This Notice describes how health information about you may be used and disclosed and how you can get access to it. It is issued by one or more subsidiaries of The Cigna Group that act as affiliated covered entities under HIPAA, referred to as "we". The Notice says it covers uses and disclosures of your PHI and your rights to access and amend it. Cigna Healthcare (employer-sponsored plans, third-party administrator collaboration, Medicare and individual and family plans) and Evernorth Health Services (pharmacy, care and benefits solutions) are both described as part of this group.
Details
Who
One or more subsidiaries of The Cigna Group acting as affiliated covered entities under HIPAA
What it covers
Health information about you (PHI): how it may be used and disclosed and how to access it
What it does
Describes uses and disclosures of PHI and rights to access and amend it
Supporting quotations
This Notice describes how health information about you may be used and disclosed, and how you can get access to this information.
This Notice is provided by one or more subsidiaries of The Cigna Group that operate as affiliated covered entities under HIPAA (“we”).
Evernorth Health Services creates pharmacy, care and benefits solutions
How we may use and disclose your PHI
Your rights to access and amend your PHI
Qualifications & exceptions
The Notice is issued by "one or more" subsidiaries operating as affiliated covered entities, so the entity that holds your PHI depends on your coverage or service.
Not stated here
This block does not say which specific subsidiary applies to a particular member; a list of subsidiaries appears elsewhere in the document.
Legal Rights & Agreement Rules · Company commitment
Legal duties: protect PHI, give notice, follow this Notice
The affiliates say they are required by state and federal law to protect the privacy of your PHI, to give you this Notice about how they safeguard and use it, and to notify you following a breach of your health information. They say they are bound by the terms of this Notice when they use or disclose PHI. The Notice lists three legal duties: maintain the privacy of PHI, provide notice of legal duties and privacy practices, and abide by the Notice currently in effect for Cigna Affiliated Covered Entities. Where federal, state or local law in your jurisdiction gives additional protection against improper use or disclosure of PHI, the Notice says it will follow that law to the extent it applies.
Details
Who
The Cigna affiliates ("we")
What it does
Protect PHI privacy, give this Notice, notify of breach, abide by the Notice in effect
Condition
Bound by the Notice when using or disclosing PHI; additional laws followed to the extent they apply
Where
Federal, state or local law within your jurisdiction
Supporting quotations
We are required by state and federal law to protect the privacy of your PHI and to provide you with this Notice about how we safeguard and use it, and notify you following a breach of your health information.
When we use or give out (“disclose”) your PHI, we are bound by the terms of this Notice.
Maintain the privacy of your PHI
Provide you with notice of our legal duties and privacy practices with respect to PHI
Abide by the terms of the Notice currently in effect for Cigna Affiliated Covered Entities
If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.
Qualifications & exceptions
The commitment to follow terms is tied to the Notice "currently in effect".
Additional protections from federal, state or local law are followed only to the extent they apply.
Legal Rights & Agreement Rules · Company commitment
Disclosures required by law; stronger local laws followed
The affiliates will disclose PHI about you when required to do so by law. If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, they say they will follow those laws to the extent they apply.
Details
Who
The Cigna affiliates ("we")
Condition
Required by law; more protective law followed to the extent it applies
Where
Federal, state or local law within your jurisdiction
Supporting quotations
We will disclose PHI about you when required to do so by law.
If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.
Qualifications & exceptions
More protective laws apply "to the extent they apply".
Legal Rights & Agreement Rules · User right or choice
Uses that require your authorization
Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures for marketing purposes, and disclosures that constitute a sale of PHI require an authorization. Any other use or disclosure of your PHI not listed in the Notice will be made only with your authorization, unless applicable law permits the use or disclosure, in which case the affiliates say they will comply with applicable law.
Details
Who
The Cigna affiliates ("we")
What it covers
Psychotherapy notes, marketing uses, sales of PHI, and any use or disclosure not listed in the Notice
Condition
Authorization required, unless applicable law permits the use or disclosure
Supporting quotations
Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures for marketing purposes and disclosures that constitute a sale of PHI require an authorization.
These activities and any other uses and disclosures of your PHI not listed in this Notice will be made only with your authorization unless we are permitted by applicable law to make such other use and disclosure, in which case we shall comply with applicable law.
These studies generate aggregate data that we may sell or disclose to other companies or organizations.
Qualifications & exceptions
"Most" uses and disclosures of psychotherapy notes, and only "where appropriate".
The authorization requirement for unlisted uses has an exception where applicable law permits them.
Not stated here
The Notice elsewhere says the affiliates may sell or disclose aggregate data that does not identify you; this passage does not say whether such sales count as a "sale of PHI", so how the two statements fit together is not stated.
Marketing is not defined here, and the earlier passage on contacting you about "other products that may benefit your health" does not say whether it is treated as marketing.
Cross-references
contrast (model-proposed): Aggregate data may be studied, sold or disclosed — One passage says disclosures that constitute a sale of PHI require authorization; another says aggregate data (described as not identifying you) may be sold or disclosed to other companies. The Notice does not say whether aggregate data counts as PHI, so the two are shown side by side rather than reconciled.
contrast (model-proposed): Contact about treatment options and other products — The Notice says uses for marketing purposes require authorization, and separately says the affiliates may contact you about treatment options and other products that may benefit your health without listing authorization. It does not say whether that contact counts as marketing, so both statements are shown.
Legal Rights & Agreement Rules · User right or choice
Revoking an authorization
You may revoke your authorization, in writing, at any time, unless the affiliates have already taken action in reliance on it. The written revocation must be sent to the address listed below in the Notice.
Details
Who
You (the individual)
What it does
Revoke an authorization in writing
Exception
Action already taken in reliance on the authorization
Supporting quotations
You may revoke your authorization, in writing, at any time unless we have taken action in reliance upon it.
Written revocation of authorization must be sent to the address listed below.
Qualifications & exceptions
Revocation must be in writing.
Does not undo action already taken in reliance on the authorization.
Not stated here
The Notice does not say how quickly a revocation takes effect.
Cross-references
refers to (model-proposed): Where to send requests, complaints and revocations — The revocation passage sends written revocations to the address listed below, which is the Privacy Office contact in the rights section.
Categories of PHI that may get extra legal protection
The Notice says certain types of PHI may be subject to enhanced privacy protections under federal and/or state laws. It lists: psychotherapy notes; PHI related to reproductive health care; PHI concerning alcohol and drug abuse prevention, treatment and referral; PHI involving HIV/AIDS testing, diagnosis or treatment; PHI related to venereal and other communicable diseases; and PHI associated with genetic testing.
Details
What it covers
Psychotherapy notes; reproductive health care; alcohol and drug abuse; HIV/AIDS; venereal and other communicable diseases; genetic testing
Condition
May be subject to enhanced protections under federal and/or state law
Where
Federal and/or state law
Supporting quotations
Certain types of Protected Health Information (PHI) may be subject to enhanced privacy protections under federal and/or state laws.
Psychotherapy notes
PHI related to reproductive health care
PHI concerning alcohol and drug abuse prevention, treatment, and referral
PHI involving HIV/AIDS testing, diagnosis, or treatment
PHI related to venereal and other communicable diseases
PHI associated with genetic testing
Qualifications & exceptions
The protections "may" apply, depending on federal and/or state law.
Not stated here
The Notice does not say what the enhanced protections are or which state or federal laws apply.
Legal Rights & Agreement Rules · Restriction or exception
Substance use disorder treatment information
The affiliates say they are not a substance use disorder treatment program (a "SUD Program") but may receive information from one about your treatment. They may not disclose that information so it can be used in a civil, criminal, administrative or legislative proceeding against you unless they have your written consent, or a court order accompanied by a subpoena or other legal requirement compelling disclosure, issued after they and you were given notice and an opportunity to be heard. If they use this information to raise funds for their benefit, they must first give you a clear and conspicuous opportunity to elect not to receive fundraising communications.
Details
Who
The Cigna affiliates ("we")
What it covers
Information received from a SUD Program about your treatment
Condition
Written consent, or court order plus subpoena or other legal requirement after notice and opportunity to be heard
Why
Fundraising only after a clear opportunity to opt out
Supporting quotations
Although we are not a substance use disorder treatment program (a “SUD Program”), we may receive information from a SUD Program about your treatment.
We may not disclose this information so that it can be used in a civil, criminal, administrative, or legislative proceeding against you unless (i) we have your written consent, or (ii) a court order accompanied by a subpoena or other legal requirement compelling disclosure issued after we and you were given notice and an opportunity to be heard.
In addition, if we use this information to raise funds for our benefit, we must first provide you with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
Qualifications & exceptions
The ban on use in proceedings against you is lifted only by your written consent or a court order with a subpoena or other legal requirement issued after notice and an opportunity to be heard.
Applies to information received from a SUD Program.
Cross-references
exception to (model-proposed): Disclosure in judicial and administrative proceedings — The general rule allows disclosure in judicial and administrative proceedings in response to legal process after notice efforts; information received from a SUD Program has the stricter limit that it cannot be used in a proceeding against you without written consent or a court order after notice and opportunity to be heard.
Legal Rights & Agreement Rules · User right or choice
Your rights regarding the PHI maintained about you
The Notice sets out individual rights regarding the PHI the affiliates maintain about you. The rights that follow are: inspect and copy, amend, an accounting of disclosures, request restrictions, confidential communications, be notified of a breach, a paper copy of the Notice, and to file a complaint.
Details
Who
You (the individual)
What it covers
PHI the affiliates maintain about you
Supporting quotations
You have the following rights regarding the PHI we maintain about you.
Legal Rights & Agreement Rules · User right or choice
Right to file a complaint, with no retaliation
If you believe the affiliates violated your privacy rights, you may send a written complaint to their Privacy Office at the contact listed in the Notice. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. The Notice says you will not face retaliation for filing a complaint.
Details
Who
You (the individual)
Condition
Belief that your privacy rights were violated; written complaint to the Privacy Office
Supporting quotations
Right to File a Complaint – If you believe we violated your privacy rights, you may address a written complaint to our Privacy Office at the contact below. You may also file a complaint with the Secretary of the U.S. Dept. of Health and Human Services. You will not face retaliation for filing a complaint.
The affiliates reserve the right to revise the Notice. A revised Notice will be effective for PHI they already have about you as well as any PHI they receive in the future. They say they will communicate revisions through www.TheCignaGroup.com/PrivacyPolicy or www.Evernorth.com.
Details
Who
The Cigna affiliates ("we")
What it does
Revise the Notice; communicate revisions through websites
What it covers
PHI already held and future PHI
Supporting quotations
We Reserve the Right to Revise this Notice – A revised Notice will be effective for PHI we already have about you, as well as any PHI we may receive in the future.
We will communicate revisions to this Notice through our websites www.TheCignaGroup.com/PrivacyPolicy or www.Evernorth.com.
Qualifications & exceptions
Revisions apply to PHI already held and to future PHI.
Not stated here
The Notice names its websites as the way revisions are communicated; it does not promise direct notice to you.
Which Cigna subsidiaries provide products and services
The closing legal text says all Cigna products and services are provided exclusively by or through operating subsidiaries of Cigna Corporation, and lists them: Cigna Health and Life Insurance Company, Connecticut General Life Insurance Company, American Retirement Life Insurance Company, Cigna National Health Insurance Company, Loyal American Life Insurance Company, Evernorth Behavioral Health, Sterling Life Insurance Company, Cigna Health Management, Inc., and HMO or service company subsidiaries of Cigna Health Corporation, Evernorth Care Solutions, Inc., and Cigna Dental Health, Inc. This is the nearest thing in the Notice to a list of the entities behind "we".
Details
Who
Operating subsidiaries of Cigna Corporation
Condition
Products and services provided exclusively by or through these subsidiaries; list is introduced by "including"
Supporting quotations
All Cigna products and services are provided exclusively by or through operating subsidiaries of Cigna Corporation, including
Cigna Health and Life Insurance Company, Connecticut General Life Insurance Company, American Retirement Life Insurance Company, Cigna National Health Insurance Company, Loyal American Life Insurance Company, Evernorth Behavioral Health, Sterling Life Insurance Company, Cigna Health Management, Inc., and HMO or service company subsidiaries of Cigna Health Corporation, Evernorth Care Solutions, Inc., and Cigna Dental Health, Inc.
This Notice is provided by one or more subsidiaries of The Cigna Group that operate as affiliated covered entities under HIPAA (“we”).
Qualifications & exceptions
The list uses "including", so it is not stated to be exhaustive.
Not stated here
The Notice does not say which of these subsidiaries are the "affiliated covered entities" that issue the Notice, or which one holds a given member’s PHI.
The Notice refers to "The Cigna Group" in the body and "Cigna Corporation" in this closing text; it does not explain the relationship between the two names.
Legal Rights & Agreement Rules · Permission or license
Disclosure in judicial and administrative proceedings
The affiliates may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena or other lawful process, but only after they have been assured that efforts have been made to notify you of the request. A separate passage limits use of substance use disorder treatment information that the affiliates receive from a SUD program: it may not be disclosed for use in a civil, criminal, administrative or legislative proceeding against you without your written consent or a court order accompanied by a subpoena or other legal requirement issued after notice to you and an opportunity to be heard.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed in judicial or administrative proceedings
Condition
Court order, subpoena or lawful process; assurance of efforts to notify you
Exception
SUD program information needs written consent or a court order after notice and a chance to be heard
Supporting quotations
We may disclose your PHI in the course of any judicial or administrative proceeding in response to a court order, subpoena or other lawful process, but only after we have been assured that efforts have been made to notify you of the request.
We may not disclose this information so that it can be used in a civil, criminal, administrative, or legislative proceeding against you unless (i) we have your written consent, or (ii) a court order accompanied by a subpoena or other legal requirement compelling disclosure issued after we and you were given notice and an opportunity to be heard.
Qualifications & exceptions
Only in response to a court order, subpoena or other lawful process, and only after assurance that efforts were made to notify you.
Information received from a SUD program has the stricter condition described in the later passage.
Cross-references
has exception (model-proposed): Substance use disorder treatment information — The general rule allows disclosure in judicial and administrative proceedings in response to legal process after notice efforts; information received from a SUD Program has the stricter limit that it cannot be used in a proceeding against you without written consent or a court order after notice and opportunity to be heard.