Legal Rights & Agreement Rules · Restriction or exception
Notice covers insured plans, not employer self-funded plans
This notice covers Aetna’s insured health benefit plans. It does not cover plans that an employer funds itself (self-funded plans). The notice says your employer can tell you whether your plan is insured or self-funded, and suggests that if yours is self-funded you may want to ask for a copy of your employer’s own privacy notice.
Supporting quotations
This Notice of Privacy Practices applies to Aetna’s insured health benefit plans. It does not apply to any plans that are self-funded by an employer.
Your employer will be able to tell you if your plan is insured or self-funded.
If you plan is self-funded, you may want to ask for a copy of your employer’s privacy notice.
Qualifications & exceptions
Applies only to insured plans
Self-funded employer plans are excluded
Not stated here
The text never uses the word “voluntary” or lists which products count as Aetna’s insured health benefit plans, so the scope is only as stated here
The employer’s own privacy notice for a self-funded plan is not supplied
Account & Service Control · Procedure
Spanish copy available by calling Member Services
A line in Spanish says that to receive this notice in Spanish you should call the toll-free Member Services number printed on your ID card.
Supporting quotations
Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.
Qualifications & exceptions
Request is made by phone using the number on the ID card
Not stated here
The Spanish version is not part of the supplied text
Legal Rights & Agreement Rules · Context
Notice effective October 1, 2025
The notice states that it became effective on October 1, 2025.
Supporting quotations
This notice became effective on October 1, 2025.
Qualifications & exceptions
Effective date as stated in the notice
Not stated here
The page footers carry a form code, “GR-68113 (2-26)”, which the text does not explain; the notice does not say whether it relates to a later printing than the stated effective date
Data Access & Collection · Context
What “personal information” and “health information” mean
In this notice, “personal information” means information that identifies you as an individual, such as your name and Social Security Number, together with financial, health and other information about you that is nonpublic and that Aetna obtains so it can provide you with insurance coverage. “Health information” means information that identifies you and relates to your medical history, meaning the health care you receive or the amounts paid for it.
Supporting quotations
When we use the term “personal information,” we mean information that identifies you as an individual, such as your name and Social Security Number, as well as financial, health and other information about you that is nonpublic, and that we obtain so we can provide you with insurance coverage.
By “health information,” we mean information that identifies you and relates to your medical history (i.e., the health care you receive or the amounts paid for that care).
Qualifications & exceptions
Personal information is information that is nonpublic
Obtained in order to provide insurance coverage
Name and Social Security Number are given as examples
Not stated here
Only examples of personal information are named; the full range is not listed
Legal Rights & Agreement Rules · Company commitment
Aetna treats personal information as confidential
Aetna says it considers personal information confidential and protects its privacy in line with federal and state privacy laws and its own company privacy policies. The notice explains how Aetna may use and disclose information in administering your benefits and your legal rights over that information. Near the end it adds that the federal privacy regulations require Aetna to keep your personal information private, to give you notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Supporting quotations
Aetna1 considers personal information confidential. We protect the privacy of that information in accordance with federal and state privacy laws, as well as our own company privacy policies.
This notice describes how we may use and disclose information about you in administering your benefits, and it explains your legal rights regarding the information.
Aetna’s Legal Obligations
The federal privacy regulations require us to keep personal information about you private, to give you notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Qualifications & exceptions
Protection is described as being in accordance with federal and state privacy laws and Aetna’s own policies
Duty to follow the notice currently in effect
Not stated here
The notice does not name the specific federal or state laws or the company policies
Data Access & Collection · Company practice
Where Aetna gets personal information
Aetna says it needs personal information about you to provide insurance coverage and gets it from many different sources, particularly your employer or benefits plan sponsor, other insurers, HMOs or third-party administrators, and health care providers.
Supporting quotations
In order to provide you with insurance coverage, we need personal information about you, and we obtain that information from many different sources – particularly your employer or benefits plan sponsor, other insurers, HMOs, or third-party administrators (TPAs), and health care providers.
Qualifications & exceptions
“Particularly” signals the named sources are the main ones, not a closed list
Purpose given is providing insurance coverage
Not stated here
Sources other than those named are not identified
Use & Processing · Permission or license
Use and disclosure for health care operations
Aetna says it may use and disclose personal information while running its health business. The activities named include quality assessment and improvement, licensing, accreditation by independent organizations, performance measurement and outcomes assessment, health services research, and preventive health, disease management, case management and care coordination. For example, it may use information to run disease management programs for members with conditions such as diabetes, asthma or heart failure.
Supporting quotations
Health Care Operations: We may use and disclose personal information during the course of running our health business – that is, during operational activities such as quality assessment and improvement; licensing; accreditation by independent organizations; performance measurement and outcomes assessment; health services research; and preventive health, disease management, case management and care coordination.
For example, we may use the information to provide disease management programs for members with specific conditions, such as diabetes, asthma, or heart failure.
Qualifications & exceptions
Stated as “may”, not “will”
Listed activities are introduced by “such as”, so the list is illustrative
Later sections say stricter state or federal law can limit the use of certain sensitive information
Not stated here
Which disclosures happen in practice is not stated
Use & Processing · Permission or license
Other operational uses: underwriting, fraud, mergers and sales
Aetna lists further operational activities that require use and disclosure of personal information: reinsurance and stop loss; underwriting and rating; fraud detection and investigation; pharmaceutical programs and payments; transfer of policies or contracts to and from other health plans; facilitating a sale, transfer, merger or consolidation of all or part of Aetna with another entity, including due diligence; and general administration such as data and information systems management and customer service. A later section on your rights says your genetic information cannot be used for underwriting purposes.
Supporting quotations
Other operational activities requiring use and disclosure include administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans; facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity); and other general administrative activities, including data and information systems management, and customer service.
Qualifications & exceptions
Introduced as activities “requiring use and disclosure”
“Including” means the list is not necessarily complete
Genetic information cannot be used for underwriting (rights section)
Not stated here
The passage does not say who receives information in due diligence for a sale or merger or what protections apply there
Use & Processing · Permission or license
Use and disclosure for payment
To help pay for your covered services, Aetna may use and disclose personal information in conducting utilization and medical necessity reviews, coordinating care, determining eligibility, determining formulary compliance, collecting premiums, calculating cost-sharing amounts, and responding to complaints, appeals and requests for external review. For example, it may use your medical history and other health information to decide whether a treatment is medically necessary and what the payment should be, and it may disclose information to your provider during that process. It also uses personal information to obtain payment for mail order pharmacy services provided to you.
Supporting quotations
Payment: To help pay for your covered services, we may use and disclose personal information in a number of ways – in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review.
For example, we may use your medical history and other health information about you to decide whether a particular treatment is medically necessary and what the payment should be – and during the process, we may disclose information to your provider.
We also use personal information to obtain payment for any mail order pharmacy services provided to you.
Qualifications & exceptions
The permission is stated as “may”
The mail order pharmacy sentence says “we also use”, a statement of practice rather than a “may”
Later sections say stricter state or federal law can limit the use of certain sensitive information
Sharing & Disclosure · Company practice
Explanation of Benefits mailed to the subscriber’s address
Aetna says it mails Explanation of Benefits forms and other information to the address it has on record for the subscriber, meaning the primary insured. Other sections of the notice let you ask for communications to go to a different address and let you stop paper mailing of EOBs by registering online.
Supporting quotations
We also mail Explanation of Benefits forms and other information to the address we have on record for the subscriber (i.e., the primary insured).
Qualifications & exceptions
Address used is the one on record for the subscriber, not necessarily the member
You can ask for a different address and can stop paper EOBs through online registration (rights section)
Not stated here
“Other information” mailed is not specified
Sharing & Disclosure · Permission or license
Disclosure to health care providers for treatment
Aetna says it may disclose information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you; for example, doctors may request medical information from Aetna to supplement their own records. It also may use personal information to provide mail order pharmacy services and send certain information to doctors for patient safety or other treatment-related reasons.
Supporting quotations
Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records. We also may use personal information in providing mail order pharmacy services and by sending certain information to doctors for patient safety or other treatment-related reasons.
Qualifications & exceptions
Recipients are providers who take care of you
Stated as “may”
Later sections say stricter state or federal law can limit the disclosure of certain sensitive information
Not stated here
What counts as “certain information” sent for patient safety is not specified
Sharing & Disclosure · Permission or license
Disclosure to other covered entities and their business associates
Aetna says it may disclose personal information to other covered entities, or to their business associates, for treatment, payment and certain health care operations purposes. For example, it may disclose information to other health plans maintained by your employer if it has been arranged for Aetna to do so in order to have certain expenses reimbursed.
Supporting quotations
Disclosures to Other Covered Entities: We may disclose personal information to other covered entities, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, we may disclose personal information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.
Qualifications & exceptions
Limited to treatment, payment and certain health care operations purposes
Employer-plan example applies only where it has been arranged for Aetna to do so
Not stated here
Which health care operations purposes are “certain” is not specified
Sharing & Disclosure · Company practice
“Aetna” means a group of subsidiaries that share protected health information
In this notice, “Aetna”, “we”, “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities are designated as a single affiliated covered entity for federal privacy purposes, and its members can share protected health information (PHI) with each other for the treatment, payment and health care operations of the group and as allowed by HIPAA and this notice. A full list of the members is available by contacting the Aetna Privacy Office at PrivacyAetna@aetna.com.
Supporting quotations
For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These
entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information (PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.
Qualifications & exceptions
Sharing within the group is for treatment, payment and health care operations and as allowed by HIPAA and this notice
The footnote is split across a page break in the source (it ends “These” and continues “entities”) and is read here as one passage
Not stated here
The member list is not in the notice; whether the mail order pharmacy entity named at the end of the notice is a member is not stated
Use & Processing · Permission or license
Treatment alternatives, reminders and other health-related benefits and services
Aetna says it may use or disclose health information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
Supporting quotations
Additional Reasons for Disclosure
We may use or disclose health information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services.
Qualifications & exceptions
Stated as “may”
Applies to health information (the notice’s defined term), not all personal information
Later sections say stricter state or federal law can limit the use of certain sensitive information
Not stated here
Who delivers these alternatives, reminders or services is not stated
Sharing & Disclosure · Permission or license
Disclosure to your employer for plan administration
Aetna says it may disclose health information to your employer in support of plan administration, either when Aetna has been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Supporting quotations
We also may disclose such information in support of:
Plan Administration – to your employer, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
Qualifications & exceptions
Two stated circumstances: Aetna has been informed appropriate language is in the plan documents, or summary data is disclosed for bidding or amending a group health plan
Stated as “may”
Not stated here
The notice does not say what the “appropriate language” is, or what information beyond summary data the employer can receive under the first circumstance
Sharing & Disclosure · Permission or license
Disclosure to researchers
Aetna says it may disclose health information to researchers, provided measures are taken to protect your privacy.
Supporting quotations
We also may disclose such information in support of:
Research – to researchers, provided measures are taken to protect your privacy.
Qualifications & exceptions
Condition: measures are taken to protect your privacy
Stated as “may”
Not stated here
The notice does not describe the privacy measures or who decides they are adequate
Sharing & Disclosure · Permission or license
Disclosure to business partners who assure protection
Aetna says it may disclose health information to persons who provide services to it and who assure Aetna that they will protect the information.
Supporting quotations
We also may disclose such information in support of:
Business Partners – to persons who provide services to us and assure us they will protect the information.
Qualifications & exceptions
Recipients must provide services to Aetna
Condition: they assure Aetna they will protect the information
Stated as “may”
Not stated here
The services, the recipients and the form of assurance are not specified in the notice
Sharing & Disclosure · Permission or license
Disclosure to regulators and for workers’ compensation
Aetna says it may disclose health information to state insurance departments, boards of pharmacy, the U.S. Food and Drug Administration, the U.S. Department of Labor and other government agencies that regulate it, and to comply with workers’ compensation laws.
Supporting quotations
We also may disclose such information in support of:
Industry Regulation – to state insurance departments, boards of pharmacy, U.S. Food and Drug Administration, U.S. Department of Labor and other government agencies that regulate us.
Workers’ Compensation – to comply with workers’ compensation laws.
Qualifications & exceptions
Regulator recipients are agencies that regulate Aetna
Workers’ compensation disclosure is to comply with those laws
Stated as “may”
Not stated here
“Other government agencies that regulate us” is open-ended and no agencies beyond those named are identified
Sharing & Disclosure · Permission or license
Disclosure to law enforcement and in legal proceedings
Aetna says it may disclose health information to federal, state and local law enforcement officials, and in response to a court order or other lawful process.
Supporting quotations
We also may disclose such information in support of:
Law Enforcement – to federal, state, and local law enforcement officials.
Legal Proceedings – in response to a court order or other lawful process.
Qualifications & exceptions
Stated as “may”
Legal proceedings disclosure is in response to a court order or other lawful process
Later sections say stricter state or federal law can limit the disclosure of certain sensitive information
Not stated here
The law enforcement entry states no conditions of its own, and what counts as “other lawful process” is not defined
Sharing & Disclosure · Permission or license
Disclosure for public welfare and as required by law
Aetna says it may disclose health information to address matters of public interest as required or permitted by law, for example child abuse and neglect, threats to public health and safety, and national security, and to comply with legal obligations and requirements.
Supporting quotations
We also may disclose such information in support of:
Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).
As Required by Law – to comply with legal obligations and requirements.
Qualifications & exceptions
Public welfare disclosures are those “required or permitted by law”
Examples are introduced by “e.g.” and are not a closed list
Stated as “may”
Not stated here
Recipients of public welfare disclosures are not named
Sharing & Disclosure · Permission or license
Disclosure about deceased people and organ donation
Aetna says it may disclose health information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law; to funeral directors as necessary to carry out their duties; and to organ donation groups to facilitate donation and transplantation.
Supporting quotations
We also may disclose such information in support of:
Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.
Qualifications & exceptions
Funeral director disclosure is limited to what is necessary to carry out their duties
Stated as “may”
Legal Rights & Agreement Rules · Company practice
Disclosures Aetna must make
Aetna says it must use and disclose your personal information to you or to someone with the legal right to act for you (your personal representative) in order to administer your rights under this notice, and to the Secretary of the Department of Health and Human Services as necessary for HIPAA compliance and enforcement.
Supporting quotations
Required Disclosures: We must use and disclose your personal information in the following manner:
To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.
Qualifications & exceptions
Stated as “must”, unlike the “may” permissions elsewhere
Disclosure to the HHS Secretary is limited to what is necessary for HIPAA compliance and enforcement
Sharing & Disclosure · User right or choice
Disclosure to people involved in your care, and your right to stop it
Aetna says it may disclose personal information to a relative, friend, the subscriber of your health plan or any other person you identify, provided the information is directly relevant to that person’s involvement with your health care or payment for it. For example, if a family member or caregiver calls with prior knowledge of a claim, Aetna may confirm whether the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the toll-free Customer Service number given in the notice.
Supporting quotations
Disclosure to Others Involved in Your Health Care
We may disclose personal information about you to a relative, a friend, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person’s involvement with your health care or payment for that care.
For example, if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid.
You have the right to stop or limit this kind of disclosure by calling the toll-free Customer Service number at 1-888-772-9682.
Qualifications & exceptions
Condition: information is directly relevant to the person’s involvement with your care or payment
The example involves a caller who already knows about the claim
You can stop or limit this kind of disclosure by phone
Not stated here
The notice does not say how quickly a stop or limit takes effect
Cross-references
contrast (model-proposed): Right to ask for restrictions, which Aetna may refuse — contrast: One section describes a right to stop or limit disclosure to people involved in your care by phone; the rights section describes a right to ask Aetna to restrict such disclosures. The notice does not say whether the request can be refused for these disclosures, as it can for operations, payment and treatment.
Account & Service Control · User right or choice
Minors may be able to block parental access
If you are a minor, you also may have the right to block parental access to your health information in certain circumstances, if state law permits. You can call the toll-free Customer Service number in the notice, or have your provider contact Aetna.
Supporting quotations
If you are a minor, you also may have the right to block parental access to your health information in certain circumstances, if permitted by state law. You can contact us using the toll-free Customer Service number at 1-888-772-9682 – or have your provider contact us.
Qualifications & exceptions
Only “may”: depends on circumstances and on state law permitting it
Contact is by phone or through your provider
Not stated here
The circumstances and the state laws involved are not described
Legal Rights & Agreement Rules · Company commitment
Written authorization needed for other uses and disclosures
Aetna says that in all situations other than those described above it will ask for your written authorization before using or disclosing personal information about you. Examples where it will get your authorization: marketing unrelated to your benefit plan(s), before disclosing any psychotherapy notes, in connection with the sale of your health information, and for other reasons required by law.
Supporting quotations
In all situations other than those described above, we will ask for your written authorization before using or disclosing personal information about you. For example, we will get your authorization:
for marketing purposes that are unrelated to your benefit plan(s),
before disclosing any psychotherapy notes,
related to the sale of your health information, and
for other reasons as required by law.
Qualifications & exceptions
Authorization requirement applies outside the situations described earlier in the notice
The four items are introduced as examples
Not stated here
Marketing that is related to your benefit plan(s) is not addressed in this passage
Account & Service Control · User right or choice
You can revoke an authorization in writing
If you have given Aetna an authorization, you may revoke it in writing at any time, if Aetna has not already acted on it. Questions about authorizations can be directed to the toll-free Customer Service number in the notice.
Supporting quotations
If you have given us an authorization, you may revoke it in writing at any time, if we have not already acted on it.
If you have questions regarding authorizations, please call the toll-free Customer Service number at 1-888-772-9682.
Qualifications & exceptions
Revocation must be in writing
Does not undo what Aetna has already acted on
Sharing & Disclosure · Context
Information disclosed under HIPAA may be redisclosed
The notice warns that protected health information disclosed as permitted by HIPAA may be redisclosed by the recipient and may then no longer be protected by HIPAA.
Supporting quotations
PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.
Qualifications & exceptions
Applies to PHI disclosed as permitted by HIPAA
Not stated here
The notice does not say which recipients or what other protections might apply after redisclosure
Legal Rights & Agreement Rules · Restriction or exception
Categories of sensitive information that laws may protect
The notice says some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. It lists information related to alcohol or substance use disorder, biometric information, child or adult abuse or neglect including sexual assault, communicable diseases, genetic information, HIV/AIDS, mental health, minors, reproductive health, and sexually transmitted diseases.
Supporting quotations
Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:
Alcohol or substance use disorder
Biometric Information
Child or adult abuse or neglect, including sexual assault
Communicable diseases
Genetic information
HIV/AIDs
Mental health
Minors
Reproductive health
Sexually transmitted diseases
Qualifications & exceptions
Stated as “may”: some laws may require protections
Protections vary by law and by type of information
Not stated here
The laws themselves are not named or supplied, and the notice does not say which protections apply to which category
Legal Rights & Agreement Rules · Restriction or exception
Stricter law is followed where it applies
For sensitive information, Aetna says it will follow the law that is stricter (more protective of your PHI) where it applies to Aetna, and invites you to contact the Aetna Privacy Office for more information about additional restrictions. This qualifies the notice’s general permissions to use and disclose information for treatment, payment, health care operations and the other purposes listed, which are introduced as things Aetna “may” do.
Supporting quotations
We will follow the law that is stricter (or more protective of your PHI), where it applies to us.
If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.
How Aetna Uses and Discloses Personal Information
In administering your health benefits, we may use and disclose personal information about you in various ways, including:
Health Care Operations: We may use and disclose personal information during the course of running our health business
Payment: To help pay for your covered services, we may use and disclose personal information in a number of ways
Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you.
Qualifications & exceptions
Applies “where it applies to us”
Concerns sensitive PHI
Contact is the Aetna Privacy Office
Not stated here
Which stricter laws apply, and how they change any particular use or disclosure, is not described
Cross-references
qualifies (model-proposed): Use and disclosure for health care operations — qualifies: Where a stricter or more protective law applies, Aetna follows it, so the general “may use and disclose” permission for health care operations is subject to that qualification.
qualifies (model-proposed): Use and disclosure for payment — qualifies: Same qualification applies to the payment permission for sensitive information.
qualifies (model-proposed): Disclosure to health care providers for treatment — qualifies: Same qualification applies to disclosures to providers for treatment where a stricter law covers the information.
Use & Processing · Company commitment
Information from substance use disorder programs
Aetna says it is not a substance use disorder treatment program, but it may receive or keep information about you that comes from one. If a substance use disorder program gives Aetna this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment and health care operations, Aetna says it will use or share the information in accordance with both the consent and HIPAA. In limited situations where it may disclose this information without your permission, such as medical emergencies and government audits, Aetna says it will follow the law that is more protective of your information.
Supporting quotations
Substance Use Disorder Information
We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program.
If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA.
In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information.
Qualifications & exceptions
Applies to information that comes from a substance use disorder program under a 42 CFR Part 2 consent
Uses follow both the consent and HIPAA
Where disclosure without permission is possible, the more protective law is followed
Medical emergencies and government audits are given as examples of limited situations
Not stated here
The text refers to 42 CFR Part 2 by citation only; the regulation itself is not supplied
The notice does not say what happens to substance use disorder information that arrives without a Part 2 consent
Legal Rights & Agreement Rules · Restriction or exception
Substance use disorder information not used in legal cases against you without consent or court order
Aetna says it will not use or share information that comes from a substance use disorder program in any legal case against you unless you give written consent, or a court orders Aetna with a subpoena or other legal requirement. The notice adds that you or Aetna must also receive notice and a chance to be heard.
Supporting quotations
We will not use or share this information in any legal case against you unless:
You give us written consent, or
A court orders us with a subpoena or other legal requirement.
You or Aetna must also receive notice and a chance to be heard.
Qualifications & exceptions
Two routes: your written consent, or a court order with a subpoena or other legal requirement
Notice and a chance to be heard are also required
Not stated here
The notice does not spell out who must be heard in each route, since it says “you or Aetna”
Account & Service Control · User right or choice
Right to ask for communications in a certain way or place
You have the right to ask Aetna to communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent you might want health information such as Explanation of Benefits and other claim information sent to a different address from your subscriber’s. Aetna says it will accommodate reasonable requests. This is separate from the default of mailing Explanation of Benefits forms to the subscriber’s address on record.
Supporting quotations
The federal privacy regulations give you several rights regarding your health information.
You have the right to ask us to communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits
(EOB) and other claim information) to a different address from that of your subscriber. We will accommodate reasonable requests.
We also mail Explanation of Benefits forms and other information to the address we have on record for the subscriber (i.e., the primary insured).
Qualifications & exceptions
Aetna will accommodate “reasonable” requests
The example involves an adult dependent whose subscriber is a different person
Not stated here
The notice does not define which requests are reasonable
Cross-references
qualifies (model-proposed): Explanation of Benefits mailed to the subscriber’s address — qualifies: The right to ask for communications at a different address qualifies the default of mailing EOBs to the subscriber’s address on record.
Account & Service Control · User right or choice
Right to ask for restrictions, which Aetna may refuse
You have the right to ask Aetna to restrict how it uses or discloses health information about you for health care operations, payment and treatment. Aetna says it will consider such requests but may not agree to them. You also have the right to ask Aetna to restrict disclosures to persons involved in your health care. Elsewhere the notice says you have the right to stop or limit disclosures to relatives, friends and others involved in your care by calling the toll-free Customer Service number.
Supporting quotations
You have the right to ask us to restrict the way we use or disclose health information about you in connection with health care operations, payment, and treatment. We will consider, but may not agree to, such requests.
You also have the right to ask us to restrict disclosures to persons involved in your health care.
Disclosure to Others Involved in Your Health Care
You have the right to stop or limit this kind of disclosure by calling the toll-free Customer Service number at 1-888-772-9682.
Qualifications & exceptions
For operations, payment and treatment, Aetna will consider the request but may not agree
Restrictions on disclosures to persons involved in your care are described both as a request and, in the earlier section, as a right to stop or limit by phone
Not stated here
The notice does not say whether a request to restrict disclosures to persons involved in your care can be refused
Account & Service Control · User right or choice
Right to a copy of your designated record set
You have the right to ask Aetna to obtain a copy of health information in a designated record set, meaning medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management and other decisions. Aetna may ask you to make the request in writing, may charge a reasonable fee for producing and mailing the copies, and in certain cases may deny the request.
Supporting quotations
You have the right to ask us to obtain a copy of health information that is contained in a “designated record set” – medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management, and other decisions. We may ask you to make your request in writing, may charge a reasonable fee for producing and mailing the copies and, in certain cases, may deny the request.
Qualifications & exceptions
May require a written request
May charge a reasonable fee for producing and mailing copies
May deny the request in certain cases
Not stated here
The notice does not state the fee amount, the response time or the cases in which a request may be denied
Account & Service Control · User right or choice
Right to ask for amendment of your records
You have the right to ask Aetna to amend health information in a designated record set. The request must be in writing and must include the reason. If Aetna denies the request, you may file a written statement of disagreement.
Supporting quotations
You have the right to ask us to amend health information that is in a “designated record set.” Your request must be in writing and must include the reason for the request. If we deny the request, you may file a written statement of disagreement.
Qualifications & exceptions
Request must be in writing and include a reason
If denied, you may file a written statement of disagreement
Not stated here
The notice does not state when Aetna may deny an amendment or whether the statement of disagreement is attached to your record
Account & Service Control · User right or choice
Right to a list of certain disclosures
You have the right to ask Aetna for a list of certain disclosures it has made about you, such as disclosures of health information to government agencies that license it. The request must be in writing. If you request such an accounting more than once in a 12-month period, Aetna may charge a reasonable fee.
Supporting quotations
You have the right to ask us to provide a list of certain disclosures we have made about you, such as disclosures of health information to government agencies that license us. Your request must be in writing. If you request such an accounting more than once in a 12-month period, we may charge a reasonable fee.
Qualifications & exceptions
Covers “certain” disclosures, not all
Request must be in writing
Reasonable fee may apply to a second or later request within 12 months
Not stated here
Which disclosures are included or excluded is not listed beyond the licensing-agency example
Security & Safeguards · User right or choice
Right to be notified of a breach
You have the right to be notified following a breach involving your health information.
Supporting quotations
You have the right to be notified following a breach involving your health information.
Qualifications & exceptions
Applies to a breach involving your health information
Not stated here
The notice does not say how, how soon or by whom you will be notified
Use & Processing · User right or choice
Rights about underwriting decisions and genetic information
You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless Aetna makes an independent evaluation of the basic facts. Your genetic information cannot be used for underwriting purposes.
Supporting quotations
You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic information cannot be used for underwriting purposes.
Qualifications & exceptions
Prior unfavorable decisions can be relied on only after an independent evaluation of the basic facts
Genetic information cannot be used for underwriting
Not stated here
The notice does not describe how to request the reasons
Cross-references
qualifies (model-proposed): Other operational uses: underwriting, fraud, mergers and sales — qualifies: The statement that genetic information cannot be used for underwriting limits the underwriting and rating activity listed among operational uses.
Legal Rights & Agreement Rules · User right or choice
Right not to be subjected to pretext interviews
You have the right, with very limited exceptions, not to be subjected to pretext interviews. A footnote at the end of the notice says that Aetna does not participate in pretext interviews.
Supporting quotations
You have the right with very limited exceptions, not to be subjected to pretext interviews.
Qualifications & exceptions
“Very limited exceptions” apply
Not stated here
The exceptions are not described and the notice does not define “pretext interview”
Account & Service Control · Procedure
How to make requests and get a paper copy
The notice says you may make any of the requests described above, request a paper copy of the notice, or ask questions about the notice by calling the toll-free Customer Service number. Several of the rights above require a written request, so a phone call may not be enough for those.
Supporting quotations
You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by calling the toll-free Customer Service number at 1-888-772-9682.
Qualifications & exceptions
Phone number given is 1-888-772-9682
Some rights separately say the request must be in writing
Not stated here
The notice does not say how a written request is submitted for those rights, apart from the complaint address
Legal Rights & Agreement Rules · User right or choice
Right to file a complaint, with no penalty
You have the right to file a complaint if you think your privacy rights have been violated, by email to the Aetna Privacy Office at PrivacyAetna@aetna.com or by mail to the HIPAA Member Rights Team at P.O. Box 14079, Lexington, KY 40512-4079. You may also write to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.
Supporting quotations
You also have the right to file a complaint if you think your privacy rights have been violated. To do so, please send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send your request to the following address:
HIPAA Member Rights Team P.O. Box 14079 Lexington, KY 40512-4079
You also may write to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.
Qualifications & exceptions
Condition: you think your privacy rights have been violated
No penalty for filing a complaint
Account & Service Control · User right or choice
Stop paper mailing of EOBs by registering online
You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com, clicking Log In/Register and completing the one-time registration. You can then log in to view past copies of EOBs and other claim information.
Supporting quotations
You may stop the paper mailing of your EOB and other claim information by visiting www.aetna.com and click “Log In/Register”. Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information.
Qualifications & exceptions
Requires one-time online registration
Past copies are then viewable online
Not stated here
The notice does not say what information Aetna collects at registration
Aetna says it guards your information with administrative, technical and physical safeguards against unauthorized access and against threats and hazards to its security and integrity, and that it complies with all applicable state and federal law on the security and confidentiality of personal information.
Supporting quotations
Safeguarding Your Information
We guard your information with administrative, technical, and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity. We comply with all applicable state and federal law pertaining to the security and confidentiality of personal information.
Qualifications & exceptions
Safeguards are described by type (administrative, technical, physical) without specifics
Not stated here
No specific security measures or standards are named
Legal Rights & Agreement Rules · Company commitment
Aetna’s legal obligations under the federal privacy regulations
Aetna states that the federal privacy regulations require it to keep personal information about you private, to give you notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Supporting quotations
Aetna’s Legal Obligations
The federal privacy regulations require us to keep personal information about you private, to give you notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Qualifications & exceptions
Three duties: keep information private, give notice of duties and practices, follow the notice currently in effect
Not stated here
The regulations are referred to generally and are not named or supplied
Legal Rights & Agreement Rules · Permission or license
Aetna may change the notice at any time, with effect on existing information
Aetna says it may change the terms of this notice and its privacy policies at any time. If it does, the new terms and policies apply to all the information it already has about you, as well as any information it receives or holds in the future.
Supporting quotations
This Notice is Subject to Change
We may change the terms of this notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the information that we already have about you, as well as any information that we may receive or hold in the future.
Qualifications & exceptions
Changes may be made “at any time”
New terms apply to information already held as well as future information
Not stated here
This passage does not say how or when you will be told of a change
Retention & Deletion · Company practice
Information is not destroyed when coverage ends
Aetna says it does not destroy personal information about you when you terminate your coverage. It may be necessary to use and disclose this information for the purposes described in the notice even after coverage ends, although policies and procedures remain in place to protect against inappropriate use or disclosure.
Supporting quotations
Please note that we do not destroy personal information about you when you terminate your coverage with us. It may be necessary to use and disclose this information for the purposes described above even after your coverage terminates, although policies and procedures will remain in place to protect against inappropriate use or disclosure.
How Aetna Uses and Discloses Personal Information
Health Care Operations: We may use and disclose personal information during the course of running our health business
Payment: To help pay for your covered services, we may use and disclose personal information in a number of ways
Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you.
Qualifications & exceptions
Purposes are those described above in the notice
Use and disclosure after coverage ends is described as something that “may be necessary”
Policies and procedures remain in place against inappropriate use or disclosure
Not stated here
No retention period or deletion practice is stated
The notice does not say whether this applies to information that came from a substance use disorder program
Legal Rights & Agreement Rules · Company commitment
Aetna does not participate in pretext interviews
A footnote states that Aetna does not participate in pretext interviews. This is the footnote attached to the right in the rights section not to be subjected to pretext interviews.
Supporting quotations
We do not participate in pretext interviews.
Qualifications & exceptions
Stated as a flat statement of practice
Not stated here
The notice does not define “pretext interview”
Cross-references
related (model-proposed): Right not to be subjected to pretext interviews — references: The footnote attached to the pretext right states that Aetna does not participate in pretext interviews.
Legal Rights & Agreement Rules · Context
Companies that may underwrite or administer coverage
The notice says coverage may be underwritten or administered by one or more of Aetna Health Inc.; Aetna Health of California Inc.; Aetna Dental of California Inc.; Aetna Dental Inc.; Aetna Life Insurance Company; Aetna Insurance Company of Connecticut; Aetna Health Insurance Company of New York; and Corporate Health Insurance Company. Mail order pharmacy services may be provided by Aetna Rx Home Delivery, LLC.
Supporting quotations
Coverage may be underwritten or administered by one or more of the following companies: Aetna Health Inc.; Aetna Health of California Inc.; Aetna Dental of California Inc.; Aetna Dental Inc.; Aetna Life Insurance Company; Aetna Insurance Company of Connecticut; Aetna Health Insurance Company of New York; and Corporate Health Insurance Company. Mail order pharmacy services may be provided by Aetna Rx Home Delivery, LLC.
Qualifications & exceptions
“May” and “one or more”: which company applies to your coverage is not decided by this list
Not stated here
The notice does not say which company covers which plan, whether these companies are all in the affiliated covered entity described at the start, or whether the mail order pharmacy company is