PI may be shared outside the company, sometimes without approval, with opt-outs only for some activities
The notice says the insurer may share a member’s PI with others outside the company, ’without your approval, in some cases’. It adds that it takes reasonable measures to protect the information. Where an activity requires the insurer to give the member a chance to opt out, the insurer says it will tell the member and explain how to say they do not want their PI used or shared for that activity. The text does not say which activities allow an opt-out, so the opt-out applies only to activities where such a chance is required.
Supporting quotations
We may also share your PI with others outside our company — without your approval, in some cases.
But we take reasonable measures to protect your information.
If an activity requires us to give you a chance to opt out, we’ll let you know, and we’ll let you know how to tell us you don’t want your PI used or shared for an activity you can opt out of.
Qualifications & exceptions
'In some cases' limits the no-approval sharing but does not say which cases.
Opt-out is described only for activities that 'require' giving the member that chance.
Not stated here
Who the outside recipients are, which cases need no approval, and which activities carry an opt-out are not specified in this paragraph.
Sharing & Disclosure · Company practice
Insurer does not provide treatment but uses and shares treatment information
For treatment activities, the notice says the insurer does not provide treatment, but collects, uses, and shares information about the member’s treatment to offer services that may help the member, including sharing information with others providing the member treatment.
Supporting quotations
Treatment activities: We don’t provide treatment, but we collect, use, and share information about your treatment to offer services that may help you, including sharing information with others providing you treatment.
Qualifications & exceptions
Stated purpose is 'to offer services that may help you'.
Not stated here
Which services are offered and which treatment providers receive the information are not specified.
Sharing & Disclosure · Company practice
Examples of routine sharing with doctors, hospitals and the plan subscriber
The notice’s examples of sharing include giving information to a doctor’s office to confirm benefits, sharing the explanation of benefits (EOB) with the subscriber of the plan for payment purposes, and sharing PHI with the member’s doctor or hospital so they may treat the member. The EOB example names the subscriber, who may be a different person from the member; the notice does not define ’subscriber’ or say what an EOB contains.
Supporting quotations
We may give information to a doctor’s office to confirm your benefits.
We may share explanation of benefits (EOB) with the subscriber of your plan for payment purposes.
We may share PHI with your doctor or hospital so that they may treat you.
Qualifications & exceptions
Presented as examples under the heading of ways information is used.
Not stated here
Who the subscriber is relative to the member is not defined, and the notice does not say what an EOB contains.
Sharing & Disclosure · Company practice
PHI may be shared with health information exchanges; the notice points to the website for opting out
The insurer says it may use and share PHI directly or indirectly with health information exchanges for payment, healthcare operations, and treatment. For members who do not want their PHI shared in these situations, the notice says to visit www.wellpoint.com/privacy for more information. The notice itself does not say whether the member can opt out or how; it only points to the website, which is not part of the supplied text.
Supporting quotations
We may also use and share PHI directly or indirectly with health information exchanges for payment, healthcare operations, and treatment.
If you don’t want your PHI to be shared in these situations, visit www.wellpoint.com/privacy for more information.
Qualifications & exceptions
Sharing is for payment, healthcare operations and treatment, 'directly or indirectly'.
Not stated here
Whether an opt-out exists, and its process, are not stated in this notice; the website page is not supplied.
Sharing & Disclosure · Company commitment
Written permission is needed for most other uses, marketing, sale of PHI and psychotherapy notes
The notice says that in most cases, if the insurer uses or shares PHI outside of treatment, payment, operations, or research activities, it has to get the member’s written okay first. It must also get written permission before using PHI for certain marketing activities, selling PHI, or sharing psychotherapy notes from the member’s doctor or therapist, and it may need written permission in other situations not listed. The member can cancel any written permission at any time; the later Authorization section adds that cancellation must be in writing and does not undo actions already taken. Research is named among the activities that do not need that written okay. Separate paragraphs allow sharing for public health, legal and government reasons; the notice does not say how the written-permission rule applies to those.
Supporting quotations
In most cases, if we use or share your PHI outside of treatment, payment, operations, or research activities, we have to get your okay in writing first.
Using your PHI for certain marketing activities.
Selling your PHI.
Sharing any psychotherapy notes from your doctor or therapist.
We may also need your written permission for other situations not mentioned above. You always have the right to cancel any written permission you have given at any time.
Qualifications & exceptions
'In most cases' means there are cases without a written okay.
The marketing rule applies to 'certain' marketing activities only.
Treatment, payment, operations and research are outside the written-permission rule.
Not stated here
Which marketing activities count as 'certain', and which other situations need written permission, are not listed.
Sharing & Disclosure · User right or choice
Member can tell the insurer to share information with family, friends or in emergencies
The notice says the member has the right and choice to tell the insurer to share information with family, close friends, or others involved with the member’s current treatment or payment for care, and to share information in an emergency or disaster relief situation. It does not say how the member tells the insurer or whether this must be in writing.
Supporting quotations
You have the right and choice to tell us to:
Share information with your family, close friends, or others involved with your current treatment or payment for your care.
Share information in an emergency or disaster relief situation.
Qualifications & exceptions
Framed as a choice to tell the insurer to share; the notice does not describe a choice to refuse in these terms.
Not stated here
How the choice is made, and whether writing is required, are not stated.
Sharing & Disclosure · Restriction or exception
Insurer may share PHI when you cannot state a preference or there is a serious threat
If the member cannot state a preference, for example in an emergency or if unconscious, the insurer says it may share PHI if it believes this is in the member’s best interest. It may also share information when needed to lessen a serious and likely threat to health or safety. This operates as an exception to the choices above: the insurer applies its own belief about the member’s best interest, and the sentence does not name the recipients.
Supporting quotations
If you can’t tell us your preference, for example in an emergency, or if you’re unconscious, we may share your PHI if we believe it’s in your best interest. We may also share your information when needed to lessen a serious and likely threat to your health or safety.
Qualifications & exceptions
Depends on the insurer's belief about the member's best interest.
PHI may be shared for public health and safety purposes
In a list of other reasons to use or share information, the notice says the insurer is allowed, and in some cases required, to share information in other ways, usually for the good of the public. For public health and safety, it names preventing disease, helping with product recalls, reporting adverse reactions to medicines, reporting suspected abuse, neglect, or domestic violence, and preventing or reducing a serious threat to anyone’s health or safety. The list is introduced as ’these specific purposes’.
Supporting quotations
We are allowed, and in some cases required, to share your information in other ways — usually for the good of the public, such as public health and research.
Helping with public health and safety issues, such as:
Preventing disease
Helping with product recalls
Reporting adverse reactions to medicines
Reporting suspected abuse, neglect, or domestic violence
Preventing or reducing a serious threat to anyone’s health or safety
Qualifications & exceptions
'Usually for the good of the public' and the 'such as' wording leave room for sharing beyond the examples under the public health heading.
The written-permission paragraph does not list these purposes as exempt, and this paragraph does not say whether written permission is needed for them.
Not stated here
Who receives the information and what conditions apply for each purpose are not stated.
Whether written permission is required for these purposes is not stated either way.
Sharing & Disclosure · Permission or license
PHI may be shared for health research and with organ donation groups
The notice lists doing health research and responding to organ donation groups for research and certain reasons among the purposes for which the insurer may use or share information. The earlier written-permission paragraph names research as an activity outside the written-permission rule, so research uses do not need the member’s written okay. The notice does not say what conditions apply to research sharing or whether the information is identifiable.
Supporting quotations
Doing health research.
Responding to organ donation groups for research and certain reasons.
In most cases, if we use or share your PHI outside of treatment, payment, operations, or research activities, we have to get your okay in writing first.
Qualifications & exceptions
Organ donation sharing is for 'research and certain reasons', and the 'certain reasons' are not listed.
Not stated here
Conditions for research sharing, and whether data is identified, are not stated.
PHI may be shared to obey the law, for lawsuits, government requests and law enforcement
Among the reasons for sharing information, the notice lists obeying the law if it requires sharing, addressing workers’ compensation, law enforcement and other government requests, alerting proper authorities if the insurer believes the member may be a victim of abuse or other crimes, responding to lawsuits and legal actions, and responding to the federal Secretary of Health and Human Services for HIPAA compliance and enforcement purposes. The wording ’other government requests’ is open-ended, and the notice does not say what legal process the insurer requires.
Supporting quotations
Obeying the law, if it requires sharing your information.
Addressing workers’ compensation, law enforcement, and other government requests, and to alert proper authorities if we believe you may be a victim of abuse or other crimes.
Responding to lawsuits and legal actions.
Responding to the Secretary of Human and Health Services for HIPAA rules compliance and enforcement purposes.
Qualifications & exceptions
Obeying the law applies only 'if it requires sharing'.
Alerting authorities depends on the insurer's belief that the member may be a victim.
Not stated here
What legal process is required, and what scope of information is shared for each request, is not stated.
Sharing & Disclosure · Permission or license
For employer-based coverage, PHI may be shared with the group health plan; employer access is limited
If the member is enrolled through an employer, the insurer says it may share PHI with the member’s group health plan. If the employer pays the premium or part of it but does not pay the health insurance claims, the employer can only have PHI for permitted reasons and is required by law to protect it. The notice does not say what applies when the employer does pay claims, and it does not define the permitted reasons. The stored text does not mention retiree coverage, so how this applies to retirees is not stated.
Supporting quotations
If you’re enrolled with us through an employer, we may share your PHI with your group health plan.
If the employer pays your premium or part of it, but doesn’t pay your health insurance claims, your employer can only have your PHI for permitted reasons and is required by law to protect it.
Qualifications & exceptions
The employer limit is stated for an employer that pays premium but not claims.
Not stated here
What happens when the employer pays claims, and what the 'permitted reasons' are, are not stated.
Retiree coverage is not mentioned in the text.
Sharing & Disclosure · User right or choice
Right to a list of those with whom your PHI was shared
The member can send a written request for a list of those with whom the insurer has shared their PHI. The insurer says it will usually provide the list within 60 days and will tell the member if it needs more time.
Supporting quotations
Send us a written request to ask us for a list of those with whom we’ve shared your PHI. We will provide you a list usually within 60 days of your request. If we need more time, we will let you know.
Qualifications & exceptions
The request must be written; 'usually' within 60 days.
Not stated here
Which disclosures appear on the list, and any time period it covers, are not stated.
Sharing & Disclosure · Company commitment
Business partners must protect PHI and cannot pass it on without written permission, unless the law allows
The notice says that, where required by law, the insurer’s business partners must protect the privacy of data it shares with them. It says they are not allowed to give the member’s PHI to others without written permission, unless the law allows it and it is stated in the notice. The business partners are not named or described.
Supporting quotations
Also, where required by law, our business partners must protect the privacy of data we share with them as they work with us.
They’re not allowed to give your PHI to others without your written permission, unless the law allows it and it’s stated in this notice.
Qualifications & exceptions
'Where required by law' limits the duty to protect.
Onward sharing is barred except where the law allows and the notice states it.
Not stated here
Who the business partners are and what data they receive are not stated.