain" disclosures only, "where permitted by law."
The request must be in writing.
Not stated here
The notice does not say which disclosures are included or excluded.
Use & Processing · User right or choice
Right to opt out of advertising and marketing campaigns
The notice lists, among your HIPAA rights, the right to opt out of advertising and marketing campaigns.
Supporting quotations
Opt out of advertising and marketing campaigns.
Not stated here
The notice does not say how to opt out or which campaigns this covers, and earlier text separately requires written authorization for marketing unrelated to your benefit plan(s).
Security & Safeguards · User right or choice
Right to be notified of a breach involving your health information
The notice lists the right to be notified following a breach involving your health personal information.
Supporting quotations
Be notified following a breach involving your health personal information.
Not stated here
The notice does not say how or how quickly you will be notified.
Use & Processing · User right or choice
Reasons for unfavorable underwriting decisions; genetic information not used
You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future ones unless Aetna makes an independent evaluation of the basic facts. Your genetic personal information cannot be used for underwriting purposes.
Supporting quotations
Know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic personal information cannot be used for underwriting purposes.
Qualifications & exceptions
An earlier unfavorable decision can be relied on only if Aetna makes an independent evaluation of the basic facts.
Data Access & Collection · User right or choice
Right not to be subjected to pretext interviews, with very limited exceptions
The notice says you have the right, with very limited exceptions, not to be subjected to pretext interviews. A footnote marker follows the statement.
Supporting quotations
You have the right with very limited exceptions, not to be subjected to pretext interviews.
Qualifications & exceptions
"With very limited exceptions."
Not stated here
The notice does not describe the exceptions. The footnote the marker points to is covered with the end of the notice.
Cross-references
contrast (model-proposed): Footnote: Aetna does not participate in pretext interviews — contrast: The rights list says there are very limited exceptions to the right not to be subjected to pretext interviews; the footnote says Aetna does not participate in them. The notice does not describe the exceptions.
Account & Service Control · Procedure
Request a paper copy or make requests by phone; file a HIPAA complaint
You may make any of the requests described above, request a paper copy of the notice, or ask questions about it by calling the Member Services number on your ID card. You also have the right to file a complaint if you think your privacy rights under HIPAA have been violated, by sending your inquiry to the HIPAA Member Rights Team using the contact details below.
Supporting quotations
You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by calling the Member Services number on your ID card.
You also have the right to file a complaint if you think your privacy rights under HIPAA have been violated. To do so, please send your inquiry to the HIPAA Member Rights Team by using the contact details below.
Qualifications & exceptions
The phone route is described as available for "any of the requests described above."
Account & Service Control · Procedure
Contact Aetna by email or mail for questions, rights requests and complaints
For questions about the notice, to exercise any of your rights, or for questions or complaints about how Aetna handles or protects personal data, the notice gives an email address, PrivacyInternational@CVSHealth.com, and a mailing address for the HIPAA Member Rights Team: P.O. Box 14079, Lexington, KY 40512-4079.
Supporting quotations
For any questions about this Privacy Policy, to exercise any of your rights listed above, or for any questions or complaints regarding the manner in which we handle or protect personal data, we can be contacted as follows:
Email: PrivacyInternational@CVSHealth.com
HIPAA Member Rights Team Contact: HIPAA Member Rights Team P.O. Box 14079 Lexington, KY 40512-4079
Account & Service Control · User right or choice
Stop paper EOB mailings by registering at aetna.com
You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com, selecting "Log In/Register," and completing a one-time registration. After that you can log in at any time to view past copies of EOBs and other claim information.
Supporting quotations
You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com and click
Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information.
Legal Rights & Agreement Rules · User right or choice
You may complain to the data protection agency without penalty
The notice says you may also have the right to take your complaint to the applicable data protection agency, and that you will not be penalized for filing a complaint.
Supporting quotations
You may also have the right to take your complaint to the applicable data protection agency. You will not be penalized for filing a complaint.
Qualifications & exceptions
Stated as "may also have the right," depending on the applicable agency.
Not stated here
The notice does not name the agency.
Legal Rights & Agreement Rules · Company commitment
Privacy regulations require Aetna to keep information private and follow the notice
The notice says privacy regulations require Aetna to keep your information private, confidential and secure, to give you notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Supporting quotations
Privacy regulations require us to keep Information about you private, confidential, and secure, to give you notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.
Not stated here
The notice does not name the regulations.
Security & Safeguards · Company practice
Administrative, technical and physical safeguards
Aetna says it guards your information with administrative, technical and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity.
Supporting quotations
We guard your Information with administrative, technical, and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity.
Not stated here
The notice does not describe the specific safeguards.
Legal Rights & Agreement Rules · Permission or license
Aetna may change this notice and its policies at any time, for all information it holds
Aetna says it may change the terms of this notice and its privacy policies at any time. If it does, the new terms and policies will be effective for all of the information it already has about you, as well as any information it may receive or hold in the future. The notice also says privacy regulations require Aetna to follow the terms of the notice currently in effect.
Supporting quotations
We may change the terms of this Notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the Information that we already have about you, as well as any Information that we may receive or hold in the future.
to follow the terms of the Notice currently in effect.
Qualifications & exceptions
New terms apply to information already held as well as future information.
Aetna must follow the notice "currently in effect," which would be the changed version after a change.
Not stated here
The notice does not say how members are told about changes.
Retention & Deletion · Company practice
Aetna does not destroy information when your coverage ends
Aetna says it does not destroy information about you when you terminate your coverage. It says it may be necessary to use and disclose the information for legal and regulatory reasons, for the purposes described in the notice, even after coverage terminates, although policies and procedures remain in place to protect against inappropriate use or disclosure.
Supporting quotations
Please note that we do not destroy Information about you when you terminate your coverage with us.
It may be necessary to use and disclose this information, for legal and regulatory reasons, for the purposes described above even after your coverage terminates, although policies and procedures will remain in place to protect against inappropriate use or disclosure.
Qualifications & exceptions
Described as legal and regulatory reasons "for the purposes described above"; stated as "may be necessary."
The notice's earlier retention statement says data is kept "as long as necessary," with no fixed period.
Not stated here
The notice does not give a period after which information is deleted.
Data Access & Collection · Company commitment
Footnote: Aetna does not participate in pretext interviews
A footnote at the end of the notice says Aetna does not participate in pretext interviews. It follows the earlier statement that you have the right, with very limited exceptions, not to be subjected to pretext interviews.
Supporting quotations
We do not participate in pre-text interviews.
You have the right with very limited exceptions, not to be subjected to pretext interviews.
Qualifications & exceptions
The footnote does not repeat the "very limited exceptions" wording used in the rights list.
Not stated here
The notice does not say what the exceptions in the rights list are, or how they square with the footnote's statement that Aetna does not participate in pretext interviews.