The affiliates may disclose your PHI, as required by law, in response to a subpoena, warrant, summons or other appropriate process. In some circumstances they may also disclose PHI to assist law enforcement with identification of relevant individuals, provide information about crime victims, provide information about decedents, and report a crime.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed to law enforcement
Condition
As required by law in response to legal process; other disclosures only "in some circumstances"
Supporting quotations
We may disclose your PHI, as required by law, in response to a subpoena, warrant, summons or other appropriate process.
In some circumstances, we may also disclose PHI to assist law enforcement with identification of relevant individuals, provide information about crime victims, provide information to law enforcement about decedents, and report a crime.
Qualifications & exceptions
The first sentence is tied to what the law requires and to legal process; the second sentence covers additional disclosures "in some circumstances" without naming the conditions.
Not stated here
The circumstances in which PHI is disclosed to help identify individuals, about crime victims or decedents, or to report a crime are not described.
Sharing & Disclosure · Permission or license
Coroners, organ donation and workers’ compensation disclosures
The affiliates may disclose your PHI to a coroner or medical examiner to determine cause of death or other duties authorized by law; to organizations involved in organ transplantation to facilitate donation and transplantation; and to comply with workers’ compensation laws and other similar programs.
Details
Who
The Cigna affiliates ("we")
Why
Determine cause of death; facilitate organ donation and transplantation; comply with workers’ compensation and similar programs
Supporting quotations
We may disclose your PHI to a coroner or a medical examiner for the purpose of determining cause of death or other duties authorized by law.
We may disclose your PHI to organizations involved in organ transplantation to facilitate donation and transplantation.
We may disclose your PHI to comply with workers’ compensation laws and other similar programs.
Sharing & Disclosure · Permission or license
National security, military and correctional disclosures
The affiliates may disclose your PHI to authorized federal officials for intelligence, counterintelligence, medical suitability determinations, Presidential protection activities and other national security activities authorized by law. If you are a member of the U.S. Armed Forces or a foreign military, they may disclose PHI as required by military command authorities or law. If you are an inmate in a correctional institution or in the custody of a law enforcement official, they may disclose PHI to those parties if disclosure is necessary for your health care, maintaining the health or safety of yourself or other inmates, or ensuring the safety and security of the institution or its agents.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed to federal officials, military command authorities, or correctional/law enforcement custodians
Condition
Authorized by law; for inmates, only if necessary for the listed purposes
Supporting quotations
We may disclose your PHI to authorized federal officials to perform intelligence, counterintelligence, medical suitability determinations, Presidential protection activities and other national security activities authorized by law.
If you are a member of the U.S. Armed Forces or of a foreign military, we may disclose your PHI as required by military command authorities or law.
If you are an inmate in a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to those parties if disclosure is necessary for: the provision of your health care, maintaining the health or safety of yourself or other inmates, or ensuring the safety and security of the correctional institution or its agents.
Qualifications & exceptions
Military disclosures are as required by military command authorities or law.
Correctional disclosures apply only if necessary for one of the listed purposes.
Sharing & Disclosure · Permission or license
Health oversight agencies
The affiliates may disclose PHI to a health oversight agency performing activities authorized by law, such as investigations and audits. These agencies include governmental agencies that oversee the health care system, government benefit programs, and organizations subject to government regulation and civil rights laws.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed to health oversight agencies
Condition
Agency performing activities authorized by law
Supporting quotations
We may disclose PHI to a health oversight agency performing activities authorized by law, such as investigations and audits.
These agencies include governmental agencies that oversee the health care system, government benefit programs, and organizations subject to government regulation and civil rights laws.
Sharing & Disclosure · Permission or license
Averting a serious threat to health or safety
The affiliates may disclose your PHI to prevent or lessen an imminent threat to the health or safety of another person or the public. The disclosure will only be made to someone in a position to prevent or lessen the threat.
Details
Who
The Cigna affiliates ("we")
Why
Prevent or lessen an imminent threat to health or safety
Condition
Only to someone able to prevent or lessen the threat
Supporting quotations
We may disclose your PHI to prevent or lessen an imminent threat to the health or safety of another person or the public.
Such disclosure will only be made to someone in a position to prevent or lessen the threat.
Qualifications & exceptions
Requires an imminent threat; recipient must be in a position to prevent or lessen it.
The Notice includes a statement written in the first person ("I understand") that once PHI is disclosed it may no longer be protected by HIPAA and may be subject to re-disclosure. Because it is written from the individual’s perspective and sits at the end of the SUD passage, the text does not say whether it is meant to apply to all disclosures or only SUD information.
Details
What it covers
PHI after it is disclosed
Condition
May no longer be protected by HIPAA and may be re-disclosed
Supporting quotations
Redisclosure – I understand that once my PHI is disclosed it may be no longer be protected by the Health Insurance Portability and Accountability Act (HIPAA) and may be subject to re-disclosure.
Qualifications & exceptions
Says protection "may" be lost, not that it always is.
Not stated here
Whether this statement applies to all PHI or only to SUD information is not clear from the text.
The first-person wording suggests it may have been drawn from a consent form; the Notice does not say.
Treatment: sharing PHI with health care professionals and third parties
The affiliates may use and disclose your PHI to health care professionals or other third parties to provide, coordinate and manage the delivery of health care. The examples given are ordering lab tests and using results, and disclosing PHI about you to your doctor to coordinate the prescribing and delivery of your drugs. They may also send treatment reminders and information about potential side effects, drug interactions and other treatment-related issues involving your medicine.
Details
Who
The Cigna affiliates ("we")
What it does
Use and disclose PHI
What it covers
Your PHI, to health care professionals or other third parties
Why
Provide, coordinate and manage health care; treatment reminders and medicine information
Supporting quotations
How We May Use PHI Without Your Authorization
We may use and disclose your PHI to health care professionals or other third parties to provide, coordinate and manage the delivery of health care.
We also may provide you with treatment reminders and information about potential side effects, drug interactions and other treatment-related issues involving your medicine.
Qualifications & exceptions
Described as a use and disclosure that does not need your authorization (listed under "How We May Use PHI Without Your Authorization").
Not stated here
The source sentence giving the lab-test and pharmacist examples is grammatically garbled; this summary follows its evident meaning that PHI may be disclosed to your doctor to coordinate prescribing and delivery of drugs.
Sharing & Disclosure · Permission or license
Disclosures to your employer as health plan sponsor
Where permitted by law, the affiliates may disclose your PHI to your employer or to a company acting on your employer’s behalf so that entity can monitor, audit and otherwise administer the employee health plan in which you participate. The Notice says your employer is not permitted to use the PHI for any purpose other than administration of your benefits. It tells you to see your employer’s health plan documents to learn whether your employer receives PHI and which employees are authorized to receive it.
Details
Who
The Cigna affiliates ("we")
What it covers
Your PHI, disclosed to your employer or a company acting for it
Why
Monitor, audit and administer the employee health plan
Condition
Where permitted by law; employer may use it only to administer your benefits
Supporting quotations
Where permitted by law, we may disclose your PHI to your employer or to a company acting on your employer’s behalf, so that entity can monitor, audit and otherwise administer the employee health plan in which you participate.
Your employer is not permitted to use the PHI we disclose for any purpose other than administration of your benefits.
See your employer’s health plan documents for information on whether your employer receives PHI and, if so, the identity of the employees who are authorized to receive your PHI.
Qualifications & exceptions
Only "where permitted by law".
Employer use is limited to administration of your benefits.
Not stated here
Whether your own employer actually receives PHI, and which employees may receive it, is not stated; the Notice refers you to your employer’s health plan documents.
Disclosures to people involved in your care or payment
The affiliates may disclose PHI about you to someone who assists in or pays for your care. Unless you write to them and specifically tell them not to, they may disclose your PHI to someone who has your permission to act on your behalf, and they will require that person to provide adequate proof of that permission.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed to someone who assists in or pays for your care, or has your permission to act for you
Condition
Unless you write to us and specifically tell us not to; recipient must give adequate proof of permission
Supporting quotations
We may disclose PHI about you to someone who assists in or pays for your care.
Unless you write to us and specifically tell us not to, we may disclose your PHI to someone who has your permission to act on your behalf.
We will require this person to provide adequate proof that he or she has your permission.
Qualifications & exceptions
Your way to stop disclosure to someone acting on your behalf is a written instruction.
The recipient must give adequate proof of your permission.
Sharing & Disclosure · Permission or license
Release of a minor’s or ward’s PHI to parents or guardians
If you are a minor or under a legal guardianship, the affiliates may release your PHI to your parents or legal guardians when they are permitted or required to do so under federal and applicable state law.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI of a minor or person under guardianship, released to parents or legal guardians
Condition
Permitted or required under federal and applicable state law
Where
Federal law and applicable state law
Supporting quotations
If you are a minor or under a legal guardianship, we may release your PHI to your parents or legal guardians when we are permitted or required to do so under federal and applicable state law.
Qualifications & exceptions
Only when permitted or required by federal and applicable state law.
Sharing & Disclosure · Permission or license
Business associates and their vendors
The affiliates arrange some services through contracts with business associates and may disclose your PHI to business associates acting on their behalf. The Notice says business associates are required by law and contract to protect the information, and that PHI is protected using confidentiality agreements. If a business associate uses vendors, the business associate must enter into a confidentiality agreement with the vendor.
Details
Who
The Cigna affiliates ("we")
What it covers
Your PHI, disclosed to business associates and their vendors
Condition
Business associates are bound by law and contract; vendors must sign a confidentiality agreement
Supporting quotations
We may disclose your PHI to business associates acting on our behalf.
Business Associates are required by law and contract to protect the privacy of sensitive information.
Our business associates may, in turn, use vendors to assist them in providing services to us. If so, the business associates must enter into a confidentiality agreement with the vendor, which protects your information from unauthorized use and disclosure.
Qualifications & exceptions
Disclosure is to business associates "acting on our behalf".
Vendors of business associates must also sign a confidentiality agreement.
Not stated here
The Notice does not name business associates or vendors or say what services they perform beyond helping the affiliates "operate more efficiently".
Sharing & Disclosure · Company practice
Aggregate data may be studied, sold or disclosed
In some circumstances the affiliates may use your PHI to generate aggregate data (summarized data that does not identify you) to study outcomes, costs and provider profiles, and to suggest benefit designs for your employer or health plan. The Notice states that these studies generate aggregate data that the affiliates may sell or disclose to other companies or organizations, and that aggregate data does not personally identify you.
Details
Who
The Cigna affiliates ("we")
What it does
Generate aggregate data from PHI; may sell or disclose it
What it covers
Aggregate (summarized) data that does not identify you
Why
Study outcomes, costs and provider profiles; suggest benefit designs
Supporting quotations
In some circumstances, we may use your PHI to generate aggregate data (summarized data that does not identify you) to study outcomes, costs and provider profiles, and to suggest benefit designs for your employer or health plan.
These studies generate aggregate data that we may sell or disclose to other companies or organizations.
Aggregate data does not personally identify you.
Qualifications & exceptions
Applies to aggregate data, which the Notice describes as not personally identifying you.
Described as occurring "in some circumstances".
Not stated here
Recipients of sold or disclosed aggregate data are not identified, and the method of aggregation is not described.
Cross-references
contrast (model-proposed): Uses that require your authorization — One passage says disclosures that constitute a sale of PHI require authorization; another says aggregate data (described as not identifying you) may be sold or disclosed to other companies. The Notice does not say whether aggregate data counts as PHI, so the two are shown side by side rather than reconciled.
Reporting suspected abuse, neglect or domestic violence
The affiliates may disclose your PHI to a social service, protective agency or other government authority if they believe you are a victim of abuse, neglect or domestic violence. They will inform you of the disclosure unless informing you would place you at risk of serious harm.
Details
Who
The Cigna affiliates ("we")
What it covers
PHI disclosed to a social service, protective agency or government authority
Condition
Belief that you are a victim; notice to you unless it risks serious harm
Supporting quotations
We may disclose your PHI to a social service, protective agency or other government authority if we believe you are a victim of abuse, neglect or domestic violence. We will inform you of our disclosure unless informing you would place you at risk of serious harm.
Qualifications & exceptions
Requires a belief that you are a victim.
You are told unless that would put you at risk of serious harm.
Public health disclosures, including payment received
The affiliates may disclose your PHI for public health activities and purposes, such as regulatory reporting (for example reporting adverse events, vaccination efforts to avert the spread of communicable diseases) or post-marketing surveillance in connection with FDA-mandates or product recalls. The Notice also states that they may receive payment from a third party for making disclosures for public health activities and purposes.
Details
Who
The Cigna affiliates ("we")
Why
Public health activities: regulatory reporting, post-marketing surveillance
What it covers
Payment received from a third party for these disclosures
Supporting quotations
We may disclose your PHI for public health activities and purposes, such as regulatory reporting (e.g., reporting adverse events, vaccination efforts to avert the spread of communicable diseases) or for post-marketing surveillance in connection with FDA-mandates or product recalls.
We may receive payment from a third party for making disclosures for public health activities and purposes.
Qualifications & exceptions
Examples are introduced with "such as" and are not an exhaustive list.
Not stated here
The third parties that might pay, and the amounts or conditions of payment, are not stated.