Aetna says it treats NPI as confidential and has policies against unlawful use and disclosure
The notice says Aetna, to administer its life and disability plans, must collect and disclose nonpublic personal information (NPI). It says Aetna considers this information private and confidential and has policies and procedures in place to protect it against unlawful use and disclosure. This is a statement of Aetna’s own practice and approach; the notice does not describe how the policies work or how compliance is checked here. “Aetna” means the Aetna Inc. family of companies, per the footnote.
Supporting quotations
To effectively administer our life and disability plans (collectively the “Benefits Plans”), Aetna† must collect and disclose
nonpublic personal information. We consider this information private and confidential and have policies and procedures in place to protect the information against unlawful use and disclosure.
“Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life
Qualifications & exceptions
The protection described is against “unlawful” use and disclosure; later sections (V, VI) describe broad uses and disclosures that Aetna treats as permitted by law, so this statement does not mean NPI is not disclosed.
“Aetna” is the Aetna Inc. family of companies as defined in the footnote.
Not stated here
The notice does not describe what the policies and procedures contain or how they are enforced beyond the Privacy Office description in Section IV.
Security & Safeguards · Company practice
Aetna restricts access to NPI to employees who need it and keeps physical, electronic and procedural safeguards
Aetna says it restricts access to NPI to those employees who need it to provide products or services to members and their dependents and beneficiaries. It says it maintains physical, electronic and procedural safeguards to protect NPI against unauthorized access and use. As examples it says access to its facilities is limited to authorized personnel and that electronically held information is protected with a variety of technical tools.
Supporting quotations
At Aetna, we restrict access to NPI to those employees who need it to provide products or services to you and your dependents and beneficiaries. We maintain physical, electronic and procedural safeguards to protect NPI against unauthorized access and
use. For example, access to our facilities is limited to authorized personnel and we protect information we maintain electronically through use of a variety of technical tools.
Qualifications & exceptions
The access restriction is stated for Aetna’s employees. Disclosure to outside parties is governed separately, by Section V.
The facility and technical-tool statements are introduced as examples (“For example”).
Not stated here
The notice does not name the technical tools, security standards or audit practices.
Security & Safeguards · Company practice
Aetna has a Privacy Office responsible for NPI policies and enforcement
Aetna says it has established a Privacy Office with overall responsibility for developing, implementing, educating company personnel about, and enforcing policies and procedures that safeguard NPI against inappropriate access, use and disclosure, consistent with applicable law.
Supporting quotations
We also have established a Privacy Office, which has overall responsibility for developing, implementing, educating company personnel about, and enforcing policies and procedures to safeguard NPI against inappropriate access, use and disclosure, consistent with applicable law.
Qualifications & exceptions
The responsibility is stated “consistent with applicable law.”
Not stated here
The notice gives no contact details for the Privacy Office and does not say whether members can contact it.