Medical, dental, pharmacy, managed behavioral health and vision plans notice of privacy practices

Sharing & Disclosure · Company practice

Who "Aetna" is here: one affiliated group that shares PHI

The notice describes the privacy practices of Aetna Life Insurance Company. In the notice, "Aetna", "we", "us" and "our" mean all the HMO and licensed insurer subsidiaries of Aetna Inc., which are designated a single affiliated covered entity (the "Aetna ACE") for federal privacy purposes. Members of that group can share Protected Health Information (PHI) with each other for the treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice. A full list of group members is available by contacting the Aetna Privacy Office at PrivacyAetna@aetna.com.

Supporting quotations

This Notice of Privacy Practices (Notice) describes the privacy practices of Aetna Life Insurance Company.

For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc.

These entities have been designated as a single affiliated covered entity for federal privacy purposes.

The members of the Aetna ACE can share Protected Health Information (PHI) with each other.

We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice.

For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

Qualifications & exceptions

• Sharing within the group is described as for treatment, payment and health care operations of the group, and as allowed by HIPAA and this Notice.

Not stated here

• The list of Aetna ACE members is not in the document; it is available only on request from the Aetna Privacy Office.
• The notice does not say which member of the group is the insurer for any particular plan or member.

Sharing & Disclosure · Company practice

Explanation of Benefits mail and claims-status access reach the subscriber and dependents

Aetna may mail Explanation of Benefits forms and other information to the address it has on file for the subscriber (the primary insured). It also makes claims information available on its secure member website and telephone claims status sites to the subscriber and all covered dependents. PHI is also used to get payment for mail-order pharmacy services you get.

Supporting quotations

We may also mail Explanation of Benefits forms and other information to the address we have on file for the subscriber (i.e., the primary insured).

We also make claims information on our secure member website and telephonic claims status sites available to the subscriber and all covered dependents.

We also use PHI to get payment for any mail-order pharmacy services you get.

Qualifications & exceptions

• The rights section lets you ask Aetna to communicate with you at a different address, and the notice says paper mailing of EOBs can be stopped by registering on Aetna.com.

Not stated here

• The notice does not say whether each covered dependent can see claims information about other members of the plan.

Cross-references

• qualified by (model-proposed): Right to ask for communications in the way or place you choose — EOBs go to the subscriber's address on file, but you may ask Aetna to send health information such as an EOB to a different address if the request is reasonable.
• qualified by (model-proposed): Stop the paper mailing of EOBs by registering on Aetna.com — The paper mailing of EOBs to the address on file can be stopped by completing the one-time registration on Aetna.com.

Sharing & Disclosure · Permission or license

Treatment: sharing PHI with your providers and offering mail-order pharmacy

Aetna may share your PHI with the health care providers who take care of you, like doctors, dentists, pharmacies and hospitals, and the notice says doctors may sometimes ask Aetna for your medical information to put in their own records. Aetna may also use your information to offer you mail-order pharmacy services, and may share certain information for patient safety or other reasons linked to your treatment.

Supporting quotations

We may share your PHI with the health care providers who take care of you like your doctors, dentists, pharmacies and hospitals.

Sometimes doctors may ask for your medical information from us to put in their own records.

We may also use your information to offer you mail-order pharmacy services.

And we may also share certain information for patient safety or other reasons linked to your treatment.

Qualifications & exceptions

• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not say which information is "certain information" shared for patient safety, or what other reasons are "linked to your treatment".

Sharing & Disclosure · Permission or license

Sharing with other covered entities and their business associates

Aetna may share your PHI with other covered entities or their business associates for treatment, payment, or certain health care operations. As an example, if you get your health benefits through an employer, Aetna may share your PHI with other health plans your employer offers so that claims are paid the right way.

Supporting quotations

We may share your PHI with other covered entities or their business associates.

This may be for treatment, payment, or for certain health care operations.

For example, you may get your health benefits through an employer. If so, we may share your PHI with other health plans your employer offers. We do this to make sure we pay your claims the right way.

Qualifications & exceptions

• The employer-plan sentence is an example, introduced with "For example", of this sharing.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• "Certain health care operations" is not defined, and the notice does not list which other covered entities or business associates may receive PHI.

Sharing & Disclosure · Permission or license

Further disclosures that need no authorization, by category

The notice says Aetna also may use or share your PHI without your authorization in support of the purposes it lists next: group plan administration, research, business associates, health oversight, workers' compensation, law enforcement, legal proceedings, public welfare matters, as required by law, decedents, organ procurement, reports of abuse, neglect or domestic violence, and specialized government functions, military and correctional institutions. Each category has its own conditions, which are described in the cards that follow.

Supporting quotations

We also may use or share your PHI without your authorization in support of:

Qualifications & exceptions

• Each listed category has its own stated conditions or limits.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice describes categories, not individual recipients; the actual recipients in a given case are not named.

Cross-references

• qualified by (model-proposed): Recipients may pass PHI on and HIPAA may no longer protect it — Information shared in the listed categories may be redisclosed by the recipient and may no longer be protected by HIPAA.
• qualified by (model-proposed): Stricter laws for sensitive information; Aetna follows the stricter one — Aetna says it follows the stricter or more protective law where it applies, which qualifies the further disclosures listed as allowed without authorization.

Sharing & Disclosure · Permission or license

Group plan administration: PHI to your employer under stated conditions

For group plans, Aetna may share PHI with your employer, as applicable, when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.

Supporting quotations

Plan Administration (Group Plans) – to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.

Qualifications & exceptions

• Applies to group plans and only "as applicable".
• Two alternative conditions are stated: informed plan-document language, or summary data for bidding or amending the plan.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not say what "appropriate language" is or what "summary data" contains.

Sharing & Disclosure · Permission or license

Research: PHI to researchers with privacy protections

Aetna may share PHI with researchers, provided measures are taken to protect your privacy.

Supporting quotations

Research – to researchers, provided measures are taken to protect your privacy.

Qualifications & exceptions

• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not say what the privacy measures are, who decides they are adequate, or whether any research disclosure needs your permission.

Sharing & Disclosure · Permission or license

Business associates: PHI to service providers who promise to protect it

Aetna may share PHI with persons who provide services to it and who assure Aetna that they will protect the information.

Supporting quotations

Business Associates – to persons who provide services to us and assure us they will protect the information.

Qualifications & exceptions

• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not name or categorize the service providers, or say how the assurance is given or checked.

Sharing & Disclosure · Permission or license

Health oversight agencies

Aetna may share PHI with health oversight agencies, such as agencies that oversee the health care system and government benefit programs, for oversight activities authorized by law, such as investigations, audits, and licensure or disciplinary actions.

Supporting quotations

Health Oversight – to health oversight agencies (e.g., agencies that oversee the healthcare system and government benefit programs) for purposes of oversight activities authorized by law (e.g., investigations, audits, and licensure or disciplinary actions).

Qualifications & exceptions

• Limited to oversight activities authorized by law; the examples are introduced with "e.g.".
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Sharing & Disclosure · Permission or license

Public welfare matters such as public health and child abuse

Aetna may share PHI to address matters of public interest as required or permitted by law, such as child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, and product recalls.

Supporting quotations

Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, public health surveillance and investigations, controlling disease, product recalls).

Qualifications & exceptions

• The examples are introduced with "e.g." and are not the complete set of public-interest matters.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Sharing & Disclosure · Permission or license

Decedents and organ donation

Aetna may share PHI with a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and with funeral directors as necessary to carry out their duties. It may also share PHI with organ donation groups to facilitate donation and transplantation.

Supporting quotations

Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.

Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.

Qualifications & exceptions

• Funeral director disclosures are limited to what is necessary to carry out their duties.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Sharing & Disclosure · Permission or license

Reports of abuse, neglect or domestic violence, with notice to you

If Aetna believes you are a victim of abuse, neglect or domestic violence, it may share PHI with government authorities, including social service or protective service agencies, that are authorized to receive such reports. Aetna says it will inform you of such a disclosure unless doing so would place you at risk of serious harm or would not be in your best interests.

Supporting quotations

Abuse, Neglect, or Domestic Violence – to government authorities, including social service or protective service agencies, authorized to receive such reports, if we believe that you are a victim of abuse, neglect, or domestic violence. We will inform you of such a disclosure, unless doing so would place you at risk of serious harm or not be in your best interests.

Qualifications & exceptions

• The disclosure depends on Aetna's belief that you are a victim.
• You are told about the disclosure unless it would place you at risk of serious harm or is not in your best interests.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Sharing & Disclosure · Permission or license

National security, military and correctional institutions

Aetna may share PHI with authorized government officials for national security and intelligence activities, protective services for the President, and medical suitability determinations. For members of the U.S. armed forces or the foreign military, it may disclose PHI for activities deemed necessary by appropriate command authorities or under the law. If you are in the custody of a correctional institution or a law enforcement official, Aetna may disclose your PHI to them if certain representations are made, for example that the information is necessary to provide you with health care or for the health and safety of others.

Supporting quotations

Specialized Government Functions, Military, and Correctional Institutions –

to authorized government officials for purposes of national security and intelligence activities, protective services for the President, and medical suitability determinations. If you are a member of the U.S. armed forces or the foreign military, we may disclose your PHI for activities deemed necessary by appropriate command authorities or under the law. If you are under the custody of a correctional institution or a law enforcement official, we may disclose your PHI to such parties if certain representations are made (e.g., the information is necessary to provide you with health care or the health and safety of others).

Qualifications & exceptions

• Custody disclosures depend on "certain representations" being made; the examples are introduced with "e.g.".
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not say who makes the representations or how Aetna checks them.

Sharing & Disclosure · Company practice

Times when Aetna must share your PHI

The notice says there are times when Aetna must share your PHI. When required, it must release it to you or to someone who has the legal right to act for you (your personal representative); to the Department of Health and Human Services, which may collect this information to enforce HIPAA; and to other government authorities as required by applicable law.

Supporting quotations

There are times when we must share your PHI. When required, we must release it to:

You, or someone who has the legal right to act for you. This person is your personal representative. We do this to help manage your rights, as spelled out in this Notice.

The Department of Health and Human Services. We may do this to comply with the Health Insurance Portability and Accountability Act (HIPAA). They may collect this information to enforce HIPAA.

Other government authorities as required by applicable law.

Qualifications & exceptions

• The Health and Human Services item says Aetna "may" do this to comply with HIPAA, while the lead sentence says "must"; the lead sentence limits all three to times when sharing is required.

Sharing & Disclosure · Permission or license

Sharing with people involved in your care or its payment

Aetna may share your PHI with people involved in your health care, and with those involved in paying for your care. For example, if a family member or a caregiver calls about a claim, Aetna may tell them what stage it is in.

Supporting quotations

When we may share your information with those involved in your care

We may share your PHI with people involved in your health care.

We may also share with those involved in paying for your care.

For example, if a family member or a caregiver calls us about a claim, we may tell them what stage it’s in.

Qualifications & exceptions

• You can stop or limit this sharing; see the right to stop or limit it.
• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Not stated here

• The notice does not say whether Aetna checks that a caller is involved in your care before telling them a claim's status.

Sharing & Disclosure · User right or choice

You can stop or limit sharing with people involved in your care

You have the right to stop or limit sharing of your PHI with people involved in your care or its payment. To do so, you call the toll-free number on your member ID card.

Supporting quotations

You have the right to stop or limit this kind of sharing (disclosure).

To do so, just call the toll-free number on your member ID card.

Qualifications & exceptions

• The rights section describes this as asking Aetna to restrict sharing with people involved in your health care, and says requests to limit uses and sharing for treatment, payment and operations are considered but may not be agreed to.

Not stated here

• The notice does not say whether Aetna must honor a request to stop or limit this sharing, or how quickly it takes effect.

Cross-references

• contrast (model-proposed): Right to ask for limits on use and sharing — One passage says you have the right to stop or limit sharing with people involved in your care by calling; the rights section describes asking Aetna to restrict that sharing and says Aetna will consider but may not agree to requests to limit uses. The notice does not say whether Aetna must honor a request to restrict sharing with people involved in care.

Sharing & Disclosure · User right or choice

Minors may be able to block parental views, if state law allows

If you are a minor, you may have the right to block parental views of your health information in certain cases, but only if state law allows it. You can call the toll-free number on your ID card, or have your provider talk to Aetna.

Supporting quotations

If you’re a minor, you may have the right to block parental views of your health information in certain cases. But you can only do so if state law allows it. You can call us at the toll-free number on your ID card. Or have your provider talk to us.

Qualifications & exceptions

• The right exists only "in certain cases" and only if state law allows it.

Not stated here

• The notice does not say which states allow this or which cases qualify.

Sharing & Disclosure · Permission or license

Notifying family or disaster relief groups about location, condition or death

Aetna may use or share your PHI to notify, or to help notify, a family member or any other person responsible for your care about your location, general condition or death. It may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.

Supporting quotations

We may use or share your PHI to notify or to help to notify a family member or any other person responsible for your care about your location, general condition or death. We may also disclose your PHI to disaster relief groups so that your family or others responsible for your care can learn of your location, general condition or death.

Qualifications & exceptions

• The notice later says that stricter state or federal law may protect certain sensitive information (for example mental health, HIV/AIDS, reproductive health, substance use disorder) and that Aetna follows the stricter law where it applies to it.

Sharing & Disclosure · User right or choice

When Aetna needs your written okay

If Aetna has not described a use or disclosure in the notice above, it needs you to say in writing that it is okay to use or disclose your PHI. Examples where it will get your okay are marketing purposes unrelated to your benefit plan(s), before sharing any psychotherapy notes, when linked to the sale of your PHI, and for other reasons as required by law.

Supporting quotations

When we need your okay to use or share your information

If we have not described a use or disclosure above, we will need you to say it’s okay in writing to use or disclose your PHI. For example, we will get your okay:

For marketing purposes unrelated to your benefit plan(s)

Before sharing any psychotherapy notes

When linked to the sale of your PHI

For other reasons as required by law

Qualifications & exceptions

• The requirement applies to uses and disclosures the notice has not described; the examples are introduced with "For example" and are not the complete set.
• Marketing needs your okay only when it is unrelated to your benefit plan(s); the notice separately describes treatment alternatives and health-related benefits as uses without authorization.

Not stated here

• The notice does not say what counts as marketing that is related to your benefit plan.

Cross-references

• qualified by (model-proposed): You can withdraw your okay in writing at any time — An authorization given for an otherwise undescribed use can be withdrawn in writing, but Aetna stops only for what it has not already acted on.

Sharing & Disclosure · User right or choice

You can withdraw your okay in writing at any time

Even if you gave your okay, you can withdraw it at any time by letting Aetna know in writing. If Aetna has not already acted on it, it will stop using or sharing your information for that purpose. For questions about written permission, you can call the toll-free number on your ID card.

Supporting quotations

Even if you gave us your okay, you can withdraw it anytime. You just need to let us know in writing. If we haven’t already acted on it, we’ll stop using or sharing your information for that purpose. If you have questions about written permission, just call the toll-free number on your ID card.

Qualifications & exceptions

• Withdrawal must be in writing and does not undo uses or disclosures Aetna has already acted on.

Cross-references

• qualifies (model-proposed): When Aetna needs your written okay — An authorization given for an otherwise undescribed use can be withdrawn in writing, but Aetna stops only for what it has not already acted on.

Sharing & Disclosure · Restriction or exception

Recipients may pass PHI on and HIPAA may no longer protect it

The notice says that PHI disclosed as permitted by HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA.

Supporting quotations

PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

Qualifications & exceptions

• Applies to PHI disclosed as permitted by HIPAA.

Not stated here

• The notice does not say what other protections, if any, apply once a recipient passes the information on.

Cross-references

• qualifies (model-proposed): Further disclosures that need no authorization, by category — Information shared in the listed categories may be redisclosed by the recipient and may no longer be protected by HIPAA.