This Notice describes how health information about you may be used and disclosed and how you can get access to it. It is issued by one or more subsidiaries of The Cigna Group that act as affiliated covered entities under HIPAA, referred to as "we". The Notice says it covers uses and disclosures of your PHI and your rights to access and amend it. Cigna Healthcare (employer-sponsored plans, third-party administrator collaboration, Medicare and individual and family plans) and Evernorth Health Services (pharmacy, care and benefits solutions) are both described as part of this group.
Supporting quotations
This Notice describes how health information about you may be used and disclosed, and how you can get access to this information.
This Notice is provided by one or more subsidiaries of The Cigna Group that operate as affiliated covered entities under HIPAA (“we”).
Evernorth Health Services creates pharmacy, care and benefits solutions
How we may use and disclose your PHI
Your rights to access and amend your PHI
Qualifications & exceptions
The Notice is issued by "one or more" subsidiaries operating as affiliated covered entities, so the entity that holds your PHI depends on your coverage or service.
Not stated here
This block does not say which specific subsidiary applies to a particular member; a list of subsidiaries appears elsewhere in the document.
Data Access & Collection · Company practice
What PHI is and which records the Notice covers
In the normal course of business, the Cigna affiliates create, obtain and/or maintain records about you and the services they provide to you. The information in those records is called Protected Health Information, or PHI. The Notice says it applies to all electronic or paper records the affiliates create, obtain and/or maintain that contain your PHI.
Supporting quotations
we create, obtain and/or maintain records about you and the services we provide to you
The information we collect is called Protected Health Information (“PHI”).
This Notice applies to all electronic or paper records we create, obtain and/or maintain that contain your PHI.
Qualifications & exceptions
Applies to records that contain your PHI, whether electronic or paper.
Not stated here
This passage does not list the specific kinds of data that make up PHI.
Legal Rights & Agreement Rules · Company commitment
Legal duties: protect PHI, give notice, follow this Notice
The affiliates say they are required by state and federal law to protect the privacy of your PHI, to give you this Notice about how they safeguard and use it, and to notify you following a breach of your health information. They say they are bound by the terms of this Notice when they use or disclose PHI. The Notice lists three legal duties: maintain the privacy of PHI, provide notice of legal duties and privacy practices, and abide by the Notice currently in effect for Cigna Affiliated Covered Entities. Where federal, state or local law in your jurisdiction gives additional protection against improper use or disclosure of PHI, the Notice says it will follow that law to the extent it applies.
Supporting quotations
We are required by state and federal law to protect the privacy of your PHI and to provide you with this Notice about how we safeguard and use it, and notify you following a breach of your health information.
When we use or give out (“disclose”) your PHI, we are bound by the terms of this Notice.
Maintain the privacy of your PHI
Provide you with notice of our legal duties and privacy practices with respect to PHI
Abide by the terms of the Notice currently in effect for Cigna Affiliated Covered Entities
If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.
Qualifications & exceptions
The commitment to follow terms is tied to the Notice "currently in effect".
Additional protections from federal, state or local law are followed only to the extent they apply.
Security & Safeguards · Company commitment
Technical, physical and administrative safeguards
The affiliates say they maintain technical, physical and administrative safeguards to ensure the privacy of your PHI. The text does not describe the specific measures.
Supporting quotations
We maintain technical, physical and administrative safeguards to ensure the privacy of your PHI.
Not stated here
No specific security measures, standards or certifications are named.
Sharing & Disclosure · Permission or license
Disclosures to law enforcement
The affiliates may disclose your PHI, as required by law, in response to a subpoena, warrant, summons or other appropriate process. In some circumstances they may also disclose PHI to assist law enforcement with identification of relevant individuals, provide information about crime victims, provide information about decedents, and report a crime.
Supporting quotations
We may disclose your PHI, as required by law, in response to a subpoena, warrant, summons or other appropriate process.
In some circumstances, we may also disclose PHI to assist law enforcement with identification of relevant individuals, provide information about crime victims, provide information to law enforcement about decedents, and report a crime.
Qualifications & exceptions
The first sentence is tied to what the law requires and to legal process; the second sentence covers additional disclosures "in some circumstances" without naming the conditions.
Not stated here
The circumstances in which PHI is disclosed to help identify individuals, about crime victims or decedents, or to report a crime are not described.
Sharing & Disclosure · Permission or license
Coroners, organ donation and workers’ compensation disclosures
The affiliates may disclose your PHI to a coroner or medical examiner to determine cause of death or other duties authorized by law; to organizations involved in organ transplantation to facilitate donation and transplantation; and to comply with workers’ compensation laws and other similar programs.
Supporting quotations
We may disclose your PHI to a coroner or a medical examiner for the purpose of determining cause of death or other duties authorized by law.
We may disclose your PHI to organizations involved in organ transplantation to facilitate donation and transplantation.
We may disclose your PHI to comply with workers’ compensation laws and other similar programs.
Use & Processing · Permission or license
Fundraising communications and your right to opt out
The affiliates may use your PHI to send you fundraising communications. The Notice states you have the right to opt out of receiving such communications.
Supporting quotations
We may use your PHI to send you fundraising communications, but you have the right to opt out of receiving such communications.
Qualifications & exceptions
You may opt out of fundraising communications.
Not stated here
This passage does not say how to opt out.
Use & Processing · Permission or license
Facility directory information
The affiliates may use your PHI to maintain contact information in a facility directory. The Notice says this information may include names, facility location, general information about conditions, and religious affiliation.
Supporting quotations
We may use your PHI for purposes of maintaining contact information in a facility directory.
Such information may include names, facility location, general information about conditions, and religious affiliation.
Not stated here
The passage does not say which facilities, whether the directory is public, or who can see it.
Use & Processing · Permission or license
Underwriting, with a ban on genetic information
The affiliates may use or disclose your PHI for underwriting and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits. They state they are prohibited from using or disclosing PHI that is genetic information for these purposes.
Supporting quotations
We may use or disclose your PHI for the purpose of underwriting and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits.
We are prohibited from using or disclosing PHI that is genetic information for such purposes.
Qualifications & exceptions
Genetic information is excluded from underwriting use and disclosure.
Sharing & Disclosure · Permission or license
National security, military and correctional disclosures
The affiliates may disclose your PHI to authorized federal officials for intelligence, counterintelligence, medical suitability determinations, Presidential protection activities and other national security activities authorized by law. If you are a member of the U.S. Armed Forces or a foreign military, they may disclose PHI as required by military command authorities or law. If you are an inmate in a correctional institution or in the custody of a law enforcement official, they may disclose PHI to those parties if disclosure is necessary for your health care, maintaining the health or safety of yourself or other inmates, or ensuring the safety and security of the institution or its agents.
Supporting quotations
We may disclose your PHI to authorized federal officials to perform intelligence, counterintelligence, medical suitability determinations, Presidential protection activities and other national security activities authorized by law.
If you are a member of the U.S. Armed Forces or of a foreign military, we may disclose your PHI as required by military command authorities or law.
If you are an inmate in a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to those parties if disclosure is necessary for: the provision of your health care, maintaining the health or safety of yourself or other inmates, or ensuring the safety and security of the correctional institution or its agents.
Qualifications & exceptions
Military disclosures are as required by military command authorities or law.
Correctional disclosures apply only if necessary for one of the listed purposes.
Legal Rights & Agreement Rules · Company commitment
Disclosures required by law; stronger local laws followed
The affiliates will disclose PHI about you when required to do so by law. If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, they say they will follow those laws to the extent they apply.
Supporting quotations
We will disclose PHI about you when required to do so by law.
If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.
Qualifications & exceptions
More protective laws apply "to the extent they apply".
Sharing & Disclosure · Permission or license
Health oversight agencies
The affiliates may disclose PHI to a health oversight agency performing activities authorized by law, such as investigations and audits. These agencies include governmental agencies that oversee the health care system, government benefit programs, and organizations subject to government regulation and civil rights laws.
Supporting quotations
We may disclose PHI to a health oversight agency performing activities authorized by law, such as investigations and audits.
These agencies include governmental agencies that oversee the health care system, government benefit programs, and organizations subject to government regulation and civil rights laws.
Inference & Profiling · Permission or license
Creating de-identified data for business activities
The affiliates may use your PHI to create data that cannot be linked to you by removing certain elements such as your name, address, telephone number and member identification number. They may use this de-identified information for certain business activities, for example to create summary reports and to analyze and monitor industry trends.
Supporting quotations
We may use your PHI to create data that cannot be linked to you by removing certain elements from your PHI, such as your name, address, telephone number and member identification number.
We may use this de-identified information to conduct certain business activities; for example, to create summary reports and to analyze and monitor industry trends.
Qualifications & exceptions
The data is described as de-identified, with the listed identifiers removed.
Not stated here
The full set of identifiers removed and any "certain business activities" beyond summary reports and trend analysis are not specified.
Sharing & Disclosure · Permission or license
Averting a serious threat to health or safety
The affiliates may disclose your PHI to prevent or lessen an imminent threat to the health or safety of another person or the public. The disclosure will only be made to someone in a position to prevent or lessen the threat.
Supporting quotations
We may disclose your PHI to prevent or lessen an imminent threat to the health or safety of another person or the public.
Such disclosure will only be made to someone in a position to prevent or lessen the threat.
Qualifications & exceptions
Requires an imminent threat; recipient must be in a position to prevent or lessen it.
Legal Rights & Agreement Rules · User right or choice
Uses that require your authorization
Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures for marketing purposes, and disclosures that constitute a sale of PHI require an authorization. Any other use or disclosure of your PHI not listed in the Notice will be made only with your authorization, unless applicable law permits the use or disclosure, in which case the affiliates say they will comply with applicable law.
Supporting quotations
Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures for marketing purposes and disclosures that constitute a sale of PHI require an authorization.
These activities and any other uses and disclosures of your PHI not listed in this Notice will be made only with your authorization unless we are permitted by applicable law to make such other use and disclosure, in which case we shall comply with applicable law.
These studies generate aggregate data that we may sell or disclose to other companies or organizations.
Qualifications & exceptions
"Most" uses and disclosures of psychotherapy notes, and only "where appropriate".
The authorization requirement for unlisted uses has an exception where applicable law permits them.
Not stated here
The Notice elsewhere says the affiliates may sell or disclose aggregate data that does not identify you; this passage does not say whether such sales count as a "sale of PHI", so how the two statements fit together is not stated.
Marketing is not defined here, and the earlier passage on contacting you about "other products that may benefit your health" does not say whether it is treated as marketing.
Cross-references
contrast (model-proposed): Aggregate data may be studied, sold or disclosed — contrast: One passage says disclosures that constitute a sale of PHI require authorization; another says aggregate data (described as not identifying you) may be sold or disclosed to other companies. The Notice does not say whether aggregate data counts as PHI, so the two are shown side by side rather than reconciled.
contrast (model-proposed): Contact about treatment options and other products — contrast: The Notice says uses for marketing purposes require authorization, and separately says the affiliates may contact you about treatment options and other products that may benefit your health without listing authorization. It does not say whether that contact counts as marketing, so both statements are shown.
Legal Rights & Agreement Rules · User right or choice
Revoking an authorization
You may revoke your authorization, in writing, at any time, unless the affiliates have already taken action in reliance on it. The written revocation must be sent to the address listed below in the Notice.
Supporting quotations
You may revoke your authorization, in writing, at any time unless we have taken action in reliance upon it.
Written revocation of authorization must be sent to the address listed below.
Qualifications & exceptions
Revocation must be in writing.
Does not undo action already taken in reliance on the authorization.
Not stated here
The Notice does not say how quickly a revocation takes effect.
Cross-references
related (model-proposed): Where to send requests, complaints and revocations — references: The revocation passage sends written revocations to the address listed below, which is the Privacy Office contact in the rights section.
Legal Rights & Agreement Rules · Context
Categories of PHI that may get extra legal protection
The Notice says certain types of PHI may be subject to enhanced privacy protections under federal and/or state laws. It lists: psychotherapy notes; PHI related to reproductive health care; PHI concerning alcohol and drug abuse prevention, treatment and referral; PHI involving HIV/AIDS testing, diagnosis or treatment; PHI related to venereal and other communicable diseases; and PHI associated with genetic testing.
Supporting quotations
Certain types of Protected Health Information (PHI) may be subject to enhanced privacy protections under federal and/or state laws.
Psychotherapy notes
PHI related to reproductive health care
PHI concerning alcohol and drug abuse prevention, treatment, and referral
PHI involving HIV/AIDS testing, diagnosis, or treatment
PHI related to venereal and other communicable diseases
PHI associated with genetic testing
Qualifications & exceptions
The protections "may" apply, depending on federal and/or state law.
Not stated here
The Notice does not say what the enhanced protections are or which state or federal laws apply.
Legal Rights & Agreement Rules · Restriction or exception
Substance use disorder treatment information
The affiliates say they are not a substance use disorder treatment program (a "SUD Program") but may receive information from one about your treatment. They may not disclose that information so it can be used in a civil, criminal, administrative or legislative proceeding against you unless they have your written consent, or a court order accompanied by a subpoena or other legal requirement compelling disclosure, issued after they and you were given notice and an opportunity to be heard. If they use this information to raise funds for their benefit, they must first give you a clear and conspicuous opportunity to elect not to receive fundraising communications.
Supporting quotations
Although we are not a substance use disorder treatment program (a “SUD Program”), we may receive information from a SUD Program about your treatment.
We may not disclose this information so that it can be used in a civil, criminal, administrative, or legislative proceeding against you unless (i) we have your written consent, or (ii) a court order accompanied by a subpoena or other legal requirement compelling disclosure issued after we and you were given notice and an opportunity to be heard.
In addition, if we use this information to raise funds for our benefit, we must first provide you with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
Qualifications & exceptions
The ban on use in proceedings against you is lifted only by your written consent or a court order with a subpoena or other legal requirement issued after notice and an opportunity to be heard.
Applies to information received from a SUD Program.
Cross-references
narrows (model-proposed): Disclosure in judicial and administrative proceedings — exception_to: The general rule allows disclosure in judicial and administrative proceedings in response to legal process after notice efforts; information received from a SUD Program has the stricter limit that it cannot be used in a proceeding against you without written consent or a court order after notice and opportunity to be heard.
Sharing & Disclosure · Context
Redisclosed PHI may lose HIPAA protection
The Notice includes a statement written in the first person ("I understand") that once PHI is disclosed it may no longer be protected by HIPAA and may be subject to re-disclosure. Because it is written from the individual’s perspective and sits at the end of the SUD passage, the text does not say whether it is meant to apply to all disclosures or only SUD information.
Supporting quotations
Redisclosure – I understand that once my PHI is disclosed it may be no longer be protected by the Health Insurance Portability and Accountability Act (HIPAA) and may be subject to re-disclosure.
Qualifications & exceptions
Says protection "may" be lost, not that it always is.
Not stated here
Whether this statement applies to all PHI or only to SUD information is not clear from the text.
The first-person wording suggests it may have been drawn from a consent form; the Notice does not say.
Legal Rights & Agreement Rules · User right or choice
Your rights regarding the PHI maintained about you
The Notice sets out individual rights regarding the PHI the affiliates maintain about you. The rights that follow are: inspect and copy, amend, an accounting of disclosures, request restrictions, confidential communications, be notified of a breach, a paper copy of the Notice, and to file a complaint.
Supporting quotations
You have the following rights regarding the PHI we maintain about you.
Account & Service Control · User right or choice
Right to inspect and copy your records
Subject to some restrictions, you may inspect and copy PHI that may be used to make decisions about you, as well as records of enrollment, payment, claims adjudication, and case or medical management. If the records are kept electronically, you can request them in electronic format and may have them sent to a third party, including a Health Information Exchange (HIE). If you request copies, the affiliates may charge reasonable expenses for copying and mailing. Under limited circumstances they may deny access to a portion of your records.
Supporting quotations
Subject to some restrictions, you may inspect and copy PHI that may be used to make decisions about you, as well as records of enrollment, payment, claims adjudication, and case or medical management.
If we maintain such records electronically, you have the right to request such records in electronic format. You may also have the records sent to a third party, including requesting that we share your PHI with a Health Information Exchange (HIE).
If you request copies, we may charge reasonable expenses incurred with copying and mailing the records.
Under limited circumstances, we may deny you access to a portion of your records.
Qualifications & exceptions
"Subject to some restrictions."
Reasonable copying and mailing expenses may be charged.
Access to a portion of the records may be denied "under limited circumstances".
Not stated here
The limited circumstances for denying access are not described.
Account & Service Control · User right or choice
Right to ask for corrections to your PHI
If you believe PHI about you is incorrect or incomplete, you may ask the affiliates to amend it. You must give a reason supporting your request, and they may deny the request in some instances. If they determine the PHI is inaccurate, they will correct it if permitted by law. If a health care facility or professional created the information, the Notice says to ask them to amend it.
Supporting quotations
If you believe PHI about you is incorrect or incomplete, you may ask us to amend the information. You must provide a reason supporting your request to amend.
We may deny the request in some instances. If we determine that the PHI is inaccurate, we will correct it if permitted by law.
If a health care facility or professional created the information that you want to change, you should ask them to amend the information.
Qualifications & exceptions
A supporting reason is required.
Correction happens only if the PHI is determined to be inaccurate and the law permits it.
Not stated here
The instances in which a request may be denied are not listed.
Account & Service Control · User right or choice
Right to an accounting of disclosures
You have the right to request an accounting of the disclosures the affiliates have made of your PHI other than for treatment, payment or health care operations. The accounting is subject to certain restrictions and excludes, among others, disclosures to you and disclosures you authorized; disclosures made more than six years before your request (for disclosures from an electronic health record, this may be limited to three years); and certain other disclosures excepted by law. If you request an accounting more than once in any 12-month period, a reasonable fee may be charged for each report after the first.
Supporting quotations
You have the right to request an accounting of disclosures of your
This accounting identifies the disclosures we have made of your PHI other than for treatment, payment or health care operations.
The provision of an accounting of disclosures is subject to certain restrictions.
Disclosures to you as well as disclosures you have authorized
Disclosures made earlier than six years before the date of your request (in the case of disclosures made from an electronic health record, this period may be limited to three years before the date of your request)
Certain other disclosures that are excepted by law
If you request an accounting more than once during any 12-month period, we may charge you a reasonable fee for each accounting report after the first one.
Qualifications & exceptions
Excludes treatment, payment and health care operations disclosures and the listed exclusions "among others".
Time limit of six years, which may be three for electronic health record disclosures.
A reasonable fee may apply after the first request in a 12-month period.
Use & Processing · User right or choice
Right to request restrictions on use and disclosure
You may request a restriction or limitation on the PHI the affiliates use and disclose for treatment, payment or health care operations, and may ask that your PHI not be disclosed to family members or friends involved in your care or its payment. The request must be in writing and state the restriction and to whom it applies. The affiliates are not required to agree. If they do agree, they will comply unless the restricted information is needed to provide you with emergency treatment.
Supporting quotations
You have the right to request a restriction or limitation on the PHI we use and disclose about you for treatment, payment or health care operations.
You may also request your PHI not be disclosed to family members or friends who may be involved in your care or paying for your care.
Your request must be in writing; state the restrictions you are requesting and state to whom the restriction applies. We are not required to agree to your request.
If we do agree, we will comply with your request unless the restricted information is needed to provide you with emergency treatment.
Qualifications & exceptions
Request must be in writing and state the restrictions and to whom they apply.
The affiliates are "not required to agree", with a required exception for out-of-pocket medications described in a separate card.
An agreed restriction does not apply if the information is needed for emergency treatment.
Use & Processing · User right or choice
Required agreement for medications you paid for in full
The affiliates say they will agree to your request to restrict PHI disclosed to a health plan for payment or health care operations (non-treatment) purposes if the information is about a medication for which you paid them, out-of-pocket, in full. This is an exception to the general statement that they are not required to agree to restriction requests.
Supporting quotations
We will agree to your request to restrict PHI disclosed to a health plan for payment or health care operations (that is, non-treatment) purposes if the information is about a medication for which you paid us, out-of-pocket, in full.
Qualifications & exceptions
Applies to disclosures to a health plan for payment or health care operations, not treatment.
Applies only when you paid out-of-pocket, in full, for the medication.
Not stated here
Whether the written-request requirement for restrictions also applies here is not separately stated; the surrounding text says requests must be in writing.
Cross-references
narrows (model-proposed): Right to request restrictions on use and disclosure — exception_to: Restriction requests need not be agreed to in general, but the affiliates will agree where the information is about a medication you paid for out-of-pocket in full and is disclosed to a health plan for payment or operations.
Account & Service Control · User right or choice
Right to confidential communications
You may ask the affiliates to communicate with you in an alternate way or at an alternate location to protect the confidentiality of your PHI. Your request must state the alternate method or location you want them to use.
Supporting quotations
You may ask that we communicate with you in an alternate way or at an alternate location to protect the confidentiality of your PHI.
Your request must state an alternate method or location you would like us to use to communicate your PHI to you.
Qualifications & exceptions
The request must state the alternate method or location.
Not stated here
The passage does not say whether the request must be in writing or whether the affiliates may refuse.
Security & Safeguards · User right or choice
Right to be notified of a breach
You have the right to be notified following a breach of unsecured PHI if your PHI is affected.
Supporting quotations
You have the right to be notified following a breach of unsecured PHI if your PHI is affected.
Qualifications & exceptions
Applies to breaches of unsecured PHI that affect your PHI.
Not stated here
The timing and method of breach notice are not stated.
Account & Service Control · User right or choice
Right to a paper copy of this Notice
You have the right to request a paper copy of the Notice at any time, even if you agreed to receive it electronically. To get a copy or answers to frequently asked questions, call Customer Service at the number on your customer ID card or contact Cigna Customer Service at 1-800-244-6224 or Evernorth Customer Service at 1-877-279-6391. The Notice can also be obtained from www.TheCignaGroup.com or www.Evernorth.com.
Supporting quotations
You have the right to request a paper copy of this Notice at any time.
Cigna Customer Service: 1-800-244-6224 or Evernorth Customer Service: 1-877-279-6391
Even if we agreed to provide this Notice electronically, you are still entitled to a paper copy. You may obtain a copy of this Notice from our website at: www.TheCignaGroup.com or www.Evernorth.com.
Legal Rights & Agreement Rules · User right or choice
Right to file a complaint, with no retaliation
If you believe the affiliates violated your privacy rights, you may send a written complaint to their Privacy Office at the contact listed in the Notice. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. The Notice says you will not face retaliation for filing a complaint.
Supporting quotations
Right to File a Complaint – If you believe we violated your privacy rights, you may address a written complaint to our Privacy Office at the contact below. You may also file a complaint with the Secretary of the U.S. Dept. of Health and Human Services. You will not face retaliation for filing a complaint.
Qualifications & exceptions
Complaints to the Privacy Office are written.
Account & Service Control · Procedure
Where to send requests, complaints and revocations
Written complaints, revocations of authorization, requests for a copy of your PHI, amendments, accountings of disclosures, restrictions and confidential communications may be mailed to The Cigna Group Privacy Office, PO Box 188014, Chattanooga, TN 37422. Email addresses are also listed: privacyoffice@cigna.com for Cigna Healthcare and privacy@evernorth.com for Evernorth. Include your full name, address and customer ID number. For certain types of requests you must provide written documentation if applicable. Some preference edits and forms are on the Cigna website at https://www.Cigna.com/legal/members/member-privacy-forms, or you can contact Customer Service at the number on your customer ID card.
Supporting quotations
Written complaints, revocation of authorization to use or disclose PHI, requests for a copy of your PHI, amendment to your PHI, an accounting of disclosures, restrictions on your PHI or confidential communications may be mailed to:
The Cigna Group Privacy Office
PO Box 188014 Chattanooga, TN 37422
Email Cigna Healthcare: privacyoffice@cigna.com
Email Evernorth: privacy@evernorth.com
Please include your full name, address and customer ID number.
For certain types of requests, you must provide written documentation if applicable.
Certain preference edits and forms are available on our website.
Written revocation of authorization must be sent to the address listed below.
Qualifications & exceptions
The text says requests "may be mailed"; it lists email addresses but does not say that every kind of request is accepted by email.
Written documentation is needed for certain types of requests "if applicable".
Not stated here
Which request types require written documentation, and whether email is accepted for each request type, are not specified.
Legal Rights & Agreement Rules · Company practice
The affiliates may revise this Notice
The affiliates reserve the right to revise the Notice. A revised Notice will be effective for PHI they already have about you as well as any PHI they receive in the future. They say they will communicate revisions through www.TheCignaGroup.com/PrivacyPolicy or www.Evernorth.com.
Supporting quotations
We Reserve the Right to Revise this Notice – A revised Notice will be effective for PHI we already have about you, as well as any PHI we may receive in the future.
We will communicate revisions to this Notice through our websites www.TheCignaGroup.com/PrivacyPolicy or www.Evernorth.com.
Qualifications & exceptions
Revisions apply to PHI already held and to future PHI.
Not stated here
The Notice names its websites as the way revisions are communicated; it does not promise direct notice to you.
Legal Rights & Agreement Rules · Context
Effective date of this Notice
The Notice states it is effective as of April 14, 2003, and was updated as of August 18, 2025.
Supporting quotations
Effective Date – This Notice is effective as of April 14, 2003, and updated as of August 18, 2025.
Legal Rights & Agreement Rules · Context
Which Cigna subsidiaries provide products and services
The closing legal text says all Cigna products and services are provided exclusively by or through operating subsidiaries of Cigna Corporation, and lists them: Cigna Health and Life Insurance Company, Connecticut General Life Insurance Company, American Retirement Life Insurance Company, Cigna National Health Insurance Company, Loyal American Life Insurance Company, Evernorth Behavioral Health, Sterling Life Insurance Company, Cigna Health Management, Inc., and HMO or service company subsidiaries of Cigna Health Corporation, Evernorth Care Solutions, Inc., and Cigna Dental Health, Inc. This is the nearest thing in the Notice to a list of the entities behind "we".
Supporting quotations
All Cigna products and services are provided exclusively by or through operating subsidiaries of Cigna Corporation, including
Cigna Health and Life Insurance Company, Connecticut General Life Insurance Company, American Retirement Life Insurance Company, Cigna National Health Insurance Company, Loyal American Life Insurance Company, Evernorth Behavioral Health, Sterling Life Insurance Company, Cigna Health Management, Inc., and HMO or service company subsidiaries of Cigna Health Corporation, Evernorth Care Solutions, Inc., and Cigna Dental Health, Inc.
This Notice is provided by one or more subsidiaries of The Cigna Group that operate as affiliated covered entities under HIPAA (“we”).
Qualifications & exceptions
The list uses "including", so it is not stated to be exhaustive.
Not stated here
The Notice does not say which of these subsidiaries are the "affiliated covered entities" that issue the Notice, or which one holds a given member’s PHI.
The Notice refers to "The Cigna Group" in the body and "Cigna Corporation" in this closing text; it does not explain the relationship between the two names.
Content & IP Rights · Context
Ownership of the Cigna name and marks
The Cigna name, logo and other Cigna marks are stated to be owned by Cigna Intellectual Property, Inc.
Supporting quotations
The Cigna name, logo, and other Cigna marks are owned by Cigna Intellectual Property, Inc.
Sharing & Disclosure · Permission or license
Treatment: sharing PHI with health care professionals and third parties
The affiliates may use and disclose your PHI to health care professionals or other third parties to provide, coordinate and manage the delivery of health care. The examples given are ordering lab tests and using results, and disclosing PHI about you to your doctor to coordinate the prescribing and delivery of your drugs. They may also send treatment reminders and information about potential side effects, drug interactions and other treatment-related issues involving your medicine.
Supporting quotations
How We May Use PHI Without Your Authorization
We may use and disclose your PHI to health care professionals or other third parties to provide, coordinate and manage the delivery of health care.
We also may provide you with treatment reminders and information about potential side effects, drug interactions and other treatment-related issues involving your medicine.
Qualifications & exceptions
Described as a use and disclosure that does not need your authorization (listed under "How We May Use PHI Without Your Authorization").
Not stated here
The source sentence giving the lab-test and pharmacist examples is grammatically garbled; this summary follows its evident meaning that PHI may be disclosed to your doctor to coordinate prescribing and delivery of drugs.
Use & Processing · Permission or license
Payment: using and disclosing PHI for payment and claims
The affiliates may use and disclose PHI about you to receive payment for their services or premiums for your coverage, manage your account, fulfill their responsibilities under your benefit plan and process your claims for drugs you have received. For example, they may give PHI to your health plan (or its designee) to confirm eligibility or coverage, or submit claims to your health plan, employer or other third party for payment.
Supporting quotations
We may use and disclose PHI about you to receive payment for our services or premiums for your coverage, manage your account, fulfill our responsibilities under your benefit plan and process your claims for drugs you have received.
we may submit claims to your health plan, employer or other third party for payment
Qualifications & exceptions
Listed among uses that do not require your authorization.
Use & Processing · Permission or license
Health care operations: business planning and health-management information
The affiliates may use and disclose your PHI to carry on their own business planning and administrative operations, which they say they need to do to provide high-quality services. Examples: sharing claims information with your doctor if you have a medical need that requires attention, assessing the use or effectiveness of certain drugs, developing and monitoring medical protocols, and providing information about helpful health-management services.
Supporting quotations
We may use and disclose your PHI to carry on our own business planning and administrative operations.
we may share your claims information with your doctor if you have a medical need that requires attention; we may use and disclose PHI about you to assess the use or effectiveness of certain drugs, develop and monitor medical protocols, and to provide information regarding helpful health-management services
Qualifications & exceptions
Examples are illustrative; the stated purpose is "our own business planning and administrative operations".
Sharing & Disclosure · Permission or license
Disclosures to your employer as health plan sponsor
Where permitted by law, the affiliates may disclose your PHI to your employer or to a company acting on your employer’s behalf so that entity can monitor, audit and otherwise administer the employee health plan in which you participate. The Notice says your employer is not permitted to use the PHI for any purpose other than administration of your benefits. It tells you to see your employer’s health plan documents to learn whether your employer receives PHI and which employees are authorized to receive it.
Supporting quotations
Where permitted by law, we may disclose your PHI to your employer or to a company acting on your employer’s behalf, so that entity can monitor, audit and otherwise administer the employee health plan in which you participate.
Your employer is not permitted to use the PHI we disclose for any purpose other than administration of your benefits.
See your employer’s health plan documents for information on whether your employer receives PHI and, if so, the identity of the employees who are authorized to receive your PHI.
Qualifications & exceptions
Only "where permitted by law".
Employer use is limited to administration of your benefits.
Not stated here
Whether your own employer actually receives PHI, and which employees may receive it, is not stated; the Notice refers you to your employer’s health plan documents.
Use & Processing · Permission or license
Contact about treatment options and other products
The affiliates may use or disclose your PHI to contact you about treatment options or alternatives that may be of interest to you. Examples: calling to remind you of expired prescriptions or the availability of alternative drugs, or to inform you of other products that may benefit your health.
Supporting quotations
We may use or disclose your PHI to contact you about treatment options or alternatives that may be of interest to you.
or to inform you of other products that may benefit your health
Qualifications & exceptions
Listed among uses without authorization; elsewhere the Notice separately says marketing uses require an authorization, and this passage does not say how the two fit together.
Not stated here
"Other products that may benefit your health" is not defined, and the passage does not say whether those could be third-party products.
Sharing & Disclosure · Permission or license
Disclosures to people involved in your care or payment
The affiliates may disclose PHI about you to someone who assists in or pays for your care. Unless you write to them and specifically tell them not to, they may disclose your PHI to someone who has your permission to act on your behalf, and they will require that person to provide adequate proof of that permission.
Supporting quotations
We may disclose PHI about you to someone who assists in or pays for your care.
Unless you write to us and specifically tell us not to, we may disclose your PHI to someone who has your permission to act on your behalf.
We will require this person to provide adequate proof that he or she has your permission.
Qualifications & exceptions
Your way to stop disclosure to someone acting on your behalf is a written instruction.
The recipient must give adequate proof of your permission.
Sharing & Disclosure · Permission or license
Release of a minor’s or ward’s PHI to parents or guardians
If you are a minor or under a legal guardianship, the affiliates may release your PHI to your parents or legal guardians when they are permitted or required to do so under federal and applicable state law.
Supporting quotations
If you are a minor or under a legal guardianship, we may release your PHI to your parents or legal guardians when we are permitted or required to do so under federal and applicable state law.
Qualifications & exceptions
Only when permitted or required by federal and applicable state law.
Sharing & Disclosure · Permission or license
Business associates and their vendors
The affiliates arrange some services through contracts with business associates and may disclose your PHI to business associates acting on their behalf. The Notice says business associates are required by law and contract to protect the information, and that PHI is protected using confidentiality agreements. If a business associate uses vendors, the business associate must enter into a confidentiality agreement with the vendor.
Supporting quotations
We may disclose your PHI to business associates acting on our behalf.
Business Associates are required by law and contract to protect the privacy of sensitive information.
Our business associates may, in turn, use vendors to assist them in providing services to us. If so, the business associates must enter into a confidentiality agreement with the vendor, which protects your information from unauthorized use and disclosure.
Qualifications & exceptions
Disclosure is to business associates "acting on our behalf".
Vendors of business associates must also sign a confidentiality agreement.
Not stated here
The Notice does not name business associates or vendors or say what services they perform beyond helping the affiliates "operate more efficiently".
Use & Processing · Permission or license
Research uses of PHI
Under certain circumstances, the affiliates may use and disclose PHI about you for research purposes. Before doing so, they say they will remove information that personally identifies you, obtain your written authorization, or gain approval through a special approval process designed to protect the privacy of your PHI.
Supporting quotations
Under certain circumstances, we may use and disclose PHI about you for research purposes.
Before we use or disclose PHI about you, we will remove information that personally identifies you, obtain your written authorization or gain approval through a special approval process designed to protect the privacy of your PHI.
Qualifications & exceptions
Only "under certain circumstances".
One of three safeguards applies before use or disclosure: removing identifying information, your written authorization, or a special approval process.
Not stated here
The Notice does not say what the "special approval process" is or when each safeguard is used.
Sharing & Disclosure · Company practice
Aggregate data may be studied, sold or disclosed
In some circumstances the affiliates may use your PHI to generate aggregate data (summarized data that does not identify you) to study outcomes, costs and provider profiles, and to suggest benefit designs for your employer or health plan. The Notice states that these studies generate aggregate data that the affiliates may sell or disclose to other companies or organizations, and that aggregate data does not personally identify you.
Supporting quotations
In some circumstances, we may use your PHI to generate aggregate data (summarized data that does not identify you) to study outcomes, costs and provider profiles, and to suggest benefit designs for your employer or health plan.
These studies generate aggregate data that we may sell or disclose to other companies or organizations.
Aggregate data does not personally identify you.
Qualifications & exceptions
Applies to aggregate data, which the Notice describes as not personally identifying you.
Described as occurring "in some circumstances".
Not stated here
Recipients of sold or disclosed aggregate data are not identified, and the method of aggregation is not described.
Sharing & Disclosure · Permission or license
Reporting suspected abuse, neglect or domestic violence
The affiliates may disclose your PHI to a social service, protective agency or other government authority if they believe you are a victim of abuse, neglect or domestic violence. They will inform you of the disclosure unless informing you would place you at risk of serious harm.
Supporting quotations
We may disclose your PHI to a social service, protective agency or other government authority if we believe you are a victim of abuse, neglect or domestic violence. We will inform you of our disclosure unless informing you would place you at risk of serious harm.
Qualifications & exceptions
Requires a belief that you are a victim.
You are told unless that would put you at risk of serious harm.
Sharing & Disclosure · Permission or license
Public health disclosures, including payment received
The affiliates may disclose your PHI for public health activities and purposes, such as regulatory reporting (for example reporting adverse events, vaccination efforts to avert the spread of communicable diseases) or post-marketing surveillance in connection with FDA-mandates or product recalls. The Notice also states that they may receive payment from a third party for making disclosures for public health activities and purposes.
Supporting quotations
We may disclose your PHI for public health activities and purposes, such as regulatory reporting (e.g., reporting adverse events, vaccination efforts to avert the spread of communicable diseases) or for post-marketing surveillance in connection with FDA-mandates or product recalls.
We may receive payment from a third party for making disclosures for public health activities and purposes.
Qualifications & exceptions
Examples are introduced with "such as" and are not an exhaustive list.
Not stated here
The third parties that might pay, and the amounts or conditions of payment, are not stated.
Legal Rights & Agreement Rules · Permission or license
Disclosure in judicial and administrative proceedings
The affiliates may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena or other lawful process, but only after they have been assured that efforts have been made to notify you of the request. A separate passage limits use of substance use disorder treatment information that the affiliates receive from a SUD program: it may not be disclosed for use in a civil, criminal, administrative or legislative proceeding against you without your written consent or a court order accompanied by a subpoena or other legal requirement issued after notice to you and an opportunity to be heard.
Supporting quotations
We may disclose your PHI in the course of any judicial or administrative proceeding in response to a court order, subpoena or other lawful process, but only after we have been assured that efforts have been made to notify you of the request.
We may not disclose this information so that it can be used in a civil, criminal, administrative, or legislative proceeding against you unless (i) we have your written consent, or (ii) a court order accompanied by a subpoena or other legal requirement compelling disclosure issued after we and you were given notice and an opportunity to be heard.
Qualifications & exceptions
Only in response to a court order, subpoena or other lawful process, and only after assurance that efforts were made to notify you.
Information received from a SUD program has the stricter condition described in the later passage.