Aetna voluntary plans notice of privacy practices

Aetna / CVS Health · agreement dated October 1, 2025 · Official agreement

79 of 86 blocks carry cards. 48 cards.

Notice of Privacy Practices

Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.

This Notice of Privacy Practices applies to Aetna’s insured health benefit plans. It does not apply to any plans that are self-funded by an employer. Your employer will be able to tell you if your plan is insured or self-funded. If you plan is self-funded, you may want to ask for a copy of your employer’s privacy notice.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Please review it carefully.

Aetna1 considers personal information confidential. We protect the privacy of that information in accordance with federal and state privacy laws, as well as our own company privacy policies.

This notice describes how we may use and disclose information about you in administering your benefits, and it explains your legal rights regarding the information.

When we use the term “personal information,” we mean information that identifies you as an individual, such as your name and Social Security Number, as well as financial, health and other information about you that is nonpublic, and that we obtain so we can provide you with insurance coverage. By “health information,” we mean information that identifies you and relates to your medical history (i.e., the health care you receive or the amounts paid for that care).

This notice became effective on October 1, 2025.

How Aetna Uses and Discloses Personal Information

In order to provide you with insurance coverage, we need personal information about you, and we obtain that information from many different sources – particularly your employer or benefits plan sponsor, other insurers, HMOs, or third-party administrators (TPAs), and health care providers. In administering your health benefits, we may use and disclose personal information about you in various ways, including:

Health Care Operations: We may use and disclose personal information during the course of running our health business – that is, during operational activities such as quality assessment and improvement; licensing; accreditation by independent organizations; performance measurement and outcomes assessment; health services research; and preventive health, disease management, case management and care coordination. For example, we may use the information to provide disease management programs for members with specific conditions, such as diabetes, asthma, or heart failure. Other operational activities requiring use and disclosure include administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans; facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity); and other general administrative activities, including data and information systems management, and customer service.

Payment: To help pay for your covered services, we may use and disclose personal information in a number of ways – in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review. For example, we may use your medical history and other health information about you to decide whether a particular treatment is medically necessary and what the payment should be – and during the process, we may disclose information to your provider. We also mail Explanation of Benefits forms and other information to the address we have on record for the subscriber (i.e., the primary insured). We also use personal information to obtain payment for any mail order pharmacy services provided to you.

1 For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These

entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information (PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

GR-68113 (2-26) AVP Page 1 of 4 R-POD J

Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records. We also may use personal information in providing mail order pharmacy services and by sending certain information to doctors for patient safety or other treatment-related reasons.

Disclosures to Other Covered Entities: We may disclose personal information to other covered entities, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, we may disclose personal information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.

Additional Reasons for Disclosure

We may use or disclose health information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services. We also may disclose such information in support of:

Required Disclosures: We must use and disclose your personal information in the following manner:

  • To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
  • To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.

Disclosure to Others Involved in Your Health Care

We may disclose personal information about you to a relative, a friend, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person’s involvement with your health care or payment for that care. For example, if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the toll-free Customer Service number at 1-888-772-9682.

If you are a minor, you also may have the right to block parental access to your health information in certain circumstances, if permitted by state law. You can contact us using the toll-free Customer Service number at 1-888-772-9682 – or have your provider contact us.

In all situations other than those described above, we will ask for your written authorization before using or disclosing personal information about you. For example, we will get your authorization:

If you have given us an authorization, you may revoke it in writing at any time, if we have not already acted on it. If you have questions regarding authorizations, please call the toll-free Customer Service number at 1-888-772-9682. PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

GR-68113 (2-26) AVP Page 2 of 4 J

Additional Restrictions on Use and Disclosure

Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:

We will follow the law that is stricter (or more protective of your PHI), where it applies to us. If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.

Substance Use Disorder Information

We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:

You or Aetna must also receive notice and a chance to be heard.

Your Legal Rights

The federal privacy regulations give you several rights regarding your health information.

  • You have the right to ask us to communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits

(EOB) and other claim information) to a different address from that of your subscriber. We will accommodate reasonable requests.

  • You have the right to ask us to restrict the way we use or disclose health information about you in connection with health care operations, payment, and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care.
  • You have the right to ask us to obtain a copy of health information that is contained in a “designated record set” – medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management, and other decisions. We may ask you to make your request in writing, may charge a reasonable fee for producing and mailing the copies and, in certain cases, may deny the request.
  • You have the right to ask us to amend health information that is in a “designated record set.” Your request must be in writing and must include the reason for the request. If we deny the request, you may file a written statement of disagreement.
  • You have the right to ask us to provide a list of certain disclosures we have made about you, such as disclosures of health information to government agencies that license us. Your request must be in writing. If you request such an accounting more than once in a 12-month period, we may charge a reasonable fee.
  • You have the right to be notified following a breach involving your health information.
  • You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic information cannot be used for underwriting purposes.
  • You have the right with very limited exceptions, not to be subjected to pretext interviews.2 You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by calling the toll-free Customer Service number at 1-888-772-9682.

You also have the right to file a complaint if you think your privacy rights have been violated. To do so, please send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send your request to the following address:

HIPAA Member Rights Team P.O. Box 14079 Lexington, KY 40512-4079

You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com and click “Log In/Register”. Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information.

You also may write to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

Aetna’s Legal Obligations

The federal privacy regulations require us to keep personal information about you private, to give you notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

Safeguarding Your Information

We guard your information with administrative, technical, and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity. We comply with all applicable state and federal law pertaining to the security and confidentiality of personal information.

This Notice is Subject to Change

We may change the terms of this notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the information that we already have about you, as well as any information that we may receive or hold in the future.

Please note that we do not destroy personal information about you when you terminate your coverage with us. It may be necessary to use and disclose this information for the purposes described above even after your coverage terminates, although policies and procedures will remain in place to protect against inappropriate use or disclosure.

2 We do not participate in pretext interviews.

Coverage may be underwritten or administered by one or more of the following companies: Aetna Health Inc.; Aetna Health of California Inc.; Aetna Dental of California Inc.; Aetna Dental Inc.; Aetna Life Insurance Company; Aetna Insurance Company of Connecticut; Aetna Health Insurance Company of New York; and Corporate Health Insurance Company. Mail order pharmacy services may be provided by Aetna Rx Home Delivery, LLC.