PHI may be collected, used and shared for payment and healthcare operations
The notice says there are times the insurer may collect, use, and share protected health information (PHI) as allowed or required by law, including the HIPAA privacy rule. For payment, it does so to take care of the member’s account and benefits, or to pay claims for healthcare the member gets through the plan. It also does so for its healthcare operations. ’Healthcare operations’ is not defined in this notice; the examples that follow only partly show what it covers. Members have rights, set out under ’Your rights’, to ask that PHI not be used for treatment, payment, or healthcare operations and to ask for a restriction on PHI for services paid out of pocket, but the insurer may say no to the first request.
Supporting quotations
There are times we may collect, use, and share your Protected Health Information (PHI) as allowed or required by law, including the HIPAA privacy rule.
Payment: We collect, use, and share PHI to take care of your account and benefits, or to pay claims for healthcare you get through your plan.
Healthcare operations: We collect, use, and share PHI for our healthcare operations.
Qualifications & exceptions
The permission is 'as allowed or required by law, including the HIPAA privacy rule'.
'Healthcare operations' is stated without a definition or list.
The member's rights to ask for limits on these uses are in the 'Your rights' section; the insurer may refuse some requests.
Not stated here
What the insurer counts as 'healthcare operations' is not defined here.
Use & Processing · Company practice
Examples of routine uses of member information
Under ’Examples of ways we use your information’, the notice lists that the insurer keeps information on file about premium and deductible payments, may use PHI to review the quality of care and services the member gets, and may use PHI to help with services for conditions like asthma, diabetes, or traumatic injury. These are introduced as examples, not as the full list of uses.
Supporting quotations
Examples of ways we use your information:
We keep information on file about your premium and deductible payments.
We may use PHI to review the quality of care and services you get.
We may use PHI to help you with services for conditions like asthma, diabetes, or traumatic injury.
Qualifications & exceptions
Introduced as examples; the list is not stated to be complete.
Not stated here
How the services for conditions such as asthma or diabetes are delivered or chosen is not described.
Use & Processing · Company practice
PHI may be used with technology to support services
Another example says the insurer may use PHI with technology to support and enable services provided to the member. The sentence is general: it does not say what technology is used, who runs it, or whether it makes decisions about the member.
Supporting quotations
We may use PHI with technology to support and enable services provided to you.
Qualifications & exceptions
Stated only in general terms.
Not stated here
The type of technology, who operates it, and whether it is automated decision-making are not stated.
Use & Processing · Company practice
PHI may be used to create, use or share de-identified data
The insurer says it may use a member’s PHI to create, use, or share de-identified data as allowed by HIPAA. The notice does not say what the de-identified data is used for or who receives it.
Supporting quotations
We may use your PHI to create, use, or share de-identified data as allowed by HIPAA.
Qualifications & exceptions
Limited to what HIPAA allows.
Not stated here
Purposes and recipients of the de-identified data are not stated.
Use & Processing · Company practice
Insurer must give access to your PHI and may contact you about benefits, other plans and reminders
Under ’Sharing your PHI with you’, the insurer says it must give the member access to their own PHI. It may also contact the member about treatment options or other health-related benefits and services, and may tell the member or their dependents about other plans or programs they may be eligible for, including individual coverage, when they reach a certain age. It may send reminders about routine medical checkups and tests, and the member may get emails with limited PHI, such as welcome materials. The notice says it will ask the member’s permission before contacting them. The scope of that permission is not explained: it does not say which of these contacts it covers. A later section separately says the insurer may call or text using an automatic dialer.
Supporting quotations
We must give you access to your own PHI.
We may also contact you about treatment options or other health-related benefits and services.
When you or your dependents reach a certain age, we may tell you about other plans or programs for which you may be eligible, including individual coverage.
We may also send you reminders about routine medical checkups and tests.
You may get emails that have limited PHI, such as welcome materials.
We’ll ask your permission before we contact you.
Qualifications & exceptions
The permission sentence is general and not tied to a particular type of contact.
'A certain age' is not stated.
Not stated here
Which contacts require the member's permission, and what age triggers the plan notices, are not stated.
Use & Processing · Company commitment
Written permission is needed for purposes not in the notice and can be cancelled in writing, but not retroactively
The Authorization section says the insurer will get the member’s written permission before using or sharing PHI for any purpose not stated in the notice. The member may cancel that permission at any time, in writing, and the insurer then stops using PHI for that purpose. If the insurer has already used or shared PHI with the member’s permission, it cannot undo what it did before the member told it to stop. This qualifies the earlier statement that the member can cancel written permission at any time: the cancellation must be in writing and takes effect going forward only.
Supporting quotations
We’ll get your written permission before we use or share your PHI for any purpose not stated in this notice.
You may cancel your permission at any time, in writing. We will then stop using your PHI for that purpose.
But if we’ve already used or shared your PHI with your permission, we cannot undo any actions we took before you told us to stop.
Qualifications & exceptions
Cancellation must be in writing.
Cancellation does not reverse uses or sharing that already happened with the permission.
Not stated here
Where to send a cancellation, and how long the insurer takes to stop, are not stated here.
Genetic information cannot be used to decide coverage or its price
The notice says the insurer cannot use the member’s genetic information to decide whether it will give coverage or to decide the price of that coverage. The limit is stated for coverage decisions and pricing only; the notice does not say what other uses of genetic information are allowed or barred.
Supporting quotations
We cannot use your genetic information to decide whether we’ll give you coverage or decide the price of that coverage.
Qualifications & exceptions
Limited to deciding whether to give coverage and the price of coverage.
Not stated here
Other uses of genetic information are not addressed.
Use & Processing · User right or choice
Right to ask that PHI not be used for treatment, payment or operations; the insurer may refuse
The member can send a written request that the insurer not use their PHI for treatment, payment, or healthcare operations activities. The insurer may say no, but will explain why in writing. The notice gives no timeframe for the written explanation here.
Supporting quotations
Send us a written request not to use your PHI for treatment, payment, or healthcare operations activities. We may say “no” to your request, but we’ll tell you why in writing.
Qualifications & exceptions
The request must be written; the insurer may refuse.
Not stated here
Grounds for refusal and the time for a written reason are not stated.
Cross-references
qualifies (model-proposed): PHI may be collected, used and shared for payment and healthcare operations — qualifies: The member may send a written request not to have PHI used for treatment, payment, or healthcare operations; the insurer may refuse, so the payment and operations permission is limited only if the insurer agrees.
Use & Processing · User right or choice
Right to ask for a restriction on PHI for services you pay for in full yourself
If the member pays in full out of pocket for any medical services, they have the right to ask for a restriction that would prevent the use or sharing of that PHI for treatment, payment, or operations reasons. The notice then says that if the member or their provider submits a claim to the insurer, it may not agree to a restriction, and that if a law requires sharing the information, the insurer does not have to agree. So the right is to ask; it does not promise the restriction is granted. The notice refers to ’Your rights’ above for this limit but does not identify which earlier item is meant, so the cross-reference is unclear.
Supporting quotations
If you pay in full for any medical services out of your own pocket, you have the right to ask for a restriction.
The restriction would prevent the use or sharing of that PHI for treatment, payment, or operations reasons.
If you or your provider submits a claim to us, we may not agree to a restriction (see “Your rights” above).
If a law requires sharing your information, we don’t have to agree to your restriction.
Qualifications & exceptions
Applies to services paid in full out of pocket.
The insurer may not agree if a claim is submitted by the member or provider.
The insurer need not agree where a law requires sharing.
Not stated here
Which 'Your rights' item the parenthetical refers to is unclear, since the sentence is itself in that list.
The notice does not say how the member makes the request.
Use & Processing · Company practice
Insurer, affiliates and vendors may call or text using an automatic dialer or artificial voice
The notice says the insurer, including its affiliates and/or vendors, may call or text the member using an automatic telephone dialing system and/or an artificial voice, but only in accordance with the Telephone Consumer Protection Act (TCPA). The calls may be about treatment options or other health-related benefits and services. The earlier contact paragraph says the insurer will ask the member’s permission before contacting them, and this section does not say whether the TCPA-related permission is the same permission; the two statements are not reconciled in the text.
Supporting quotations
We, including our affiliates and/or vendors, may call or text you by using an automatic telephone dialing system and/or an artificial voice.
But we only do this in accordance with the Telephone Consumer Protection Act (TCPA).
The calls may be about treatment options or other health-related benefits and services for you.
Qualifications & exceptions
Stated to be only in accordance with the TCPA; the TCPA is not supplied.
The topics named are treatment options and health-related benefits and services; 'may be about' is not exhaustive.
Not stated here
Whether consent is obtained before autodialed calls or texts is not stated.
Who the affiliates and vendors are is not stated.
Cross-references
contrast (model-proposed): Insurer must give access to your PHI and may contact you about benefits, other plans and reminders — contrast: One paragraph says the insurer will ask the member's permission before contacting them; a later section says the insurer may call or text by automatic dialer in accordance with the TCPA. The text does not reconcile the two, so the extent of the permission is unclear.
Use & Processing · User right or choice
Tell the caller or call the Do Not Call number to stop calls and texts
If the member does not want to be contacted by phone, they can tell the caller or call 1-844-203-3796 to add their phone number to the insurer’s Do Not Call list. The insurer says it will then no longer call or text.
Supporting quotations
If you don’t want to be contacted by phone, just let the caller know or call 1-844-203-3796 to add your phone number to our Do Not Call list. We will then no longer call or text you.
Qualifications & exceptions
Described as covering phone calls and texts to the member.
Not stated here
How quickly the insurer stops contacting the member is not stated.