What the notice covers: records containing your PHI
The notice says it describes how medical information about you may be used and disclosed and how you can get access to it. Cigna Healthcare says it creates records about you and the treatment and services it provides, and calls the information it collects Protected Health Information (PHI). The notice says it applies to all electronic or paper records that Cigna Healthcare creates, obtains or maintains that contain your PHI, and that Cigna Healthcare is bound by the notice's terms when it uses or gives out your PHI. That commitment is qualified by a later section that lets Cigna Healthcare change the notice at any time.
Supporting quotations
This notice describes how medical information about you may be used and disclosed, and how you can get access to this information.
Cigna HealthcareSM creates records about you and the treatment and services we provide to you. The information we collect is called Protected Health Information (PHI).
When we use or give out (disclose) your PHI, we are bound by the terms of this Notice. This Notice applies to all electronic or paper records we create, obtain, and/or maintain that contain your PHI.
We may change the terms of this Notice at any time
Qualifications & exceptions
Being bound by the notice is subject to Cigna Healthcare's later stated right to change the notice's terms at any time, including making new terms effective for PHI it already holds.
Not stated here
The opening section does not say which plans or members the notice covers; the Global Health Benefits plan is named only in the section on changes to the notice.
'We' is Cigna Healthcare, described near the end of the document as The Cigna Group and/or its subsidiaries and affiliates; this section does not say which entity holds a given member's records.
Legal Rights & Agreement Rules · Company commitment
Legal duty to protect PHI, give notice and notify of breach
Cigna Healthcare says it is required by federal and state law to protect the privacy of your PHI, to give you this notice about how it safeguards and uses PHI, and to notify you following a breach of your unsecured PHI. This describes a legal duty the notice states; it does not say how or how quickly a breach notice would be given.
Supporting quotations
We are required by federal and state law to protect the privacy of your PHI and to provide you with this Notice about how we safeguard and use it and to notify you following a breach of your unsecured PHI.
Qualifications & exceptions
The breach-notification duty is stated for 'unsecured' PHI.
Not stated here
The notice does not say how, how quickly or by what channel a breach notice would be given, or which laws apply to a particular member.
Security & Safeguards · Company practice
PHI access limited to authorized staff with safeguards
Cigna Healthcare says it restricts access to your PHI to authorized workforce members who need it for your treatment, for payment purposes and/or for health care operations. It also says only authorized and trained workforce members can reach paper and electronic records and the non-public areas where they are stored, and that it maintains technical, physical and administrative safeguards.
Supporting quotations
We restrict access to your PHI to authorized workforce members who need that information for your treatment, for payment purposes and/or for health care operations. We maintain technical, physical and administrative safeguards to ensure the privacy of your PHI.
only authorized and trained workforce members are given access to our paper and electronic records and to non-public areas where this information is stored
Qualifications & exceptions
Access is tied to a need related to treatment, payment and/or health care operations.
Not stated here
The safeguards are described only by type (technical, physical, administrative); no specific controls, audits or certifications are named.
Security & Safeguards · Company practice
Workforce privacy training and Privacy Office monitoring
Cigna Healthcare says workforce members are trained on topics including privacy and data protection policies and procedures (how paper and electronic records are labeled, stored, filed and accessed) and on the technical, physical and administrative safeguards that protect PHI. It says its corporate Privacy Office monitors how the organization follows those policies and procedures and educates the organization on the topic.
Supporting quotations
Workforce members are trained on topics including:
Privacy and data protection policies and procedures including how paper and electronic records are labeled, stored, filed and accessed.
Technical, physical and administrative safeguards in place to maintain the privacy and security of your PHI
Our corporate Privacy Office monitors how we follow the policies and procedures, and educates our organization on this important topic.
Qualifications & exceptions
The training list is introduced with 'including', so the topics given are examples rather than a complete list.
Not stated here
No training frequency, testing or enforcement consequence is stated.
Sharing & Disclosure · Permission or license
Some PHI disclosures need no written authorization
Under the heading for uses of PHI without your authorization, Cigna Healthcare says it may commonly disclose your PHI without your written authorization for treatment, payment and health care operations, and may also do so for a second list of other purposes 'as permitted or required by law'. This is a permission, not a promise to disclose in every case. The permission is limited for specially protected PHI: the notice says that for the categories it calls 'Highly Confidential' (psychotherapy notes, substance use disorder, HIV/AIDS, venereal or communicable disease, genetic testing information), it can only disclose with your prior written authorization except when specifically permitted or required by law.
Supporting quotations
Uses of PHI without your authorization
We may commonly disclose your PHI without your written authorization for the following purposes:
We may also disclose your PHI without your written authorization for the following other purposes, as permitted or required by law:
Protected Health Information (PHI)
Highly Confidential
We can only disclose this type of specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Qualifications & exceptions
The first list is introduced with 'commonly'; the second list is limited to purposes 'as permitted or required by law'.
'May' describes what Cigna Healthcare is allowed to do, not what it will always do.
Specially protected PHI is subject to the stricter authorization rule in the later 'Highly Confidential' section, with the same 'permitted or required by law' exception.
Not stated here
The notice does not say how often any listed disclosure actually happens or to whom in a given case.
Sharing & Disclosure · Permission or license
Disclosure of PHI for treatment
Cigna Healthcare says it may disclose your PHI without written authorization for treatment: to share with hospital staff, nurses, doctors, pharmacists, optometrists, health educators and other health care professionals and personnel at health care facilities so they can determine your plan of care; to help you obtain services and treatment you may need (for example ordering lab tests and using the results); and to coordinate your health care and related services with a different health care facility or professional.
Supporting quotations
Treatment:
To share with hospital staff, nurses, doctors, pharmacists, optometrists, health educators and other health care professionals and personnel at health care facilities so they can determine your plan of care.
To help you obtain services and treatment you may need. For example, to order lab tests and using the results.
To coordinate your health care and related services with a different health care facility or professional.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Not stated here
The notice does not say which health care professionals or facilities in a given country receive the information.
Sharing & Disclosure · Permission or license
Disclosure of PHI for payment and benefits administration
Cigna Healthcare says it may disclose your PHI without written authorization for payment: to obtain payment of premiums for your coverage; to make coverage determinations (for example speaking with a health care professional about payment for services provided to you); to coordinate benefits with other coverage you may have (for example speaking with another health plan or insurer to determine eligibility or coverage); to obtain payment from a third party that may be responsible, such as a family member; and to otherwise determine and fulfill its responsibility to provide your health benefits, for example administering claims.
Supporting quotations
Payment:
To obtain payment of premiums for your coverage.
To make coverage determinations. For example, to speak to a health care professional about payment for services provided to you.
To coordinate benefits with other coverage you may have. For example, to speak to another health plan or insurer to determine your eligibility or coverage.
To obtain payment from a third party that may be responsible for payment, such as a family member.
To otherwise determine and fulfill our responsibility to provide your health benefits. For example, to administer claims.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Not stated here
The notice does not say how much PHI is shared with a third party or family member when seeking payment.
Sharing & Disclosure · Permission or license
Disclosure of PHI for health care operations
Cigna Healthcare says it may disclose your PHI without written authorization for health care operations: to provide customer service; to support and/or improve the programs or services it offers you; to assist you in managing your health (for example giving you information about treatment alternatives); and to support another health plan, insurer or health care professional who has a relationship with you for activities such as case management, care coordination and quality improvement. Its example is sharing your claims information with your doctor if you have a medical need that requires attention.
Supporting quotations
Health care operations:
To provide customer service.
To support and/or improve the programs or services we offer you.
To assist you in managing your health. For example, to provide you with information about treatment alternatives to which you may be entitled.
To support another health plan, insurer, or health care professional who has a relationship with you for activities such as case management, care coordination and quality improvement activities.
Qualifications & exceptions
Introduced as disclosures Cigna Healthcare 'may commonly' make without written authorization.
Disclosure to another plan, insurer or professional is tied to one who 'has a relationship with you'.
Not stated here
'Support and/or improve the programs or services' is broad; the notice does not say whether de-identified or identified data is used.
Sharing & Disclosure · Permission or license
Disclosure to family, caregivers and a child's other parent
Cigna Healthcare says it may disclose your PHI without written authorization to others involved in your health care. If you are present or otherwise available to direct it, it may disclose to others such as a family member, close friend or caregiver. If you are in an emergency, not present or incapacitated, it will use professional judgment to decide whether disclosure is in your best interests, and would then disclose only information directly relevant to the person's involvement with your treatment or payment for it; it may also disclose PHI to notify, or help notify, such persons of your location or general medical condition. Separately, it states that it may disclose your child's PHI to your child's other parent.
Supporting quotations
Disclosures to others involved in your health care.
If you are present or otherwise available to direct us to do so, we may disclose your PHI to others. For example, a family member, a close friend, or your caregiver.
If you are in an emergency situation, are not present, or are incapacitated, we will use our professional judgment to decide whether disclosing your PHI to others is in your best interests.
we would disclose only information that is directly relevant to the person’s involvement with your treatment or for payment related to your treatment
We may also disclose your PHI in order to notify (or assist in notifying) such persons of your location or your general medical condition.
We may disclose your child’s PHI to your child’s other parent.
Qualifications & exceptions
The 'directly relevant' limit is stated for situations where you are unavailable.
This list is introduced as disclosures 'as permitted or required by law'.
Not stated here
The disclosure of a child's PHI to the child's other parent is stated without conditions in this item (for example the child's age or any court order); the notice does not say whether other limits apply.
Sharing & Disclosure · Permission or license
Disclosure to your employer as plan sponsor
Cigna Healthcare says it may disclose your PHI to your employer, or to a company acting on your employer's behalf, so that entity can monitor, audit and otherwise administer the employee health plan you participate in. The notice says the employer is not permitted to use that PHI for any purpose other than administration of your benefits. It adds that the Health Plan may also give Summary Health Information to the plan sponsor as allowed by law, so the sponsor can solicit premium bids from other health plans or modify, amend or terminate the plan. For whether your employer receives PHI and who may receive it, the notice points you to your employer's health plan documents.
Supporting quotations
Disclosures to your employer as sponsor of your health plan.
We may disclose your PHI to your employer or to a company acting on your employer’s behalf, so that entity can monitor, audit and otherwise administer the employee health plan in which you participate.
Your employer is not permitted to use the PHI we disclose for any purpose other than administration of your benefits.
The Health Plan may also provide Summary Health Information to the plan sponsor as allowed by law so that the plan sponsor may solicit premium bids from other health plans or modify, amend or terminate the plan.
See your employer’s health plan documents for information on whether your employer receives PHI and, if so, the identity of the employees who are authorized to receive your PHI.
Qualifications & exceptions
Applies to members of an employer-sponsored health plan.
Summary Health Information is described as provided 'as allowed by law'.
The employer's use is limited to administration of your benefits.
Not stated here
Whether your own employer actually receives PHI, and which of its employees may see it, is left to your employer's health plan documents, which are not supplied here.
'The Health Plan' and 'Summary Health Information' are not defined in this notice.
Cross-references
contrast (model-proposed): Written authorization needed for uses not otherwise described — contrast: Disclosure to your employer as plan sponsor is allowed without authorization for administering the employee health plan, while use of PHI with a prospective employer is listed as needing authorization; the two concern different employer roles.
Sharing & Disclosure · Permission or license
Disclosure to service vendors and accreditation bodies
Cigna Healthcare says it may disclose your PHI to companies that perform services it has requested (for example vendors that help provide information and guidance to users with chronic conditions like diabetes and asthma) and to accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement. It states that before sharing PHI it obtains the vendor's or accreditation organization's written agreement to protect the privacy of the PHI.
Supporting quotations
Disclosures to vendors and accreditation organizations.
Companies that perform certain services we’ve requested. For example, we may engage vendors to help us to provide information and guidance to users with chronic conditions like diabetes and asthma.
Accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement purposes.
before we share your PHI, we obtain the vendor’s or accreditation organization’s written agreement to protect the privacy of your PHI
Qualifications & exceptions
Sharing is conditioned on a written agreement by the recipient to protect the privacy of the PHI.
Not stated here
The notice does not name vendors or say which services vendors perform beyond the chronic-condition example; the example is introduced with 'for example' and is not an exhaustive list.
Under a 'Communications' item, Cigna Healthcare lists, as purposes for which it may disclose your PHI without written authorization, encouraging you to purchase or use a product or service that is not part of its health care services and benefits when it meets with you in person, as permitted by law, and providing you a promotional gift of nominal value. It then says that, except as permitted by law, it will not use your PHI for marketing purposes without your prior written authorization. The later authorization section lists marketing communications, including those paid for by a third party, as needing your authorization.
Supporting quotations
Communications.
Encourage you to purchase or use a product or service that is not part of the health care services and benefits we provide when we meet with you in person, as permitted by law.
Provide you with a promotional gift of nominal value.
Except as permitted by law, we will not use your PHI for marketing purposes without your prior written authorization.
Qualifications & exceptions
The product encouragement is limited to in-person meetings 'as permitted by law'.
The marketing limit has an exception for what law permits.
Not stated here
The item is worded as disclosing PHI 'to' encourage purchases or give a gift; the notice does not explain further who receives the PHI or what 'nominal value' means.
Cross-references
contrast (model-proposed): Written authorization needed for uses not otherwise described — contrast: Reviewed: the Communications item allows in-person product encouragement and nominal gifts as permitted by law and bars other marketing use without authorization except as permitted by law, while the authorization section lists marketing communications (including third-party paid ones) as needing authorization. Both pass through the same 'as permitted by law' exception, so they read as complementary, not contradictory, but their exact boundary is not stated.
Sharing & Disclosure · Permission or license
Disclosure to prevent a serious and imminent threat
Cigna Healthcare says it may disclose your PHI without written authorization to prevent or lessen a serious and imminent threat to your health or safety, or to the health and safety of another individual or the general public.
Supporting quotations
We may disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or the health and safety of another individual or the general public
Qualifications & exceptions
The threat must be both serious and imminent.
Not stated here
The notice does not name who may receive the PHI or who decides that a threat is serious and imminent.
Sharing & Disclosure · Permission or license
Public health reports: disease, immunizations, abuse
Under 'Public health activities', Cigna Healthcare says it may disclose your PHI without written authorization to report health information to public health authorities authorized by law to receive it, for preventing or controlling disease, injury or disability or monitoring immunizations, and to report child abuse or neglect, or adult abuse including domestic violence, to a government authority authorized by law to receive such reports. Further public health items (product safety reports and alerts to exposed persons) continue in the next section of the notice.
Supporting quotations
Public health activities.
Report health information to public health authorities authorized by law to receive such information for the purpose of preventing or controlling disease, injury or disability, or monitoring immunizations
Report child abuse or neglect, or adult abuse, including domestic violence, to a government authority authorized by law to receive such reports
Qualifications & exceptions
Recipients must be authorities or agencies 'authorized by law' to receive the reports.
Not stated here
The notice does not say which health information is reported or how much of it.
Sharing & Disclosure · Permission or license
Public health: product safety reports and exposure alerts
Continuing the list of public health activities, Cigna Healthcare says it may disclose your PHI without written authorization to report information about an FDA-regulated product or activity to a person responsible for the quality, safety or effectiveness of that product or activity, and to alert a person who may have been exposed to a communicable disease, if it is authorized by law to give this notice.
Supporting quotations
Report information about a product or activity that is regulated by the U.S. Food and Drug Administration (FDA) to a person responsible for the quality, safety or effectiveness of the product or activity
Alert a person who may have been exposed to a communicable disease, if we are authorized by law to give this Notice
Qualifications & exceptions
The exposure alert applies only 'if we are authorized by law to give this Notice'.
Not stated here
The condition 'authorized by law to give this Notice' is worded awkwardly and the notice does not explain it further.
Sharing & Disclosure · Permission or license
Disclosure for health oversight activities
Cigna Healthcare says it may disclose your PHI without written authorization for health oversight: to a government agency legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs such as Medicare or Medicaid, and to other regulatory programs that need health information to determine compliance.
Supporting quotations
Health oversight activities.
A government agency that is legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs, such as Medicare or Medicaid.
Other regulatory programs that need health information to determine compliance.
Not stated here
'Other regulatory programs' is not further defined.
Sharing & Disclosure · Permission or license
Disclosure for research only as the law allows
Cigna Healthcare says it may disclose your PHI for research purposes, but only according to and as allowed by law.
Supporting quotations
We may disclose your PHI for research purposes, but only according to and as allowed by law.
Qualifications & exceptions
Only according to and as allowed by law.
Not stated here
The notice does not say what the law requires for research disclosures or whether authorization or other approval is needed.
Sharing & Disclosure · Permission or license
Disclosures to comply with law, courts, police and government
Cigna Healthcare says it may use and disclose your PHI to comply with the law. It may disclose PHI in a judicial or administrative proceeding or in response to a valid legal order. It may disclose PHI to the police or other law enforcement officials as required by law or in compliance with a court order or other process authorized by law. It may disclose PHI to government departments such as the U.S. military or the U.S. Department of State as required by law.
Supporting quotations
We may use and disclose your PHI to comply with the law.
We may disclose your PHI in a judicial or administrative proceeding or in response to a valid legal order.
We may disclose your PHI to the police or other law enforcement officials, as required by law or in compliance with a court order or other process authorized by law.
We may disclose your PHI to various departments of the government such as the U.S. military or the U.S. Department of State as required by law.
Qualifications & exceptions
Law enforcement disclosure is tied to a legal requirement, a court order or other legally authorized process.
Government-department disclosure is 'as required by law'.
Not stated here
The notice names U.S. agencies and does not say how disclosures to non-U.S. authorities are treated for members outside the United States.
Sharing & Disclosure · Permission or license
Disclosures for workers' compensation, organ procurement and coroners
Cigna Healthcare says it may disclose your PHI when necessary to comply with workers' compensation laws and similar programs, to organizations that facilitate organ, eye or tissue procurement, banking or transplantation, and to a coroner or medical examiner as authorized by law.
Supporting quotations
We may disclose your PHI when necessary to comply with workers’ compensation laws and similar programs.
We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
We may disclose your PHI to a coroner or medical examiner as authorized by law.
Qualifications & exceptions
Workers' compensation disclosure applies when necessary to comply with those laws; coroner disclosure is as authorized by law.
Sharing & Disclosure · Restriction or exception
PHI disclosed under these purposes may lose HIPAA protection
Cigna Healthcare warns that if it discloses your PHI for any of the purposes listed above, the recipient may redisclose the PHI and it may no longer be protected by HIPAA. In other words, the notice's protections do not necessarily follow the information once it leaves Cigna Healthcare.
Supporting quotations
If we disclose your PHI for any of the purposes above, the PHI may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.
Uses of PHI without your authorization
Qualifications & exceptions
'May': redisclosure and loss of HIPAA protection are possibilities, not certainties.
Not stated here
The notice does not say which recipients are or are not covered by HIPAA or what other law may protect redisclosed PHI.
Legal Rights & Agreement Rules · User right or choice
Written authorization needed for uses not otherwise described
Cigna Healthcare says that, other than for the purposes described above or as permitted by applicable law, it must obtain your written authorization to use or disclose your PHI. It gives examples of when it would need authorization: to use your PHI to a prospective employer; to use your PHI for marketing communications and when it receives direct or indirect payment from a third party for making such communications; and for any sale involving your PHI, as required by law. The notice repeats that any other uses and disclosures not described in it will only be made with your prior written authorization. This is separate from the disclosure to your employer as plan sponsor, which the notice permits without authorization for administering your plan.
Supporting quotations
Uses of PHI that require your authorization
Other than for the purposes described above or as permitted by applicable law, we must obtain your written authorization to use or disclose your PHI.
For example, we would need your authorization:
To use your PHI to a prospective employer.
Use your PHI for marketing communications and when we receive direct or indirect payment from a third party for making such communications.
For any sale involving your PHI, as required by law.
Any other uses and disclosures not described in this Notice will only be made with your prior written authorization.
Disclosures to your employer as sponsor of your health plan.
Qualifications & exceptions
The rule excepts the described purposes and what applicable law permits.
The examples are introduced with 'for example' and are not a complete list.
The sale example is stated 'as required by law'.
Not stated here
Item b64 is worded as 'To use your PHI to a prospective employer' and the marketing item joins two phrases with 'and'; the notice does not clarify the exact scope of either.
The notice does not describe how an authorization is requested, its form or its expiry.
Sharing & Disclosure · Restriction or exception
Specially protected PHI categories need your written authorization
Under the heading 'Highly Confidential', Cigna Healthcare says federal and state law may require enhanced privacy protection for certain kinds of PHI: psychotherapy notes; substance use disorder prevention, treatment and referral; HIV/AIDS testing, diagnosis or treatment; venereal and/or communicable diseases; and genetic testing. It says it can only disclose this specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Supporting quotations
Uses and disclosures of certain PHI deemed “Highly Confidential.”
For certain kinds of PHI, federal and state law may require enhanced privacy protection. These would include PHI that is:
Maintained in psychotherapy notes;
About substance use disorder prevention, treatment and referral;
About HIV/AIDS testing, diagnosis or treatment;
About venereal and/or communicable disease(s);
About genetic testing.
We can only disclose this type of specially protected PHI with your prior written authorization except when specifically permitted or required by law.
Qualifications & exceptions
The category list is introduced with 'would include', so it is not stated to be exhaustive.
The authorization requirement has an exception where disclosure is specifically permitted or required by law.
Not stated here
The notice does not say how this rule works alongside the general treatment, payment and operations disclosures listed earlier for these categories.
Cross-references
narrows (model-proposed): Some PHI disclosures need no written authorization — narrows: The 'Highly Confidential' PHI categories are disclosed only with prior written authorization unless specifically permitted or required by law, which narrows the broad permission to disclose without authorization.
Legal Rights & Agreement Rules · Restriction or exception
Limits on substance use disorder records and genetic information
Cigna Healthcare says it will not share substance use disorder treatment records received from federally assisted substance use disorder treatment programs for civil, criminal, administrative or legislative proceedings against you unless you consent in writing or it receives a court order. It also says it is prohibited from using or disclosing PHI that is genetic information for underwriting purposes.
Supporting quotations
We will not share your substance use disorder treatment records received from federally assisted substance use disorder treatment programs for civil, criminal, administrative, or legislative proceedings against you unless you provide your consent in writing, or we receive a court order.
We are prohibited from using or disclosing PHI that is genetic information for underwriting purposes.
Qualifications & exceptions
The substance use disorder limit covers records received from federally assisted programs and proceedings against you; it lifts with your written consent or a court order.
Not stated here
The notice does not say how a court order is evaluated before records are released.
Cross-references
narrows (model-proposed): Some PHI disclosures need no written authorization — narrows: The limits on sharing substance use disorder treatment records in proceedings against you and on using genetic information for underwriting limit what the general permissions allow.
Legal Rights & Agreement Rules · User right or choice
You can cancel a written authorization for future use
Cigna Healthcare says you may cancel (revoke) a written authorization you gave before. The cancellation must be submitted to Cigna Healthcare in writing, and it applies to future uses and disclosures of your PHI. It does not affect disclosures made previously while your authorization was in effect.
Supporting quotations
Cancellation.
You may cancel – or revoke – a written authorization you gave us before. The cancellation, submitted to us in writing, will apply to future uses and disclosures of your
PHI. It will not impact disclosures made previously, while your authorization was in effect.
Qualifications & exceptions
Cancellation must be in writing and is prospective only.
Not stated here
The notice does not say where to send the written cancellation in this section or how long it takes to take effect.
Cross-references
qualifies (model-proposed): Written authorization needed for uses not otherwise described — qualifies: A written authorization can be cancelled for future uses and disclosures, which limits how long an authorization-based use or disclosure can continue.
Legal Rights & Agreement Rules · User right or choice
Individual rights cover PHI Cigna Healthcare creates, obtains or maintains
The notice lists individual rights you have regarding the PHI that Cigna Healthcare creates, obtains and/or maintains about you. The rights are explained in the cards that follow: restrictions, confidential communications, inspection and copies, amendment, accounting of disclosures, a personal representative and a paper copy of the notice.
Supporting quotations
Your individual rights
You have the following rights regarding the PHI that Cigna Healthcare creates, obtains, and/or maintains about you.
Not stated here
The notice does not say how to exercise each right beyond the contact section, or whether rights differ by country or plan.
Legal Rights & Agreement Rules · User right or choice
Right to request restrictions on use and disclosure
You may ask Cigna Healthcare to restrict the way it uses and discloses your PHI for treatment, payment and health care operations. Cigna Healthcare is not required to agree, but says it will consider requests carefully, and if it does agree it will abide by the restriction.
Supporting quotations
Right to request restrictions.
You may ask us to restrict the way we use and disclose your PHI for treatment, payment and health care operations, as explained in this Notice.
We are not required to agree to the restrictions, but we will consider them carefully. If we do agree to the restrictions, we will abide by them.
Uses of PHI without your authorization
Qualifications & exceptions
Cigna Healthcare may decline; it is bound only if it agrees.
The right is worded for treatment, payment and health care operations.
Not stated here
The right is not worded for the other disclosures the notice lists without authorization (for example public health or law enforcement); the notice does not say whether restrictions can be requested for those.
Legal Rights & Agreement Rules · User right or choice
Right to receive confidential communications
You may ask to receive Cigna Healthcare communications containing PHI by alternative means or at alternative locations; the example is being contacted by phone at home rather than at work. Cigna Healthcare says it will accommodate reasonable requests whenever feasible.
Supporting quotations
Right to receive confidential communications. You may ask to receive Cigna Healthcare communications containing PHI by alternative means or at alternative locations.
We will accommodate reasonable requests whenever feasible.
Qualifications & exceptions
Requests must be reasonable and are accommodated 'whenever feasible'.
Not stated here
The notice does not say what makes a request unreasonable or infeasible.
Legal Rights & Agreement Rules · User right or choice
Right to inspect and copy your PHI
You may ask in advance to review or receive a copy of your PHI that is in certain paper or electronic records Cigna Healthcare maintains, such as prescription and billing records. In limited circumstances Cigna Healthcare may deny access to a portion of the records. You may also request that your PHI be disclosed or sent to a Health Information Exchange (HIE).
Supporting quotations
Right to inspect and copy your PHI. You may ask in advance to review or receive a copy of your PHI that is included in certain paper or electronic records we maintain such as prescription and billing records.
Under limited circumstances, we may deny you access to a portion of your records.
You may request that we disclose or send a copy of your PHI to a Health Information Exchange (HIE).
Qualifications & exceptions
Applies to PHI in 'certain' records; you ask in advance.
Access to a portion may be denied under limited circumstances.
Not stated here
The notice does not list the circumstances for denial, say which records are excluded, or state a response time or copy fee.
Legal Rights & Agreement Rules · User right or choice
Right to ask to amend your records
You may ask Cigna Healthcare to correct PHI in its electronic or paper records if you believe it is inaccurate. If Cigna Healthcare determines the PHI is inaccurate, it will correct it if permitted by law. If a health care facility or professional created the information you want changed, you should ask them to amend it.
Supporting quotations
Right to amend your records. You have the right to ask us to correct your PHI contained in our electronic or paper records if you believe it is inaccurate.
If we determine that the PHI is inaccurate, we will correct it if permitted by law.
If a health care facility or professional created the information that you want to change, you should ask them to amend the information.
Qualifications & exceptions
Correction happens only if Cigna Healthcare determines the PHI is inaccurate and the law permits.
Not stated here
The notice does not say what happens if Cigna Healthcare disagrees, or how long a decision takes.
Legal Rights & Agreement Rules · User right or choice
Right to an accounting of disclosures, with exclusions and a fee
On your request Cigna Healthcare will provide a list of the disclosures it has made of your PHI for a specified time period. The list excludes: disclosures you authorized; disclosures made earlier than six years before the request (for disclosures from an electronic health record this period may be limited to three years); disclosures for treatment, payment and health care operations except when required by law; and certain other disclosures excepted by law. If you request an accounting more than once in any 12-month period, Cigna Healthcare will charge a reasonable fee for each report after the first.
Supporting quotations
Right to receive an accounting of disclosures. Upon your request, we will provide a list of the disclosures we have made of your PHI for a specified time period. However, the list will exclude:
Disclosures you have authorized.
Disclosures made earlier than six years before the date of your request (in the case of disclosures made from an electronic health record, this period may be limited to three years before the date of your request).
Disclosures made for treatment, payment, and health care operations purposes except when required by law.
Certain other disclosures that are excepted by law.
If you request an accounting more than once during any 12-month period, we will charge you a reasonable fee for each accounting report after the first one.
Qualifications & exceptions
The list excludes four stated categories.
The fee applies to each accounting after the first within a 12-month period; the fee sentence appears under the last excluded item but is stated as applying to requests generally.
Not stated here
'Certain other disclosures excepted by law' are not specified.
The notice does not give the amount of the 'reasonable fee'.
Legal Rights & Agreement Rules · User right or choice
Right to name a personal representative
You may name another person to act as your Personal Representative. The representative will be allowed access to your PHI, to communicate with the health care professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant, he or she may also have authority to make health care decisions for you.
Supporting quotations
Right to name a personal representative. You may name another person to act as your Personal Representative.
Your representative will be allowed access to your PHI, to communicate with the health care professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf.
Depending on the authority you grant your representative, he or she may also have authority to make health care decisions for you.
Qualifications & exceptions
Health care decision authority depends on the authority you grant.
Not stated here
The notice does not describe how to name a representative or what documentation is required.
Legal Rights & Agreement Rules · User right or choice
Right to a paper copy of this notice
Upon your request Cigna Healthcare will provide a paper copy of the notice, even if you have already received one, as described in the 'Notice Availability and Duration' section later in the notice.
Supporting quotations
Right to receive a paper copy of this Notice. Upon your request, we will provide a paper copy of this Notice, even if you have already received one, as described in the Notice Availability and Duration
section later in this Notice.
Not stated here
The referenced section describes where to obtain a copy; it is carded in packet 4.
Account & Service Control · Procedure
How to contact Cigna Healthcare's Privacy Office
If you have questions about your privacy rights, believe Cigna Healthcare may have violated them, or disagree with a decision about access to your PHI, you may contact the Cigna Healthcare Privacy Office in writing or by telephone (PO Box 188014, Chattanooga, TN 37422; 800.234.4077; privacyoffice@cigna.com). For certain types of requests you must complete and mail an applicable form, available by calling the International Service Centers or on the website www.Cignaenvoy.com.
Supporting quotations
Contact us.
If you have questions about your privacy rights, believe that we may have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact us in writing or by telephone.
For certain types of requests, you must complete and mail to us an applicable form, which is available by calling the International Service Centers or going to our website (www.Cignaenvoy.com).
Qualifications & exceptions
Some requests require a completed form that you mail.
Not stated here
The notice does not say which requests need a form, or give response times.
Legal Rights & Agreement Rules · User right or choice
Right to complain to the U.S. HHS Office for Civil Rights without retaliation
If you believe Cigna Healthcare may have violated your privacy rights you may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services (HHS), sent by email, fax or mail to the HHS Office for Civil Rights (OCR). Cigna Healthcare will give you contact information for the OCR Regional Manager for your area if you ask its Privacy Office. It says it will not take any action against you for exercising your right to file a complaint, with it or with the Secretary.
Supporting quotations
Contact a government agency.
If you believe we may have violated your privacy rights, you may also file a written complaint with the Secretary (“the Secretary”) of the U.S. Department of Health and Human Services (HHS).
We will provide you with the contact information for the OCR Regional Manager in your area if you request it from our Privacy Office.
We will not take any action against you if you exercise your right to file a complaint, either with us or with the Secretary.
Qualifications & exceptions
The complaint must be written.
The no-retaliation statement covers complaints to Cigna Healthcare or to the Secretary.
Not stated here
The notice names a U.S. agency and does not say how members outside the United States can complain to a local authority; the OCR web address is printed with stray spaces in the extracted text.
Account & Service Control · Procedure
Where to get a copy of the notice
A copy of the notice is available by calling the International Service Centers or on the website: go to www.Cignaenvoy.com and click Notice of Privacy Practices.
Supporting quotations
Notice availability and duration
Notice availability.
A copy of this Notice is available by calling the International Service Centers or on our website (go to www.Cignaenvoy.com and click Notice of Privacy Practices).
Not stated here
No telephone number for the International Service Centers is given in this section.
Legal Rights & Agreement Rules · Permission or license
Cigna Healthcare may change the notice and apply it to existing PHI
Cigna Healthcare says it may change the terms of the notice at any time and may, at its discretion, make the new terms effective for all of your PHI it holds, including PHI created or received before the new notice. If it changes the notice it will update the notice on its website and, if you are enrolled in a Cigna Healthcare Global Health Benefits plan at that time, will send you the new notice, as required. You can also get a copy of the new notice on request by calling the International Service Centers or from the website.
Supporting quotations
Right to change terms of this Notice.
We may change the terms of this Notice at any time, and we may, at our discretion, make the new terms effective for all of your PHI in our possession, including any PHI we created or received before we issued the new Notice.
If we change this Notice, we will update the Notice on our website and, if you are enrolled in a Cigna Healthcare, Global Health Benefits plan at that time, we will send you the new Notice, as required.
In addition, you can obtain a copy of the new Notice upon request when you call the International Service Centers or from our website.
Qualifications & exceptions
Mailing the new notice is stated for people enrolled in a Cigna Healthcare Global Health Benefits plan at the time, 'as required'.
Retroactive application to existing PHI is at Cigna Healthcare's discretion.
Not stated here
No advance notice period is stated before a change takes effect.
The notice does not say what happens for people who are not enrolled in a Global Health Benefits plan at the time of a change beyond the website update and request-a-copy option.
Notice dates: effective April 14, 2003, updated October 15, 2025
The notice says it is effective as of April 14, 2003 and updated as of October 15, 2025.
Supporting quotations
Effective date
This Notice is effective as of April 14, 2003, and updated as of October 15, 2025.
Not stated here
The notice does not say what changed in the October 15, 2025 update.
Legal Rights & Agreement Rules · Context
Which Cigna companies 'Cigna Healthcare' refers to
The notice says Cigna Healthcare products and services are provided exclusively by or through operating subsidiaries of The Cigna Group, including Cigna Health and Life Insurance Company, Cigna Life Insurance Company of Canada, Cigna Global Insurance Company Limited, Evernorth Care Solutions, Inc., and Evernorth Behavioral Health, Inc. It says 'Cigna Healthcare' refers to The Cigna Group and/or its subsidiaries and affiliates, and that the name, logo and other marks are owned by Cigna Intellectual Property, Inc. and licensed for use. A footer line on the form says it is offered by Cigna Health and Life Insurance Company or its affiliates. So 'we' in the notice can mean any of these related companies.
Supporting quotations
including Cigna Health and Life Insurance Company, Cigna Life Insurance Company of Canada, Cigna Global Insurance Company Limited, Evernorth Care Solutions, Inc., and Evernorth Behavioral Health, Inc.
refers to The Cigna Group and/or its subsidiaries and affiliates
Offered by Cigna Health and Life Insurance Company or its affiliates.
Qualifications & exceptions
'Cigna Healthcare' is a collective name that can refer to The Cigna Group and/or subsidiaries and affiliates.
Not stated here
The notice does not say which listed company holds or processes a particular member's PHI.