Aetna International U.S.-based plans notice of privacy practices

Sharing & Disclosure · Company practice

"We" means Aetna subsidiaries that share PHI as one covered entity

In this notice, "Aetna International" and "we," "us" and "our" mean all of the HMO and licensed insurer subsidiaries of Aetna Inc. Those entities are designated as a single affiliated covered entity for federal privacy purposes (the Aetna ACE). The members of the Aetna ACE can share protected health information (PHI) with each other for the treatment, payment and health care operations of the Aetna ACE, and as allowed by HIPAA and this notice.

Supporting quotations

refer to all of the HMO and licensed insurer subsidiaries of Aetna Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information

(PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

Qualifications & exceptions

• Sharing among ACE members is for treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this notice.
• The "single affiliated covered entity" designation is stated to be "for federal privacy purposes."

Not stated here

• The notice does not list the members of the Aetna ACE; it directs members to contact the Aetna Privacy Office at PrivacyAetna@aetna.com for the full list.

Sharing & Disclosure · Permission or license

Information may be used to facilitate a sale, merger or transfer of Aetna

Aetna lists, among its operational activities, facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity, including due diligence related to that activity. The notice treats this as a use and disclosure of your information that it may make.

Supporting quotations

facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity)

Qualifications & exceptions

• Covers a sale, transfer, merger or consolidation of "all or part of Aetna," including due diligence.

Not stated here

• The notice does not say what safeguards or limits apply to the other entity receiving information in such a transaction.

Sharing & Disclosure · Company practice

EOBs go to the subscriber's address and claims show online to dependents

Aetna says it mails Explanation of Benefits forms and other information to the address it has on record for the subscriber (the primary insured), which may be the subscriber's employer address, as applicable. It also makes claims information available to the subscriber and all covered dependents on its member health and telephonic claims status websites, including Aetna Navigator.

Supporting quotations

We also mail Explanation of Benefits forms and other Information to the address we have on record for the subscriber (i.e., the primary insured).

we make claims Information available to the subscriber (the primary insured) and all covered dependents on our member health and telephonic claims status websites, including Aetna Navigator

Qualifications & exceptions

• Mailing goes to the subscriber's address on record, which "may be" the employer's address "as applicable."
• Online claims information is available to the subscriber and all covered dependents.

Not stated here

• The paper mailing can be stopped through online registration, described later in the notice; this section does not say that.

Cross-references

• qualified by (model-proposed): Stop paper EOB mailings by registering at aetna.com — The subscriber's paper EOB mailing can be stopped through online registration.

Sharing & Disclosure · Company practice

Treatment: information to doctors, pharmacies and hospitals; mail order pharmacy

Aetna says it may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you. For example, doctors may request medical information from Aetna to supplement their records. Aetna also may use personal information in providing mail order pharmacy services and may send certain information to doctors for patient safety or other treatment-related reasons.

Supporting quotations

Treatment: We may disclose personal information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you.

doctors may request medical information from us to supplement their own records.

We also may use personal information in providing mail order pharmacy services and by sending certain Information to doctors for patient safety or other treatment-related reasons.

Qualifications & exceptions

• Disclosures go to providers who "take care of you."

Sharing & Disclosure · Company practice

Disclosure to other insurers, providers and their business associates

Aetna says it may disclose your information to other insurers, health care providers, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, it may disclose information to other health plans maintained by your employer if it has been arranged for Aetna to do so in order to have certain expenses reimbursed.

Supporting quotations

Disclosures to Other Covered Entities: We may disclose Information to other insurers, healthcare providers, or business associates of those entities for treatment, payment and certain health care operations purposes.

we may disclose Information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.

Qualifications & exceptions

• Limited to treatment, payment and "certain" health care operations purposes.
• The employer-plan example applies only if it "has been arranged for us to do so."

Not stated here

• The notice does not say which health care operations purposes are covered.

Sharing & Disclosure · Permission or license

Group plans: information to your employer for plan administration

For group plans, Aetna says it may disclose information to your employer, as applicable, for plan administration when Aetna has been informed that appropriate language has been included in the plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.

Supporting quotations

Plan Administration (Group Plans)

to your employer, as applicable, when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.

Qualifications & exceptions

• Applies to group plans.
• Two conditions: appropriate language in the plan documents, or summary data to assist in bidding or amending the plan.

Not stated here

• The notice does not say what the required plan-document language is.

Sharing & Disclosure · Company practice

Research and business associates

Aetna says it may disclose information to researchers, provided measures are taken to protect your privacy, and to persons who provide services to Aetna and assure Aetna they will protect the information (business associates).

Supporting quotations

Research – to researchers, provided measures are taken to protect your privacy.

Business Associates – to persons who provide services to us and assure us they will protect the Information.

Qualifications & exceptions

• Research disclosures are conditioned on measures being taken to protect your privacy.
• Business associates must assure Aetna they will protect the information.

Not stated here

• The notice does not say what privacy measures are required for research or how the assurance is documented.

Sharing & Disclosure · Company practice

Disclosure to government regulators in different countries and U.S. states

Aetna says it may disclose information to government agencies that regulate it, described as agencies in different countries and U.S. state insurance departments.

Supporting quotations

Industry Regulation – to Government agencies that regulate us (different countries and U.S. state insurance departments).

Not stated here

• The notice does not name the countries or agencies.

Sharing & Disclosure · Company practice

Disclosures for workers' compensation, law enforcement, court orders and public welfare

Aetna says it may disclose information to comply with workers' compensation laws, to government law enforcement officials, in response to a court order or other lawful process, to address matters of public interest as required or permitted by law (for example child abuse and neglect, threats to public health and safety, and national security), and to comply with legal obligations and requirements. These items are part of a list that continues in the next section of the notice.

Supporting quotations

Workers’ Compensation – to comply with workers’ compensation laws.

Law Enforcement – to Government law enforcement officials.

Legal Proceedings – in response to a court order or other lawful process.

Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).

As Required by Law – to comply with legal obligations and requirements.

Qualifications & exceptions

• The notice does not attach conditions to the law enforcement item itself.
• Public interest disclosures are stated as "as required or permitted by law."
• The notice separately says that stricter laws protecting some sensitive information can limit use and disclosure, and that information from a substance use disorder program is not used or shared in a legal case against you unless you give written consent or a court orders it.

Not stated here

• The notice does not say how the sensitive-information protections apply to each disclosure on this list.

Cross-references

• qualified by (model-proposed): Stricter laws may limit use of sensitive health information — Laws protecting sensitive health information may limit disclosures, and Aetna says it follows the stricter law where it applies, which qualifies the disclosures for legal and public-interest reasons.
• narrowed by (model-proposed): SUD information is not used against you in a legal case without consent or court order — For substance use disorder program information, use or sharing in a legal case against you needs written consent or a court order, which narrows the general legal-proceedings disclosures.

Sharing & Disclosure · Company practice

Disclosures about decedents and for organ donation

Continuing the list of additional reasons for disclosure, Aetna says it may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law, and to funeral directors as necessary to carry out their duties. It may also disclose information to respond to organ donation groups for the purpose of facilitating donation and transplantation.

Supporting quotations

to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.

to respond to organ donation groups for the purpose of facilitating donation and transplantation.

Qualifications & exceptions

• Coroner and medical examiner disclosures are for the listed purposes or "as authorized by law."
• Funeral director disclosures are limited to what is "necessary to carry out their duties."

Sharing & Disclosure · Company practice

Information may go to relatives, friends or others involved in your care or payment

Aetna says it may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person's involvement with your health care or payment for that care. For example, if a family member or caregiver calls with prior knowledge of a claim, Aetna may confirm whether the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.

Supporting quotations

We may disclose health personal information about you to a relative, a friend, the employer, the subscriber of your health benefits plan or any other person you identify, provided the Information is directly relevant to that person

involvement with your health care or payment for that care.

if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid.

You have the right to stop or limit this kind of disclosure by calling the Member Services number on your ID card.

You also have the right to ask us to restrict disclosures to persons involved in your health care.

Qualifications & exceptions

• Only information "directly relevant" to the person's involvement in your care or payment for it.
• Recipients include the employer and the plan subscriber, as well as relatives, friends and other people you identify.

Not stated here

• A later list of rights says Aetna "will consider, but may not agree to" requests to restrict uses and disclosures, and separately says you may ask to restrict disclosures to persons involved in your care; this section does not say whether Aetna may decline a request to stop or limit this kind of disclosure.

Cross-references

• contrast (model-proposed): HIPAA right: ask Aetna to restrict uses and disclosures; Aetna may refuse — One passage says you have the right to stop or limit disclosures to relatives and others involved in your care; the rights list says Aetna will consider but may not agree to restriction requests. The notice does not say whether Aetna may refuse the persons-involved case.

Sharing & Disclosure · Restriction or exception

Recipients may redisclose PHI and HIPAA may no longer protect it

The notice warns that protected health information disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.

Supporting quotations

PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

Qualifications & exceptions

• Stated as "may be subject to" redisclosure.

Sharing & Disclosure · Company practice

Data collected in the EEA may be sent outside it to other Aetna group companies

If Aetna collected personal data about you in the European Economic Area, it says there are occasions where it may need to send your personal data, including health personal information, outside the EEA. Recipients may include other organizations within the Aetna group for corporate administrative purposes, regulatory reporting, dealing with complaints or seeking legal advice. Aetna says it has appropriate contractual protections, known as model contract clauses, with the group companies that receive the data.

Supporting quotations

If we collected personal data about you in the European Economic Area (EEA), there are occasions where we may need to send your personal data, including health personal information, outside of the

EEA. Organizations that we may send your personal data to include:

Other organizations within the Aetna group for the purposes of corporate administrative, regulatory reporting, dealing with complaints or seeking legal advice. We have appropriate contractual protections (known as model contract clauses) in place with other group companies that receive your personal data.

Qualifications & exceptions

• Applies if the data was collected in the EEA.
• Stated as "occasions where we may need to" send data, and recipients as organizations it "may" send data to.

Not stated here

• The model contract clauses are mentioned only for group companies; the notice does not name a safeguard for the other recipients, including the United States claims administration described earlier.

Sharing & Disclosure · Company practice

Data may go to health care providers overseas when you make a claim

Aetna says the organizations it may send EEA-collected personal data to outside the EEA include providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you while you are overseas.

Supporting quotations

Organizations that we may send your personal data to include:

Providers of health care, where you make a claim under the insurance. This may include medical personal information for the purposes of an organization providing health care to you when you are overseas.

Qualifications & exceptions

• Applies where you make a claim under the insurance.
• Stated as what the data "may" include.

Not stated here

• The notice does not say what safeguards apply to these provider disclosures.