Some PHI disclosures need no written authorization
Under the heading for uses of PHI without your authorization, Cigna Healthcare says it may commonly disclose your PHI without your written authorization for treatment, payment and health care operations, and may also do so for a second list of other purposes 'as permitted or required by law'. This is a permission, not a promise to disclose in every case. The permission is limited for specially protected PHI: the notice says that for the categories it calls 'Highly Confidential' (psychotherapy notes, substance use disorder, HIV/AIDS, venereal or communicable disease, genetic testing information), it can only disclose with your prior written authorization except when specifically permitted or required by law.
Supporting quotations
Uses of PHI without your authorization
We may commonly disclose your PHI without your written authorization for the following purposes:
We may also disclose your PHI without your written authorization for the following other purposes, as permitted or required by law:
Protected Health Information (PHI)
Highly Confidential
We can only disclose this type of specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Qualifications & exceptions
The first list is introduced with 'commonly'; the second list is limited to purposes 'as permitted or required by law'.
'May' describes what Cigna Healthcare is allowed to do, not what it will always do.
Specially protected PHI is subject to the stricter authorization rule in the later 'Highly Confidential' section, with the same 'permitted or required by law' exception.
Not stated here
The notice does not say how often any listed disclosure actually happens or to whom in a given case.
Sharing & Disclosure · Permission or license
Disclosure of PHI for treatment
Cigna Healthcare says it may disclose your PHI without written authorization for treatment: to share with hospital staff, nurses, doctors, pharmacists, optometrists, health educators and other health care professionals and personnel at health care facilities so they can determine your plan of care; to help you obtain services and treatment you may need (for example ordering lab tests and using the results); and to coordinate your health care and related services with a different health care facility or professional.
Supporting quotations
Treatment:
To share with hospital staff, nurses, doctors, pharmacists, optometrists, health educators and other health care professionals and personnel at health care facilities so they can determine your plan of care.
To help you obtain services and treatment you may need. For example, to order lab tests and using the results.
To coordinate your health care and related services with a different health care facility or professional.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Not stated here
The notice does not say which health care professionals or facilities in a given country receive the information.
Sharing & Disclosure · Permission or license
Disclosure of PHI for payment and benefits administration
Cigna Healthcare says it may disclose your PHI without written authorization for payment: to obtain payment of premiums for your coverage; to make coverage determinations (for example speaking with a health care professional about payment for services provided to you); to coordinate benefits with other coverage you may have (for example speaking with another health plan or insurer to determine eligibility or coverage); to obtain payment from a third party that may be responsible, such as a family member; and to otherwise determine and fulfill its responsibility to provide your health benefits, for example administering claims.
Supporting quotations
Payment:
To obtain payment of premiums for your coverage.
To make coverage determinations. For example, to speak to a health care professional about payment for services provided to you.
To coordinate benefits with other coverage you may have. For example, to speak to another health plan or insurer to determine your eligibility or coverage.
To obtain payment from a third party that may be responsible for payment, such as a family member.
To otherwise determine and fulfill our responsibility to provide your health benefits. For example, to administer claims.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Not stated here
The notice does not say how much PHI is shared with a third party or family member when seeking payment.
Sharing & Disclosure · Permission or license
Disclosure of PHI for health care operations
Cigna Healthcare says it may disclose your PHI without written authorization for health care operations: to provide customer service; to support and/or improve the programs or services it offers you; to assist you in managing your health (for example giving you information about treatment alternatives); and to support another health plan, insurer or health care professional who has a relationship with you for activities such as case management, care coordination and quality improvement. Its example is sharing your claims information with your doctor if you have a medical need that requires attention.
Supporting quotations
Health care operations:
To provide customer service.
To support and/or improve the programs or services we offer you.
To assist you in managing your health. For example, to provide you with information about treatment alternatives to which you may be entitled.
To support another health plan, insurer, or health care professional who has a relationship with you for activities such as case management, care coordination and quality improvement activities.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Disclosure to another plan, insurer or professional is tied to one who 'has a relationship with you'.
Not stated here
'Support and/or improve the programs or services' is broad; the notice does not say whether de-identified or identified data is used.
Sharing & Disclosure · Permission or license
Disclosure to family, caregivers and a child's other parent
Cigna Healthcare says it may disclose your PHI without written authorization to others involved in your health care. If you are present or otherwise available to direct it, it may disclose to others such as a family member, close friend or caregiver. If you are in an emergency, not present or incapacitated, it will use professional judgment to decide whether disclosure is in your best interests, and would then disclose only information directly relevant to the person's involvement with your treatment or payment for it; it may also disclose PHI to notify, or help notify, such persons of your location or general medical condition. Separately, it states that it may disclose your child's PHI to your child's other parent.
Supporting quotations
Disclosures to others involved in your health care.
If you are present or otherwise available to direct us to do so, we may disclose your PHI to others. For example, a family member, a close friend, or your caregiver.
If you are in an emergency situation, are not present, or are incapacitated, we will use our professional judgment to decide whether disclosing your PHI to others is in your best interests.
we would disclose only information that is directly relevant to the person’s involvement with your treatment or for payment related to your treatment
We may also disclose your PHI in order to notify (or assist in notifying) such persons of your location or your general medical condition.
We may disclose your child’s PHI to your child’s other parent.
Qualifications & exceptions
The 'directly relevant' limit is stated for situations where you are unavailable.
This list is introduced as disclosures 'as permitted or required by law'.
Not stated here
The disclosure of a child's PHI to the child's other parent is stated without conditions in this item (for example the child's age or any court order); the notice does not say whether other limits apply.
Sharing & Disclosure · Permission or license
Disclosure to your employer as plan sponsor
Cigna Healthcare says it may disclose your PHI to your employer, or to a company acting on your employer's behalf, so that entity can monitor, audit and otherwise administer the employee health plan you participate in. The notice says the employer is not permitted to use that PHI for any purpose other than administration of your benefits. It adds that the Health Plan may also give Summary Health Information to the plan sponsor as allowed by law, so the sponsor can solicit premium bids from other health plans or modify, amend or terminate the plan. For whether your employer receives PHI and who may receive it, the notice points you to your employer's health plan documents.
Supporting quotations
Disclosures to your employer as sponsor of your health plan.
We may disclose your PHI to your employer or to a company acting on your employer’s behalf, so that entity can monitor, audit and otherwise administer the employee health plan in which you participate.
Your employer is not permitted to use the PHI we disclose for any purpose other than administration of your benefits.
The Health Plan may also provide Summary Health Information to the plan sponsor as allowed by law so that the plan sponsor may solicit premium bids from other health plans or modify, amend or terminate the plan.
See your employer’s health plan documents for information on whether your employer receives PHI and, if so, the identity of the employees who are authorized to receive your PHI.
Qualifications & exceptions
Applies to members of an employer-sponsored health plan.
Summary Health Information is described as provided 'as allowed by law'.
The employer's use is limited to administration of your benefits.
Not stated here
Whether your own employer actually receives PHI, and which of its employees may see it, is left to your employer's health plan documents, which are not supplied here.
'The Health Plan' and 'Summary Health Information' are not defined in this notice.
Cross-references
contrast (model-proposed): Written authorization needed for uses not otherwise described — contrast: Disclosure to your employer as plan sponsor is allowed without authorization for administering the employee health plan, while use of PHI with a prospective employer is listed as needing authorization; the two concern different employer roles.
Sharing & Disclosure · Permission or license
Disclosure to service vendors and accreditation bodies
Cigna Healthcare says it may disclose your PHI to companies that perform services it has requested (for example vendors that help provide information and guidance to users with chronic conditions like diabetes and asthma) and to accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement. It states that before sharing PHI it obtains the vendor's or accreditation organization's written agreement to protect the privacy of the PHI.
Supporting quotations
Disclosures to vendors and accreditation organizations.
Companies that perform certain services we’ve requested. For example, we may engage vendors to help us to provide information and guidance to users with chronic conditions like diabetes and asthma.
Accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement purposes.
before we share your PHI, we obtain the vendor’s or accreditation organization’s written agreement to protect the privacy of your PHI
Qualifications & exceptions
Sharing is conditioned on a written agreement by the recipient to protect the privacy of the PHI.
Not stated here
The notice does not name vendors or say which services vendors perform beyond the chronic-condition example; the example is introduced with 'for example' and is not an exhaustive list.
Under a 'Communications' item, Cigna Healthcare lists, as purposes for which it may disclose your PHI without written authorization, encouraging you to purchase or use a product or service that is not part of its health care services and benefits when it meets with you in person, as permitted by law, and providing you a promotional gift of nominal value. It then says that, except as permitted by law, it will not use your PHI for marketing purposes without your prior written authorization. The later authorization section lists marketing communications, including those paid for by a third party, as needing your authorization.
Supporting quotations
Communications.
Encourage you to purchase or use a product or service that is not part of the health care services and benefits we provide when we meet with you in person, as permitted by law.
Provide you with a promotional gift of nominal value.
Except as permitted by law, we will not use your PHI for marketing purposes without your prior written authorization.
Qualifications & exceptions
The product encouragement is limited to in-person meetings 'as permitted by law'.
The marketing limit has an exception for what law permits.
Not stated here
The item is worded as disclosing PHI 'to' encourage purchases or give a gift; the notice does not explain further who receives the PHI or what 'nominal value' means.
Cross-references
contrast (model-proposed): Written authorization needed for uses not otherwise described — contrast: Reviewed: the Communications item allows in-person product encouragement and nominal gifts as permitted by law and bars other marketing use without authorization except as permitted by law, while the authorization section lists marketing communications (including third-party paid ones) as needing authorization. Both pass through the same 'as permitted by law' exception, so they read as complementary, not contradictory, but their exact boundary is not stated.
Sharing & Disclosure · Permission or license
Disclosure to prevent a serious and imminent threat
Cigna Healthcare says it may disclose your PHI without written authorization to prevent or lessen a serious and imminent threat to your health or safety, or to the health and safety of another individual or the general public.
Supporting quotations
We may disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or the health and safety of another individual or the general public
Qualifications & exceptions
The threat must be both serious and imminent.
Not stated here
The notice does not name who may receive the PHI or who decides that a threat is serious and imminent.
Sharing & Disclosure · Permission or license
Public health reports: disease, immunizations, abuse
Under 'Public health activities', Cigna Healthcare says it may disclose your PHI without written authorization to report health information to public health authorities authorized by law to receive it, for preventing or controlling disease, injury or disability or monitoring immunizations, and to report child abuse or neglect, or adult abuse including domestic violence, to a government authority authorized by law to receive such reports. Further public health items (product safety reports and alerts to exposed persons) continue in the next section of the notice.
Supporting quotations
Public health activities.
Report health information to public health authorities authorized by law to receive such information for the purpose of preventing or controlling disease, injury or disability, or monitoring immunizations
Report child abuse or neglect, or adult abuse, including domestic violence, to a government authority authorized by law to receive such reports
Qualifications & exceptions
Recipients must be authorities or agencies 'authorized by law' to receive the reports.
Not stated here
The notice does not say which health information is reported or how much of it.
Sharing & Disclosure · Permission or license
Public health: product safety reports and exposure alerts
Continuing the list of public health activities, Cigna Healthcare says it may disclose your PHI without written authorization to report information about an FDA-regulated product or activity to a person responsible for the quality, safety or effectiveness of that product or activity, and to alert a person who may have been exposed to a communicable disease, if it is authorized by law to give this notice.
Supporting quotations
Report information about a product or activity that is regulated by the U.S. Food and Drug Administration (FDA) to a person responsible for the quality, safety or effectiveness of the product or activity
Alert a person who may have been exposed to a communicable disease, if we are authorized by law to give this Notice
Qualifications & exceptions
The exposure alert applies only 'if we are authorized by law to give this Notice'.
Not stated here
The condition 'authorized by law to give this Notice' is worded awkwardly and the notice does not explain it further.
Sharing & Disclosure · Permission or license
Disclosure for health oversight activities
Cigna Healthcare says it may disclose your PHI without written authorization for health oversight: to a government agency legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs such as Medicare or Medicaid, and to other regulatory programs that need health information to determine compliance.
Supporting quotations
Health oversight activities.
A government agency that is legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs, such as Medicare or Medicaid.
Other regulatory programs that need health information to determine compliance.
Not stated here
'Other regulatory programs' is not further defined.
Sharing & Disclosure · Permission or license
Disclosure for research only as the law allows
Cigna Healthcare says it may disclose your PHI for research purposes, but only according to and as allowed by law.
Supporting quotations
We may disclose your PHI for research purposes, but only according to and as allowed by law.
Qualifications & exceptions
Only according to and as allowed by law.
Not stated here
The notice does not say what the law requires for research disclosures or whether authorization or other approval is needed.
Sharing & Disclosure · Permission or license
Disclosures to comply with law, courts, police and government
Cigna Healthcare says it may use and disclose your PHI to comply with the law. It may disclose PHI in a judicial or administrative proceeding or in response to a valid legal order. It may disclose PHI to the police or other law enforcement officials as required by law or in compliance with a court order or other process authorized by law. It may disclose PHI to government departments such as the U.S. military or the U.S. Department of State as required by law.
Supporting quotations
We may use and disclose your PHI to comply with the law.
We may disclose your PHI in a judicial or administrative proceeding or in response to a valid legal order.
We may disclose your PHI to the police or other law enforcement officials, as required by law or in compliance with a court order or other process authorized by law.
We may disclose your PHI to various departments of the government such as the U.S. military or the U.S. Department of State as required by law.
Qualifications & exceptions
Law enforcement disclosure is tied to a legal requirement, a court order or other legally authorized process.
Government-department disclosure is 'as required by law'.
Not stated here
The notice names U.S. agencies and does not say how disclosures to non-U.S. authorities are treated for members outside the United States.
Sharing & Disclosure · Permission or license
Disclosures for workers' compensation, organ procurement and coroners
Cigna Healthcare says it may disclose your PHI when necessary to comply with workers' compensation laws and similar programs, to organizations that facilitate organ, eye or tissue procurement, banking or transplantation, and to a coroner or medical examiner as authorized by law.
Supporting quotations
We may disclose your PHI when necessary to comply with workers’ compensation laws and similar programs.
We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
We may disclose your PHI to a coroner or medical examiner as authorized by law.
Qualifications & exceptions
Workers' compensation disclosure applies when necessary to comply with those laws; coroner disclosure is as authorized by law.
Sharing & Disclosure · Restriction or exception
PHI disclosed under these purposes may lose HIPAA protection
Cigna Healthcare warns that if it discloses your PHI for any of the purposes listed above, the recipient may redisclose the PHI and it may no longer be protected by HIPAA. In other words, the notice's protections do not necessarily follow the information once it leaves Cigna Healthcare.
Supporting quotations
If we disclose your PHI for any of the purposes above, the PHI may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.
Uses of PHI without your authorization
Qualifications & exceptions
'May': redisclosure and loss of HIPAA protection are possibilities, not certainties.
Not stated here
The notice does not say which recipients are or are not covered by HIPAA or what other law may protect redisclosed PHI.
Sharing & Disclosure · Restriction or exception
Specially protected PHI categories need your written authorization
Under the heading 'Highly Confidential', Cigna Healthcare says federal and state law may require enhanced privacy protection for certain kinds of PHI: psychotherapy notes; substance use disorder prevention, treatment and referral; HIV/AIDS testing, diagnosis or treatment; venereal and/or communicable diseases; and genetic testing. It says it can only disclose this specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Supporting quotations
Uses and disclosures of certain PHI deemed “Highly Confidential.”
For certain kinds of PHI, federal and state law may require enhanced privacy protection. These would include PHI that is:
Maintained in psychotherapy notes;
About substance use disorder prevention, treatment and referral;
About HIV/AIDS testing, diagnosis or treatment;
About venereal and/or communicable disease(s);
About genetic testing.
We can only disclose this type of specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Qualifications & exceptions
The category list is introduced with 'would include', so it is not stated to be exhaustive.
The authorization requirement has an exception where disclosure is specifically permitted or required by law.
Not stated here
The notice does not say how this rule works alongside the general treatment, payment and operations disclosures listed earlier for these categories.
Cross-references
narrows (model-proposed): Some PHI disclosures need no written authorization — narrows: The 'Highly Confidential' PHI categories are disclosed only with prior written authorization unless specifically permitted or required by law, which narrows the broad permission to disclose without authorization.