Notice describes Aetna’s privacy practices for its life and disability plans
The document is titled “Notice of Information Practices” and says it contains important information about Aetna’s privacy practices, asking readers to review it carefully. Its opening says that, to administer its life and disability plans (which the notice calls the “Benefits Plans”), Aetna must collect and disclose nonpublic personal information. Aetna says it treats this information as private and confidential and has policies and procedures to protect it against unlawful use and disclosure. The notice says it describes the types of information Aetna collects, when and to whom it may disclose it, and additional important information. “Aetna” is a defined term: a footnote says it means the Aetna Inc. family of companies, including those doing business as Aetna Life (the footnote continues “Insurance Company.”).
Supporting quotations
Notice of Information Practices
THIS NOTICE* CONTAINS IMPORTANT INFORMATION ABOUT AETNA’S PRIVACY PRACTICES.
PLEASE REVIEW IT CAREFULLY.
To effectively administer our life and disability plans (collectively the “Benefits Plans”), Aetna† must collect and disclose
nonpublic personal information. We consider this information private and confidential and have policies and procedures in place to protect the information against unlawful use and disclosure. This notice describes what types of information we collect, explains when and to whom we may disclose it, and provides you with additional important information.
† For purposes of this notice, “Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life
Qualifications & exceptions
The notice is about the life and disability plans it calls the “Benefits Plans”; it does not say it covers other Aetna products.
“Aetna” is defined for this notice by a footnote as the Aetna Inc. family of companies, “including” those doing business as Aetna Life Insurance Company, so the defined group is broader than that one company.
Not stated here
The notice does not list which companies belong to the “Aetna Inc. family of companies.”
The notice does not say which employer plans or which life and disability products are covered.
Legal Rights & Agreement Rules · Context
Form number GR-68049 (2-25) appears; no effective date is stated
The first page header and the closing line both carry the form identifier “GR-68049 (2-25)”. The header also says “Page 1 of 2”. The text does not state an effective date, issue date or revision history for the notice.
Supporting quotations
GR-68049 (2-25) Page 1 of 2
GR-68049 (2-25)
Qualifications & exceptions
The identifier is the only version marker in the text.
Not stated here
The notice does not say what “(2-25)” means, so no effective date is inferred from it.
The notice does not say how this form version relates to earlier or later versions.
Legal Rights & Agreement Rules · Context
Notice is provided for informational purposes only
The notice says it is provided to the member for informational purposes only. This follows its statement that it is not part of the member’s plan documents. The notice does not say what legal or contractual effect, if any, the practices it describes have.
Supporting quotations
Schedule of Benefits, Group Insurance Certificate). It is provided to you for informational purposes only.
This Notice is not a part of your Plan Documents (Group Policy, Certificate/Evidence of Coverage, Booklet, Group Agreement,
Qualifications & exceptions
Read together with the previous line, “informational purposes only” is used about this notice, not about the plan documents.
Not stated here
The notice does not say whether the practices it describes are binding commitments or whether the plan documents say anything different.
The plan documents are not supplied here.
Legal Rights & Agreement Rules · Context
“Aetna” means the Aetna Inc. family of companies, including those doing business as Aetna Life Insurance Company
A footnote attached to the word “Aetna” in the opening says that for purposes of this notice, “Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life Insurance Company. The notice’s “we” and “our” appear to refer to this group; the footnote does not say so in words.
Supporting quotations
† For purposes of this notice, “Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life
Insurance Company.
Aetna†
Qualifications & exceptions
“Including” means Aetna Life Insurance Company is an example of the group, not its only member.
“Affiliates” in Section V is a separate word and is not defined by this footnote.
Not stated here
The notice does not list the companies in the Aetna Inc. family or say whether CVS Health or other parent or sibling companies are inside the definition.
Sharing & Disclosure · Permission or license
Examples of uses: transfer of policies and due diligence for sale or transfer of Benefits Plans
A further example of the uses in Section V is the transfer of policies or contracts from and to other insurers or third party administrators. Aetna also lists facilitating due diligence activities connected with the purchase, sale or transfer of Benefits Plans. These activities can involve NPI moving to other insurers, administrators and parties to a sale or transfer.
Supporting quotations
Transfer of policies or contracts from and to other insurers or third party administrators; and facilitation of due diligence activities in connection with the purchase, sale or transfer of Benefits Plans.
Qualifications & exceptions
Listed as one of the Section V examples.
Not stated here
The notice does not say what NPI is shared in due diligence, with whom, or under what confidentiality terms.
Sharing & Disclosure · Permission or license
Aetna may disclose NPI to affiliated entities or nonaffiliated third parties as otherwise permitted by law
In addition to the Section V examples, Aetna says it may disclose NPI to affiliated entities or nonaffiliated third parties as otherwise permitted by law. The sentence names no purpose or category of recipient beyond “permitted by law,” so it works as a general permission alongside the specific lists.
Supporting quotations
In addition, we may disclose NPI to affiliated entities or nonaffiliated third parties as otherwise permitted by law.
Qualifications & exceptions
The only stated limit is “as otherwise permitted by law.”
Not stated here
The notice does not say which laws apply or what kinds of third parties this covers.
Sharing & Disclosure · Company commitment
Aetna says it seeks special authorization before disclosing NPI for other purposes
For purposes other than those in Section V, Aetna says it seeks special authorization before disclosing the information. The wording is “seeks,” not “requires,” and it is set alongside the statement that Aetna may also disclose NPI as otherwise permitted by law.
Supporting quotations
For other purposes, we seek special authorization before disclosing the information.
Qualifications & exceptions
“Other purposes” means purposes other than those described in Section V and the disclosures otherwise permitted by law.
Not stated here
The notice does not say what happens if authorization is not obtained for a purpose that is otherwise permitted by law.
Account & Service Control · Company commitment
If a member cannot give authorization, Aetna accepts it from a person legally permitted to give it
If a special authorization is required but the member cannot give it, for example because the member is medically unable to, Aetna says it will accept the authorization from any person legally permitted to give it on the member’s behalf.
Supporting quotations
In the event that a special authorization is required but the member in question is unable to give the authorization (for example, if the member is medically unable to do so), we will accept the authorization from any person legally permitted to give the authorization on behalf of the member.
Qualifications & exceptions
The person must be “legally permitted” to authorize on the member’s behalf.
Not stated here
The notice does not say what proof Aetna asks for to show the person is legally permitted.
Use & Processing · Permission or license
Aetna uses and discloses NPI as in Section V regardless of individual preferences, as far as the law permits
Aetna says it considers the Section V activities key to administering its group life and disability plans, and gives examples: target marketing to educate employees about their benefits, quality assessment and research programs, and coordinated or integrated disability and health programs. It then says that, to the extent permitted by law, it uses and discloses NPI as provided in Section V regardless of individual preferences. The notice describes no opt-out from the Section V uses and disclosures. The one carve-out it describes is marketing, covered in the next card.
Supporting quotations
V. What personal information does Aetna and other benefits plans use or disclose to third parties, and for what purposes?
We consider the activities described in Section V key for the administration of our group life and disability benefit plans. For example, target marketing helps us to better educate employees about the benefits available to them. Quality assessment and research programs help us to review and improve the services we provide. Coordinated or integrated disability and health benefit programs let us work more effectively with members to manage their disabilities and improve their health and productivity. Therefore, to the extent permitted by law, we use and disclose NPI as provided in Section V regardless of individual preferences.
We do not disclose NPI to anyone, except with member authorization (see Section VII) or otherwise as permitted by law.
Administration of life and disability benefits policies or contracts, which may involve claims payment and management
Qualifications & exceptions
“To the extent permitted by law” limits the statement.
The statement covers uses and disclosures “as provided in Section V,” and Section V itself is stated as examples with a catch-all for “other related activities.”
Not stated here
The notice does not describe any right to object to or restrict the Section V uses and disclosures; other laws or the plan documents might, but they are not supplied.
Cross-references
qualifies (model-proposed): Aetna does not disclose NPI except with member authorization or as permitted by law — qualifies: The Section VI statement that Section V uses and disclosures occur regardless of individual preferences, to the extent permitted by law, qualifies the Section V statement that NPI is not disclosed except with authorization or as permitted by law: the permitted-by-law path is available without member preference.
Sharing & Disclosure · Company commitment
Aetna says it seeks special authorization before disclosing NPI for marketing unrelated to the plans
Aetna says it recognizes that many members do not want unsolicited marketing materials unrelated to their Benefit Plans, so it seeks special authorization before disclosing NPI for these marketing purposes. Marketing that educates employees about their own benefits is described separately as part of the Section V activities that go ahead regardless of preferences.
Supporting quotations
Of course, we recognize that many members do not want to receive unsolicited marketing materials unrelated to their Benefit Plans. Therefore, we seek special authorization before disclosing NPI for these marketing purposes.
target marketing helps us to better educate employees about the benefits available to them.
Qualifications & exceptions
The commitment is to “seek” authorization, not to require it, and covers disclosure of NPI for marketing unrelated to the Benefit Plans.
Plan-related “target marketing” is within the Section V activities and does not need this authorization.
Not stated here
The notice does not say what counts as marketing “unrelated” to the plans.
It does not address whether Aetna uses NPI internally for unrelated marketing without disclosing it.
Other disclosures: call for a special authorization form and mail it to the HIPAA Member Rights Team
To have Aetna disclose personal information to a person or organization, or for reasons other than those in Section V, the member calls the toll-free customer service number to ask for a special authorization form. The notice’s example is making records available to a neighbor who is helping resolve a claim question. The member fills out the form and sends it to the HIPAA Member Rights Team at P.O. Box 14079, Lexington, KY 40512-4079.
Supporting quotations
Many people ask us to disclose NPI to third parties or for reasons not described in Section V. For example, you may want us to make your records available to a neighbor who is helping you resolve a question about your claim. To authorize us to disclose any of your personal information to a person or organization or for reasons other than those described in Section V above, please call our toll-free customer service phone number listed in Section I to ask for a special authorization form. When you receive the form, fill it out and send it to us at the following address:
HIPAA Member Rights Team P.O. Box 14079 Lexington, KY 40512-4079
*Life and Disability toll free number: 1-866-825-6944
Qualifications & exceptions
The route described is by phone request and then mailing the completed form.
Not stated here
The notice does not say how long processing takes or whether the form can be obtained online.
Sharing & Disclosure · User right or choice
A member can revoke a special authorization by letter to the same address
A member who changes their mind about a special authorization can send a letter to the HIPAA Member Rights Team address saying they want to revoke it. The letter should include name, address, member identification number or Social Security number, and a telephone number where Aetna can reach the member to confirm the request.
Supporting quotations
If you fill out a form and later change your mind about the special authorization, send a letter to us at the same address, letting us know that you would like to revoke the special authorization. Please provide your name, address, member identification number or Social Security number, and a telephone number where we can reach you to confirm your request.
Qualifications & exceptions
The notice describes revoking by letter; no other way is mentioned.
The member supplies a member ID or Social Security number and a phone number for confirmation.
Not stated here
The notice does not say when revocation takes effect or whether it affects disclosures already made.
For information about yourself, Aetna points members to the provider and says it lacks custody of medical records
For access to information about themselves, Aetna says a member should go to the provider that generated the original records, which it says are more complete than any it maintains. Aetna says it does not have custody or control of the member’s medical records. This sits alongside Section III, which lists medical history among the information Aetna collects.
Supporting quotations
If you want to access information about yourself, you should go to the provider (e.g., doctor or other caregiver) that generated the original records, which are more complete than any we maintain. We do not have custody or control of your medical records.
Qualifications & exceptions
Framed as a direction (“you should go to the provider”), not as a refusal to give access to what Aetna holds; the next card covers what Aetna will provide.
Not stated here
The notice does not reconcile “no custody or control of your medical records” with Section III’s statement that Aetna collects medical history, and does not say what medical information it keeps.
Members may request documents about information from their employer or providers; Aetna may charge a fee
A member may request documents reflecting information Aetna receives from the employer or providers when Aetna processes claims submitted for payment. In these cases Aetna may charge an administrative fee to help cover its costs, except where prohibited by law. In all other cases Aetna says it will refer the member to the applicable employer or providers.
Supporting quotations
You may also request documents reflecting information we receive from your employer or providers when we process claims submitted to us for payment. In these cases, we may charge an administrative fee to help cover our costs, except where prohibited by law. In all other cases, we will refer you to the applicable employer or providers.
Qualifications & exceptions
The fee applies to these claim-processing documents and is subject to “except where prohibited by law.”
Anything outside these documents is referred to the employer or providers.
Not stated here
The notice does not state the amount of the fee.
Account & Service Control · Procedure
Claims and encounter information is requested by phone or letter; adult dependents must co-sign
To request claims or encounter information Aetna maintains for a member and the member’s dependents, the member calls the toll-free number or writes to the HIPAA Member Rights Team at the address given earlier. The request includes the name, address, member ID or Social Security number, and date of birth of each person whose information is requested. If the request is for an adult dependent’s information, that adult dependent must co-sign the letter.
Supporting quotations
To request claims/encounter information we maintain for you and your dependents, please call our toll free customer service phone number listed in Section I or send a letter to the HIPAA Member Rights Team at the address listed above and include the name, address, member ID or Social Security number, and date of birth of each person whose information you request. If you are requesting claims/encounter information for your adult dependents, each such adult dependent must co-sign the letter.
Qualifications & exceptions
The co-signing rule is stated for requests about adult dependents.
Not stated here
The notice does not say how co-signing works for a phone request.
Account & Service Control · User right or choice
Where required by law, Aetna corrects its own records; members can request a rebuttal statement
Where required by law, Aetna says it will correct or amend the records it maintains, but not the records kept by the member’s employer, provider or other third parties. If Aetna does not agree the records are incorrect, the member can request that a rebuttal statement be added to the file.
Supporting quotations
Where required by law we will correct or amend the records we maintain (but not the records maintained by your employer, provider or other third parties). If we do not agree that the records are incorrect, you can request we add a rebuttal statement to your file.
Qualifications & exceptions
Correction is stated “where required by law” and covers only Aetna’s own records.
The rebuttal statement applies when Aetna does not agree the records are incorrect.
Not stated here
The notice does not say how to submit a correction request or how long it takes.
Retention & Deletion · Company practice
Aetna does not destroy NPI when coverage ends; protections continue
Aetna says it does not destroy NPI when individuals terminate their coverage. It says the information is necessary and used for many of the Section V purposes even after an individual leaves a plan, and in many cases is subject to legal retention requirements. The policies and procedures that protect the information, it says, apply regardless of a member’s status.
Supporting quotations
Aetna does not destroy NPI when individuals terminate their coverage with us. The information is necessary and used for many of the purposes described in Section V, even after an individual leaves a plan, and in many cases is subject to legal retention requirements. However, the policies and procedures that protect that information against inappropriate use and disclosure apply regardless of the status of any individual member.
have policies and procedures in place to protect the information against unlawful use and disclosure.
Qualifications & exceptions
Retention is tied to continued use for Section V purposes and, “in many cases,” to legal retention requirements.
Not stated here
The notice gives no retention period and does not say whether NPI is ever destroyed later.
Legal Rights & Agreement Rules · Procedure
Notice is sent at enrollment in insured or full-risk plans, on material change and as required by law
Aetna says it plans to send the notice to members upon enrollment in any of its full risk or insured Benefits Plans, or when it receives their first claim if it does not know their identity at enrollment. It also plans to send it when its confidentiality practices are materially changed and at other times as required by law.
Supporting quotations
We plan to send this notice to our members upon enrollment in any of our full risk or insured Benefits Plans (or when we receive their first claim, if we do not know their identity upon enrollment), when our confidentiality practices are materially changed, and at other times as required by law.
Qualifications & exceptions
The wording is “we plan to send,” and the enrollment trigger is stated for full risk or insured Benefits Plans.
Applies to members; employers get updates under a separate sentence.
Not stated here
The notice does not say how members of self-funded plans, which Section V mentions, receive it.
Legal Rights & Agreement Rules · Permission or license
Aetna reserves the right to change the notice; a new notice applies to all NPI it maintains
Aetna reserves the right to change the terms of the notice and to make the provisions of a new notice effective for all NPI it maintains. That includes information collected before the change. Aetna separately says it plans to send the notice again when its confidentiality practices are materially changed.
Supporting quotations
We reserve the right to change the terms of this notice and to make the provisions of the new notice effective for all NPI we maintain.
Qualifications & exceptions
The new provisions apply to all NPI maintained, not only information collected after the change.
Sending a new notice is described as a plan tied to material changes.
Not stated here
The notice states no advance-notice period and no way to object to a change.
Account & Service Control · Procedure
Updates go to employers; members can request the notice by phone or find it on aetna.com
Aetna says updates of the notice are distributed to employers who sponsor its plans. The notice can be requested by calling the toll-free number, and is also available on Aetna’s website, www.aetna.com. Aetna adds that a short version of the notice is included in many of its general marketing communications.
Supporting quotations
Updates of this notice are distributed to employers who sponsor our plans. It can be requested by calling our toll-free customer service phone number listed in Section I, and also is available on our website, at www.aetna.com. A short version of this notice is included in many of our general marketing communications.
Qualifications & exceptions
The short version is in “many” marketing communications, not all.
Not stated here
The notice does not give a page on the website or a way to receive updates other than through employers.
Legal Rights & Agreement Rules · Procedure
If members believe the policy was violated, they follow plan grievance procedures or call the toll-free number
If a member believes the notice’s policy has been violated with respect to information about the member or the member’s dependents or beneficiaries, Aetna asks the member to follow the grievance procedures described in the plan documents or to call the toll-free customer service number listed in Section I, which is 1-866-825-6944 for Life and Disability.
Supporting quotations
If you believe this policy has been violated with respect to information about you or your dependents or beneficiaries, please follow the grievance procedures described in your plan documents or call our toll-free customer service phone number listed in Section I.
*Life and Disability toll free number: 1-866-825-6944
Qualifications & exceptions
Two routes are offered: the plan documents’ grievance procedures, or the phone number.
The notice calls its own content “this policy.”
Not stated here
The plan documents’ grievance procedures are not supplied here, so their steps and deadlines are unknown.
The notice does not name a regulator or any outside body to complain to.
Legal Rights & Agreement Rules · User right or choice
Members have the right to know the reasons for an unfavorable underwriting decision
Under “Other important information,” the notice says “you” have the right to know the reasons for an unfavorable underwriting decision.
Supporting quotations
You have the right to know the reasons for an unfavorable underwriting decision.
Qualifications & exceptions
Stated as a right without a stated procedure.
Not stated here
The notice does not say how to ask for the reasons, who “you” is for group coverage (employee, employer or plan member), or how long a response takes.
Use & Processing · Restriction or exception
Earlier unfavorable underwriting decisions are not the basis for future ones without an independent evaluation
The notice says previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless Aetna makes an independent evaluation of the basic facts.
Supporting quotations
Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts.
Qualifications & exceptions
The restriction has one exception: an independent evaluation of the basic facts.
Not stated here
The notice does not say what an independent evaluation involves.
Data Access & Collection · User right or choice
Right, with very limited exceptions, not to face pretext interviews; Aetna says it does not participate in them
The notice says “you” have the right, with very limited exceptions, not to be subjected to pretext interviews, and the statement carries a footnote mark. After a divider line the notice says “We do not participate in pretext interviews,” which appears to be the text of that footnote. The notice does not define pretext interviews.
Supporting quotations
You have the right with very limited exceptions, not to be subjected to pretext interviews.1
We do not participate in pretext interviews.
Qualifications & exceptions
The right is stated “with very limited exceptions.”
The footnote statement is about Aetna’s own participation.
Not stated here
The exceptions are not described.
“Pretext interviews” is not defined.
The notice does not say whether anyone other than Aetna, such as an employer or agent, might conduct them.
Legal Rights & Agreement Rules · Context
Coverage may be underwritten or administered by Aetna Life Insurance Company
The notice says coverage may be underwritten or administered by Aetna Life Insurance Company. This is one of the companies the notice’s footnote includes in the defined term “Aetna.”
Supporting quotations
Coverage may be underwritten or administered by Aetna Life Insurance Company.
“Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life
Qualifications & exceptions
Stated with “may,” so it is not a statement that every plan is underwritten or administered by that company.
Not stated here
The notice does not say which plans are underwritten or administered by Aetna Life Insurance Company or by other Aetna companies.
Security & Safeguards · Company practice
Aetna says it treats NPI as confidential and has policies against unlawful use and disclosure
The notice says Aetna, to administer its life and disability plans, must collect and disclose nonpublic personal information (NPI). It says Aetna considers this information private and confidential and has policies and procedures in place to protect it against unlawful use and disclosure. This is a statement of Aetna’s own practice and approach; the notice does not describe how the policies work or how compliance is checked here. “Aetna” means the Aetna Inc. family of companies, per the footnote.
Supporting quotations
To effectively administer our life and disability plans (collectively the “Benefits Plans”), Aetna† must collect and disclose
nonpublic personal information. We consider this information private and confidential and have policies and procedures in place to protect the information against unlawful use and disclosure.
“Aetna” refers to the Aetna Inc. family of companies, including those doing business as Aetna Life
Qualifications & exceptions
The protection described is against “unlawful” use and disclosure; later sections (V, VI) describe broad uses and disclosures that Aetna treats as permitted by law, so this statement does not mean NPI is not disclosed.
“Aetna” is the Aetna Inc. family of companies as defined in the footnote.
Not stated here
The notice does not describe what the policies and procedures contain or how they are enforced beyond the Privacy Office description in Section IV.
Account & Service Control · Procedure
Questions about the notice go to a life and disability toll-free number
The notice invites questions about itself by phone to a toll-free customer service number, given as 1-866-825-6944 for Life and Disability. Later sections send members to this same number to ask for a special authorization form, to request claims information, and to raise a belief that the notice’s policy was violated.
Supporting quotations
If you have questions about this notice, please call our toll-free customer service number:
*Life and Disability toll free number: 1-866-825-6944
Qualifications & exceptions
The only contact route given for questions is the phone number; Section VII adds a mailing address for specific requests.
Not stated here
The notice does not give hours, an email address or a web contact form for this number.
Data Access & Collection · Context
NPI means identifiable information about an enrolled person; public and aggregate information is excluded
The notice defines “nonpublic personal information” (NPI) as information that identifies an individual enrolled in an Aetna Benefits Plan and relates to the person’s participation in the plan, physical or mental health or condition, provision of health care, employment, or payment of benefits to that person or the person’s beneficiary. NPI does not include publicly available information, or information reported in summarized or aggregate form that does not identify any individual. The rest of the notice’s promises about “NPI” (restricted access, confidentiality, disclosure rules) are tied to this definition.
Supporting quotations
Nonpublic personal information (“NPI”) is information that identifies an individual enrolled in an Aetna Benefits Plan and relates to the person’s participation in the Plan, the person’s physical or mental health or condition, the provision of health care to that person, the person’s employment, or payment of benefits to that person or the person’s beneficiary. NPI does not include publicly available information, or information that is available or reported in a summarized or aggregate fashion but does not identify any individual person.
Qualifications & exceptions
The definition covers information that both identifies an enrolled individual and relates to one of the listed subjects; the list is part of the definition, not examples.
Publicly available information and non-identifying summarized or aggregate information are outside NPI.
Not stated here
The definition speaks of an “individual enrolled in an Aetna Benefits Plan”; the notice does not say whether information about a dependent or beneficiary who is not enrolled counts as NPI, although Sections III and IV mention dependents and beneficiaries.
“Publicly available” is not defined.
Data Access & Collection · Company practice
Aetna collects information from you, your employer or plan sponsor, and previous benefits companies
Aetna says it collects information about you and your dependents and beneficiaries that it receives directly or indirectly from you, your employer or benefits plan sponsor, or previous benefits companies. The information arrives through applications, surveys or other forms, in writing, in person, by telephone or electronically. The examples given are name, address, social security number, date of birth, marital status, dependent or beneficiary information, employment information and medical history.
Supporting quotations
Like all benefits companies, we collect the following types of information about you and your dependents and beneficiaries:
Information we receive directly or indirectly from you, your employer or benefits plan sponsor, or previous benefits companies through applications, surveys, or other forms, in writing, in person, by telephone, or electronically (e.g., name, address, social security number, date of birth, marital status, dependent/beneficiary information, employment information, medical history).
Qualifications & exceptions
The items in parentheses are introduced by “e.g.,” so they are examples, not a complete list.
Applies to information about the member and the member’s dependents and beneficiaries.
Some of this information can reach Aetna “indirectly,” for example from an employer or a previous benefits company, rather than from the person.
Not stated here
The notice does not say which items are collected for every person versus only some, or how medical history is obtained.
Data Access & Collection · Company practice
Aetna collects information about your relationship and transactions with it, its affiliates, agents and others
Aetna says it also collects information about the person’s relationship and transactions with Aetna, its affiliates, its agents and others. The examples are underwriting and claims information, medical history, eligibility information, payment information, and service request, appeal and grievance information.
Supporting quotations
Information about your relationship and transactions with us, our affiliates, our agents, and others (e.g., underwriting and claims information, medical history, eligibility information, payment information, and service request, appeal and grievance information).
Qualifications & exceptions
The examples are introduced by “e.g.,” and are not a complete list.
The transactions can be with “others” as well as Aetna, its affiliates and its agents.
Not stated here
The notice does not say who “others” are or how information about transactions with them reaches Aetna.
Data Access & Collection · Company practice
Aetna collects information from consumer reporting agencies
Aetna says it collects information it receives from consumer reporting agencies, as one of the three types of information listed in Section III.
Supporting quotations
Information we receive from consumer reporting agencies.
Qualifications & exceptions
Listed without examples or limits; the notice does not tie it to a particular purpose.
Not stated here
The notice does not say what kind of information consumer reporting agencies supply, when it is requested, or for which plans or decisions.
Security & Safeguards · Company practice
Aetna restricts access to NPI to employees who need it and keeps physical, electronic and procedural safeguards
Aetna says it restricts access to NPI to those employees who need it to provide products or services to members and their dependents and beneficiaries. It says it maintains physical, electronic and procedural safeguards to protect NPI against unauthorized access and use. As examples it says access to its facilities is limited to authorized personnel and that electronically held information is protected with a variety of technical tools.
Supporting quotations
At Aetna, we restrict access to NPI to those employees who need it to provide products or services to you and your dependents and beneficiaries. We maintain physical, electronic and procedural safeguards to protect NPI against unauthorized access and
use. For example, access to our facilities is limited to authorized personnel and we protect information we maintain electronically through use of a variety of technical tools.
Qualifications & exceptions
The access restriction is stated for Aetna’s employees. Disclosure to outside parties is governed separately, by Section V.
The facility and technical-tool statements are introduced as examples (“For example”).
Not stated here
The notice does not name the technical tools, security standards or audit practices.
Security & Safeguards · Company practice
Aetna has a Privacy Office responsible for NPI policies and enforcement
Aetna says it has established a Privacy Office with overall responsibility for developing, implementing, educating company personnel about, and enforcing policies and procedures that safeguard NPI against inappropriate access, use and disclosure, consistent with applicable law.
Supporting quotations
We also have established a Privacy Office, which has overall responsibility for developing, implementing, educating company personnel about, and enforcing policies and procedures to safeguard NPI against inappropriate access, use and disclosure, consistent with applicable law.
Qualifications & exceptions
The responsibility is stated “consistent with applicable law.”
Not stated here
The notice gives no contact details for the Privacy Office and does not say whether members can contact it.
Sharing & Disclosure · Company practice
Aetna does not disclose NPI except with member authorization or as permitted by law
Under the Section V heading about what information Aetna and other benefits plans use or disclose to third parties, Aetna says it does not disclose NPI to anyone, except with member authorization (Section VII) or otherwise as permitted by law. It says disclosures permitted by law typically include those described in more detail in Section V. The authorization route is a special authorization form requested through the toll-free number. The exception for disclosures “permitted by law” is wide: later sections say Aetna uses and discloses NPI as described in Section V regardless of individual preferences to the extent permitted by law, and may disclose NPI to affiliated entities or nonaffiliated third parties as otherwise permitted by law.
Supporting quotations
V. What personal information does Aetna and other benefits plans use or disclose to third parties, and for what purposes?
We do not disclose NPI to anyone, except with member authorization (see Section VII) or otherwise as permitted by law. Disclosures permitted by law typically include those described in more detail below.
To authorize us to disclose any of your personal information to a person or organization or for reasons other than those described in Section V above, please call our toll-free customer service phone number listed in Section I to ask for a special authorization form.
Qualifications & exceptions
Two exceptions: member authorization and disclosure otherwise permitted by law.
Later sections add that the Section V uses and disclosures occur “regardless of individual preferences” to the extent permitted by law, and that authorization is sought for other purposes.
Not stated here
The notice does not cite which laws make disclosures permitted.
The Section V heading refers to “Aetna and other benefits plans”; the notice does not say which other benefits plans are meant.
Sharing & Disclosure · Permission or license
NPI is used internally and shared with affiliates, providers, insurers, payors, vendors and government authorities
Aetna says that when necessary for the operation of its Benefits Plans, or other related activities, it uses NPI internally, shares it with its affiliates, and discloses it to health care providers (doctors and other caregivers), other insurers, third party administrators, payors, vendors, consultants, government authorities, and their respective agents. “Payors” are described as employers who sponsor self-funded Benefits Plans and others who may be financially responsible for payment for the services or benefits under the plan.
Supporting quotations
When necessary for the operation of our Benefits Plans, or other related activities, we use NPI internally, share it with our affiliates, and disclose it to health care providers (doctors and other caregivers), other insurers, third party administrators, payors (employers who sponsor self-funded Benefits Plans and others who may be financially responsible for payment for the services or benefits you receive under your plan), vendors, consultants, government authorities, and their respective agents.
Qualifications & exceptions
The condition is “when necessary for the operation of our Benefits Plans, or other related activities.”
Payors include employers who sponsor self-funded plans, so some NPI can be disclosed to an employer in that role.
The list names the recipients; it does not say which recipients receive which kinds of NPI.
Not stated here
“Other related activities” is not defined.
“Affiliates” is not defined here and is separate from the defined term “Aetna.”
The notice does not say how “necessary” is decided.
Sharing & Disclosure · Restriction or exception
Recipients are described as required to keep NPI confidential as provided by applicable law
After listing the recipients of NPI, the notice says these parties are required to keep NPI confidential as provided by applicable law. The statement ties the confidentiality duty to applicable law rather than describing a contract term Aetna imposes.
Supporting quotations
These parties are required to keep NPI confidential as provided by applicable law.
Qualifications & exceptions
The duty is “as provided by applicable law.”
Not stated here
The notice does not say which laws apply or whether every listed recipient, such as an employer acting as payor or a government authority, is bound in the same way.
Examples of uses: administering benefits, claims, appeals, auditing and building awareness of products
Aetna gives examples of what it does with collected information and why it might be disclosed to third parties. The first group is administration of life and disability benefits policies or contracts. It may involve claims payment and management, coordination of care, benefits and other services, response to member inquiries or requests, building awareness about Aetna’s products and programs, grievance and appeals programs, benefits and program analysis and reporting, fulfillment, and auditing and quality assessment and improvement activities. The list ends with “other activities described below.”
Supporting quotations
Here are some examples of what we do with the information we collect and the reasons it might be disclosed to third parties:
Administration of life and disability benefits policies or contracts, which may involve claims payment and management; coordination of care, benefits, and other services; response to member inquiries or requests for services; building awareness about our products and programs; conduct of grievance and appeals programs; benefits and program analysis and reporting; fulfillment;
auditing and quality assessment and improvement activities;
Qualifications & exceptions
The bullets are introduced as examples of what Aetna does and the reasons information might be disclosed to third parties.
“Building awareness about our products and programs” is a marketing-type use of NPI inside the administration list; Section VI says special authorization is sought before NPI is disclosed for marketing unrelated to the Benefits Plans.
Not stated here
The list does not say, item by item, whether the information is only used inside Aetna or also disclosed, or to whom.
Use & Processing · Permission or license
Examples of uses: risk management, fraud detection, underwriting, ratemaking and reinsurance
Among the examples of uses and disclosures, Aetna lists risk management; detection and investigation of fraud and other unlawful conduct; underwriting and ratemaking; and administration of reinsurance and excess or stop loss insurance policies, including coordination with reinsurance and excess or stop loss insurers. This means NPI may be shared with reinsurance and stop loss insurers.
Supporting quotations
risk management; detection and investigation of fraud and other unlawful conduct;
underwriting and ratemaking; administration of reinsurance and excess or stop loss insurance policies and coordination with reinsurance and excess or stop loss insurers; and other activities described below.
Qualifications & exceptions
Listed as examples within the administration bullet.
Not stated here
The notice does not say what NPI is shared with reinsurers or stop loss insurers, or how it is limited.
Use & Processing · Permission or license
Disability plan administration may be blended with health or workers compensation plans, including third-party ones
Aetna lists operation of benefits programs in which it coordinates or blends the administration or case management of its disability plans with health or workers compensation benefit plans. Those other plans may be administered by Aetna or by third parties.
Supporting quotations
Operation of benefits programs in which we coordinate or blend the administration or case management of our disability plans with health or workers compensation benefit plans administered by Aetna or third parties.
Qualifications & exceptions
The coordinated plans may be administered by “Aetna or third parties.”
Not stated here
The notice does not say what NPI is exchanged with third-party administrators of health or workers compensation plans.
Use & Processing · Permission or license
Examples of uses: performance measurement, claims analysis, research and systems management
Aetna lists performance measurement and outcomes assessment; claims analysis and reporting; and research as examples of uses. It also lists data and information systems management.
Supporting quotations
Performance measurement and outcomes assessment; claims analysis and reporting, and research.
Data and information systems management.
Qualifications & exceptions
Listed as examples of uses and possible disclosures.
Not stated here
The notice does not say who conducts the research, whether it uses identifiable information, or whether disclosure outside Aetna is involved.
Legal Rights & Agreement Rules · Permission or license
Examples of uses and disclosures: regulatory reporting, subpoenas, fraud reporting, litigation and third-party liability
Aetna lists performing mandatory regulatory compliance and reporting; responding to requests from regulatory authorities; responding to government agency or court subpoenas as required by law; reporting suspected or actual fraud or other criminal activity; conducting litigation, arbitration or similar dispute resolution; and performing third-party liability activities, including administration of social security and workers compensation offsets, and related activities.
Supporting quotations
Performing mandatory regulatory compliance/reporting activities; responding to requests for information from regulatory authorities, responding to government agency or court subpoenas as required by law, reporting suspected or actual fraud or other criminal activity; conducting litigation, arbitration, or similar dispute resolution proceedings; and performing third-party liability (including administration of social security and workers compensation offsets), and related activities.
Qualifications & exceptions
Responding to subpoenas is qualified by “as required by law.”
Fraud or criminal reporting covers “suspected or actual” activity.
The list is introduced as examples.
Not stated here
The notice does not say who receives the reports or what limits apply to requests from regulatory authorities that are not subpoenas.
Legal Rights & Agreement Rules · Context
Notice says it is not part of the plan documents
The notice says it is not a part of the member’s plan documents, which it lists as the group policy, certificate or evidence of coverage, booklet, group agreement, schedule of benefits and group insurance certificate. It says the notice is provided for informational purposes only.
Supporting quotations
This Notice is not a part of your Plan Documents (Group Policy, Certificate/Evidence of Coverage, Booklet, Group Agreement,
Schedule of Benefits, Group Insurance Certificate). It is provided to you for informational purposes only.
Qualifications & exceptions
The list of plan documents is given in parentheses and continues from this line of the notice into the next.
Not stated here
The notice does not say whether the plan documents or this notice controls if they differ.
The plan documents are not supplied here, so their privacy terms are not known.