Group Medicare Notice of Privacy Practices for Anthem Blue Cross and Blue Shield (Group Retiree Solutions)

Sharing & Disclosure · User right or choice

Your state may give extra rights to limit sharing

A member's state may give additional rights to limit how health information is shared. To learn more, the member is told to call the Member Services phone number on their ID card.

Supporting quotations

Your state may give you additional rights to limit sharing your health information. Please call the Member Services phone number on your ID card for more details.

Not stated here

• The notice does not list the additional state rights or which states provide them, apart from the Maine rights stated later in the document.

Sharing & Disclosure · Permission or license

PI can be shared outside the company without approval in some cases

The company may share a member's personal information with others outside the company, in some cases without the member's approval. It says it takes reasonable measures to protect the information.

Supporting quotations

We may also share your PI with others outside our company — without your approval, in some cases. But we take reasonable measures to protect your information.

Qualifications & exceptions

• The permission is limited to "some cases".

Not stated here

• This section does not say which cases allow sharing without approval or who the recipients are; later HIPAA sections list some uses and disclosures.

Cross-references

• qualified by (model-proposed): Opt-out chances are announced when an activity requires them — Sharing outside the company without approval in some cases is qualified by the statement that where an activity requires an opt-out chance, the member will be told and told how to opt out.

Sharing & Disclosure · Company practice

Example: PHI may be shared with your doctor or hospital for treatment

The company may share a member's PHI with the member's doctor or hospital so that they may treat the member.

Supporting quotations

We may share PHI with your doctor or hospital so that they may treat you.

Sharing & Disclosure · Permission or license

Example: PHI may be shared with health information exchanges

The company may use and share PHI directly or indirectly with health information exchanges for payment, healthcare operations and treatment. A member who does not want PHI shared in these situations is directed to the Anthem privacy web page for more information.

Supporting quotations

We may also use and share PHI directly or indirectly with health information exchanges for payment, healthcare operations, and treatment.

If you don’t want your PHI to be shared in these situations, visit www.anthem.com/privacy for more information.

Qualifications & exceptions

• Sharing is stated for payment, healthcare operations and treatment.

Not stated here

• The notice points to a web page for "more information" and does not itself say whether a member can stop this sharing or how.

Sharing & Disclosure · Restriction or exception

Outside treatment, payment, operations or research, written permission is usually needed

In most cases, if the company uses or shares a member's PHI outside of treatment, payment, operations or research activities, it has to get the member's written okay first.

Supporting quotations

In most cases, if we use or share your PHI outside of treatment, payment, operations, or research activities, we have to get your okay in writing first.

Qualifications & exceptions

• "In most cases" means there are exceptions; later sections list other disclosures allowed without permission.

Cross-references

• has exception (model-proposed): If you cannot state a preference, PHI may be shared if in your best interest — Sharing PHI when the member cannot state a preference and the company believes it is in their best interest is a situation where PHI may be shared without the written okay the general rule usually requires.
• has exception (model-proposed): Information may be shared for other reasons, usually for the public good — The listed public-interest purposes are stated as other allowed (or required) ways to share information, so they sit outside the general written-okay rule for non-treatment, payment, operations or research sharing.

Sharing & Disclosure · Restriction or exception

Written permission is required for certain marketing, selling PHI and psychotherapy notes

The company must also get the member's written permission before using PHI for certain marketing activities, selling PHI, or sharing psychotherapy notes from the member's doctor or therapist.

Supporting quotations

We must also get your written permission before:

Using your PHI for certain marketing activities.

Selling your PHI.

Sharing any psychotherapy notes from your doctor or therapist.

Qualifications & exceptions

• Marketing is limited to "certain" activities.

Not stated here

• The text does not say which marketing activities need permission.

Sharing & Disclosure · User right or choice

You can tell the company to share with family or friends and in emergencies

The member has the right and choice to tell the company to share information with family, close friends or others involved with the member's current treatment or payment for care, and to share information in an emergency or disaster relief situation.

Supporting quotations

You have the right and choice to tell us to:

Share information with your family, close friends, or others involved with your current treatment or payment for your care.

Share information in an emergency or disaster relief situation.

Qualifications & exceptions

• Sharing with family or friends is limited to people involved with current treatment or payment for care.

Sharing & Disclosure · Permission or license

If you cannot state a preference, PHI may be shared if in your best interest

If a member cannot state a preference, for example in an emergency or if the member is unconscious, the company may share the member's PHI if it believes doing so is in the member's best interest.

Supporting quotations

If you can’t tell us your preference, for example in an emergency, or if you’re unconscious, we may share your PHI if we believe it’s in your best interest.

Qualifications & exceptions

• Depends on the company's own belief about the member's best interest.

Cross-references

• exception to (model-proposed): Outside treatment, payment, operations or research, written permission is usually needed — Sharing PHI when the member cannot state a preference and the company believes it is in their best interest is a situation where PHI may be shared without the written okay the general rule usually requires.

Sharing & Disclosure · Permission or license

Information may be shared to lessen a serious and likely threat

The company may also share a member's information when needed to lessen a serious and likely threat to the member's health or safety.

Supporting quotations

We may also share your information when needed to lessen a serious and likely threat to your health or safety.

Not stated here

• The sentence does not name who may receive the information.

Sharing & Disclosure · Permission or license

Information may be shared for other reasons, usually for the public good

The company is allowed, and in some cases required, to share information in other ways, usually for the good of the public, such as public health and research. The notice then lists specific purposes.

Supporting quotations

We are allowed, and in some cases required, to share your information in other ways — usually for the good of the public, such as public health and research. We can share your information for these specific purposes:

Qualifications & exceptions

• The sharing is limited to the specific purposes listed; the sentence says "usually" for the public good.

Cross-references

• exception to (model-proposed): Outside treatment, payment, operations or research, written permission is usually needed — The listed public-interest purposes are stated as other allowed (or required) ways to share information, so they sit outside the general written-okay rule for non-treatment, payment, operations or research sharing.

Sharing & Disclosure · Permission or license

Sharing for public health and safety, including reporting suspected abuse

The company may share information to help with public health and safety issues, such as preventing disease, helping with product recalls, reporting adverse reactions to medicines, reporting suspected abuse, neglect or domestic violence, and preventing or reducing a serious threat to anyone's health or safety.

Supporting quotations

Helping with public health and safety issues, such as:

– Preventing disease

– Helping with product recalls

– Reporting adverse reactions to medicines

– Reporting suspected abuse, neglect, or domestic violence

– Preventing or reducing a serious threat to anyone’s health or safety

Qualifications & exceptions

• The items are introduced with "such as", so they are examples.

Not stated here

• The text does not name the agencies or others who receive the information.

Sharing & Disclosure · Permission or license

Information may be shared for health research

The company may share information for doing health research.

Supporting quotations

Doing health research.

Not stated here

• The text states no conditions, such as review or de-identification, for research use here. The earlier permission sentence treats research as outside the written-permission requirement.

Sharing & Disclosure · Permission or license

Information may be shared with organ donation groups

The company may share information in responding to organ donation groups for research and certain reasons.

Supporting quotations

Responding to organ donation groups for research and certain reasons.

Not stated here

• The text does not say what the "certain reasons" are.

Sharing & Disclosure · Permission or license

Information may be shared for workers' compensation, law enforcement and government requests

The company may share information in addressing workers' compensation, law enforcement and other government requests, and to alert proper authorities if it believes the member may be a victim of abuse or other crimes.

Supporting quotations

Addressing workers’ compensation, law enforcement, and other government requests, and to alert proper authorities if we believe you may be a victim of abuse or other crimes.

Qualifications & exceptions

• Alerting authorities depends on the company's own belief that the member may be a victim.

Not stated here

• The text does not say what level of government request or legal process is needed.

Sharing & Disclosure · Permission or license

PHI may be shared with your group health plan when enrolled through an employer

If the member is enrolled through an employer, the company may share PHI with the member's group health plan. If the employer pays the premium or part of it but does not pay the health insurance claims, the employer can only have the PHI for permitted reasons and is required by law to protect it.

Supporting quotations

If you’re enrolled with us through an employer, we may share your PHI with your group health plan.

If the employer pays your premium or part of it, but doesn’t pay your health insurance claims, your employer can only have your PHI for permitted reasons and is required by law to protect it.

Qualifications & exceptions

• Applies to members enrolled through an employer.
• The limit on employer access applies where the employer pays premium but not claims.

Not stated here

• The text does not say what the "permitted reasons" are, or what applies when the employer does pay claims. It also does not say whether a retiree plan sponsor counts as an employer.

Sharing & Disclosure · User right or choice

Right to a list of those with whom your PHI was shared

The member may send a written request for a list of those with whom the company has shared the member's PHI. The company usually provides the list within 60 days and says it will tell the member if it needs more time.

Supporting quotations

Send us a written request to ask us for a list of those with whom we’ve shared your PHI. We will provide you a list usually within 60 days of your request. If we need more time, we will let you know.

Qualifications & exceptions

• The 60-day period is stated as "usually".

Not stated here

• The text does not say which disclosures appear on the list or what period it covers.

Sharing & Disclosure · User right or choice

Right to ask for a restriction on services you pay for yourself

If the member pays in full out of pocket for medical services, the member has the right to ask for a restriction that would prevent use or sharing of that PHI for treatment, payment or operations reasons. If the member or the provider submits a claim to the company, the company may not agree to a restriction. If a law requires sharing the information, the company does not have to agree to a restriction.

Supporting quotations

If you pay in full for any medical services out of your own pocket, you have the right to ask for a restriction. The restriction would prevent the use or sharing of that PHI for treatment, payment, or operations reasons.

If you or your provider submits a claim to us, we may not agree to a restriction (see “Your rights” above).

If a law requires sharing your information, we don’t have to agree to your restriction.

Qualifications & exceptions

• The right is to ask; the company may decline if a claim is submitted by the member or the provider, or if a law requires sharing.

Not stated here

• The parenthetical "see “Your rights” above" does not say which earlier right it points to, and the stored text has no further explanation.

Cross-references

• narrows (model-proposed): Right to ask the company not to use your PHI for treatment, payment or operations — The out-of-pocket restriction is a narrower case of asking to restrict use of PHI for treatment, payment or operations, with its own conditions for when the company need not agree.

Sharing & Disclosure · Restriction or exception

Business partners must protect shared data where the law requires

Where required by law, the company's business partners must protect the privacy of data the company shares with them. They are not allowed to give a member's PHI to others without the member's written permission, unless the law allows it and it is stated in this notice.

Supporting quotations

Also, where required by law, our business partners must protect the privacy of data we share with them as they work with us. They’re not allowed to give your PHI to others without your written permission, unless the law allows it and it’s stated in this notice.

Qualifications & exceptions

• The duty applies "where required by law".

Not stated here

• The text does not say who the business partners are.

Sharing & Disclosure · Restriction or exception

Substance use disorder information has its own consent rules under 42 CFR Part 2

As an example of other laws, the notice mentions Substance Use Disorder (SUD) information the company may receive from providers or programs regulated by federal law (42 CFR Part 2). All disclosures of that information must comply with applicable federal and state privacy laws, including 42 CFR Part 2. The company may use and disclose SUD information for certain treatment, payment and health care operations activities. The member has the right to consent to disclosure of SUD information in certain circumstances and can revoke that consent in writing at any time.

Supporting quotations

One example is with Substance Use Disorder (SUD) information we may receive from Providers or programs regulated by federal law (42 CFR Part 2). All disclosures of such SUD information must comply with applicable Federal and State privacy laws, including 42 CFR Part 2.

We are allowed to Use and Disclose SUD information for certain Treatment, Payment, and Health Care Operations activities. You have the right to consent to the disclosure of SUD information in certain circumstances. You can revoke this consent in writing at any time.

Qualifications & exceptions

• Use and disclosure is allowed only for "certain" treatment, payment and operations activities, and the consent right applies "in certain circumstances".

Not stated here

• The cited federal regulation is not part of the supplied text, and the notice does not say which activities or circumstances are meant.

Cross-references

• narrows (model-proposed): State or federal laws that give more protection are followed in addition to HIPAA — The SUD passage is given as one example of the general rule that other privacy laws are followed in addition to HIPAA.