Source: http://www.dusd.net/h-i-p-a-a/
Timestamp: 2019-04-24 18:22:16+00:00

Document:
Background: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires health plans to notify plan participants and beneficiaries about its policies and practices to protect the confidentiality of their health information. This document is intended to satisfy HIPAA’s notice requirement with respect to all health information created, received, or maintained by the Downey Unified School District group health plan (referred to as the “Plan”), as sponsored by Downey Unified School District (referred to as the “Company”). For a complete listing of contracted third party administrators of the District’s self-funded plans and contact information for fully insured plans (all of which are included in the Plan), see Attachment “A”.
For Payment. The Plan may use and disclose your PHI so claims for health care treatment, services, and supplies you receive from health care providers may be paid according to the Plan’s terms. For example, the Plan may receive and maintain information about a surgery you received to enable the Plan to process a hospital’s claim for reimbursement of surgical expenses incurred on your behalf.
For Health Care Operations. The Plan may use and disclose your PHI to enable it to operate or operate more efficiently or make certain all of the Plan’s participants receive their health benefits. For example, the Plan may use your PHI for case management or to perform population-based studies designed to reduce health care costs. In addition, the Plan may use or disclose your PHI to conduct compliance reviews, audits, actuarial studies, and/or for fraud and abuse detection. The Plan may also combine health information about many Plan participants and disclose it to the Company in summary fashion so it can decide what coverages the Plan should provide. The Plan may remove information that identifies you from health information disclosed to the Company so it may be used without the Company learning who the specific participants are.
To the Company. The Plan may disclose your PHI to designated Company personnel so they can carry out their Plan-related administrative functions, including the uses and disclosures described in this notice. Such disclosures will be made only to the Company’s Assistant Superintendent, Administrative Services (“the Plan Administrator”) and/or the members of the Company’s Benefits Department. These individuals will protect the privacy of your health information and ensure it is used only as described in this notice or as permitted by law. Unless authorized by you in writing, your health information: (1) may not be disclosed by the Plan to any other Company employee or department and (2) will not be used by the Company for any employment-related actions and decisions or in connection with any other employee benefit plan sponsored by the Company.
To a Business Associate. Certain services are provided to the Plan by third party administrators known as “business associates.” For example, the Plan may input information about your health care treatment into an electronic claims processing system maintained by the Plan’s business associate so your claim may be paid. In so doing, the Plan will disclose your PHI to its business associate so it can perform its claims payment function. However, the Plan will require its business associates, through contract, to appropriately safeguard your health information. See Attachment “A” for a listing of the Company’s business associates.
Treatment Alternatives. The Plan may use and disclose your PHI to tell you about possible treatment options or alternatives that may be of interest to you, provided you have signed an Authorization to Disclose form.
Workers’ Compensation. The Plan may disclose your PHI to the extent authorized by and to the extent necessary to comply with workers’ compensation laws and other similar programs.
Employee Request for Assistance. The Company’s Plan Administrator and/or other designated personnel are unable to discuss personal health related issues in any manner with the employee or the employee’s representative or family member, without the signed consent of the employee by means of the Authorization to Disclose form, which is available in the Classified and Certificated Personnel Offices.
Coroners, Medical Examiners, and Funerals Directors. The Plan may release your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. The Plan may also release your PHI to a funeral director, as necessary, to carry out his/her duty.
To inspect and copy health information maintained by the Plan (which includes enrollment documents only), submit your request in writing to the Plan Administrator. The Plan may charge a fee for the cost of copying and/or mailing your request. In limited circumstances, the Plan may deny your request to inspect and copy your PHI. Generally, if you are denied access to health information, you may request a review of the denial. For PHI, other than enrollment documents, submit your request according to your specific health plan provider’s policy procedure.
To request an amendment, send a detailed request in writing to the Plan Administrator. You must provide the reason(s) to support your request. The Plan may deny your request if you ask the Plan to amend health information that was: accurate and complete, not created by the Plan; not part of the health information kept by or for the Plan; or not information that you would be permitted to inspect and copy. For amendments to health information, other than enrollment documents, submit your request to your specific plan provider according to their policy procedure.
Right to An Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of disclosures of your PHI that the Plan has made to others, except for those necessary to carry out health care treatment, payment, or operations; disclosures made to you; or in certain other situations.
Right to Request Restrictions. You have the right to request a restriction on the health information the Plan uses or disclosures about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information the Plan discloses about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that the Plan not use or disclose information about a surgery you had.To request restrictions, make your request in writing to the Plan Administrator. You must advise us: (1) what information you want to limit; (2) whether you want to limit the Plan’s use, disclosure, or both; and (3) to whom you want the limit(s) to apply.Note: The Plan is not required to agree to your request.
Right to Request Confidential Communications. You have the right to request that the Plan communicate with you about health matters in a certain way or at a certain location. For example, you can ask that the Plan send you explanation of benefits (EOB) forms about your benefit claims to a specified address. All communications from your specific plan provider will be sent to you at the address listed on your enrollment form. Change of address forms are available in the Classified and Certificated Personnel Offices and will be forwarded to the plan provider on your behalf.
To request any other confidential communications, make your request in writing to the Plan Administrator. The Plan will make every attempt to accommodate all reasonable requests.
Right to a Paper Copy of this Notice. You have the right to a paper copy of this notice. Paper copies are available in the Classified and Certificated Personnel Offices, and will be provided to new employees during plan enrollment. A paper copy can also be obtained by printing a copy from the District’s Web Site (listed below).
Changes to this Notice The Plan reserves the right to change this notice at any time and to make the revised or changed notice effective for health information the Plan already has about you, as well as any information the Plan receives in the future. The Plan will post a copy of the current notice on the District’s Web Site (http://www.dusd.net) and in the Classified and Certificated Personnel Offices at all times.
Complaints If you believe your privacy rights under this policy have been violated, you may file a written complaint with the Plan Administrator at the address listed on page 5. Alternatively, you may complain to the Secretary of the U.S. Department of Health and Human Services, generally, within 180 days of when the act or omission complained of occurred.Note: You will not be penalized or retaliated against for filing a complaint.
(1) Definitions. Whenever used in this Summary, the following terms shall have the respective meanings set forth below.
(a) Plan—means the group health plan, including all Employer sponsored medical, dental, vision and life insurance programs.
(b) Employer—means the Downey Unified School District, which is the plan sponsor of the Plan as defined in ERISA §3(16)(B).
(c) Plan Administration Functions—means administrative functions performed by the Employer on behalf of the Plan, excluding functions performed by the Employer in connection with any other benefit or benefit plan of the Employer.
(d) Health Information—means information (whether oral or recorded in any form or medium) that is created or received by a health care provider, health plan (as defined in 45 CFR §160.103), employer, life insurer, school or university, or health care clearinghouse (as defined in 45 CFR §160.103) that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
(e) Individually Identifiable Health Information—means Health Information, including demographic information, collected from an individual and created or received by a health care provider, health plan, employer, or health care clearinghouse that identifies the individual involved or with respect to which there is a reasonable basis to believe the information may be used to identify the individual involved.
(6) any information the Employer does not have knowledge of that could be used alone or in combination with other information to identify an individual.
(g) Protected Health Information (“PHI”)—means Individually Identifiable Health Information that is transmitted or maintained electronically, or any other form or medium.
(2) The Plan may disclose Summary Health Information to the Employer if the Employer requests such information for the purpose of obtaining premium bids for providing health insurance coverage under the Plan or for modifying, amending, or terminating the Plan.
(3) The Plan will disclose PHI to the Employer only in accordance with 45 CFR §164.504(f) and the provisions of this Section.
(5) The Plan hereby incorporates the following provisions (a) through (j) to enable it to disclose PHI to the Employer and acknowledges receipt of written certification from the Employer that the Plan has been so amended.
(i) if feasible, to return or destroy all PHI received from the Plan that the Employer maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, the Employer will limit further its uses and disclosures of the PHI to those purposes that make the return or destruction of the information infeasible.
(j) to ensure that adequate separation between the Plan and the Employer, as required by 45 CFR §164.504(f), is established and maintained.
Access to and use of PHI by the individuals described above shall be restricted to Plan Administration Functions that the Employer performs for the Plan. Such access or use shall be permitted only to the extent necessary for these individuals to perform their respective duties for the Plan.
Persons serving in the capacity of the positions listed in Section (6), shall be required to attend training on the regulations and the proper handling of PHI.
Employees found negligent in their handling of PHI will be subject to disciplinary action as outlined in Personnel Commission Rules and Regulations and the California Education Code, and may include removing the offending employee from the select group with access to PHI.
(8) A health insurance issuer or HMO providing services to the Plan is not permitted to disclose PHI to the Employer except as would be permitted by the Plan in this HIPAA Plan Language Summary and only if a notice is maintained and provided as required by 45 CFR §164.520.

References: §3
 §160
 §160
 §164
 §164
 §164