Blue Cross and Blue Shield of Texas

HIPAA NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Our Responsibilities

We are required by applicable federal and state law to maintain the privacy of your protected health information. "Protected health information" (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your PHI. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect April 14, 2003, and will remain in effect until we replace it. We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all PHI that we maintain, including PHI we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and make the new notice available upon request. For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Uses and Disclosures of Protected Health Information

We use and disclose PHI about you for treatment, payment, and health care operations. Following are examples of the types of uses and disclosures that we are permitted to make.

Treatment: We may use or disclose your PHI to a physician or other health care provider providing treatment to you. We may use or disclose your PHI to a health care provider so that we can make prior authorization decisions under your benefit plan.

Payment: We may use and disclose your PHI to make benefit payments for the health care services provided to you. We may disclose your PHI to another health plan, to a health care provider, or other entity subject to the federal Privacy Rules for their payment purposes. Payment activities may include processing claims, determining eligibility or coverage for claims, issuing premium billings, reviewing services for medical necessity, and performing utilization review of claims.

Health Care Operations: We may use and disclose your PHI in connection with our health care operations. Health care operations include the business functions conducted by a health insurer. These activities may include providing customer services, responding to complaints and appeals from members, providing case management and care coordination under the benefit plans, conducting medical review of claims and other quality assessment and improvement activities, establishing premium rates and underwriting rules. In certain instances, we may also provide PHI to the plan sponsor of a group health plan. We may also in our health care operations disclose PHI to business associates1 with whom we have written agreements containing terms to protect the privacy of your PHI. We may disclose your PHI to another entity that is subject to the federal Privacy Rules and that has a relationship with you for its health care operations relating to quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, case management and care coordination, or detecting or preventing healthcare fraud and abuse.

On Your Authorization: You may give us written authorization to use your PHI or to disclose it to another person and for the purpose you designate. If you give us an authorization, you may withdraw it in writing at any time. Your withdrawal will not affect any use or disclosures permitted by your authorization while it was in effect. Unless you give us a written authorization, we cannot use or disclose your PHI for any reason except those described in this notice. We will make disclosures of any psychotherapy notes we may have only if you provide us with a specific written authorization or when disclosure is required by law.

Personal Representatives: We will disclose your PHI to your personal representative when the personal representative has been properly designated by you and the existence of your personal representative is documented to us in writing through a written authorization.

Disaster Relief: We may use or disclose your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.

Health Related Services: We may use your PHI to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you. We may disclose your PHI to a business associate to assist us in these activities. We may use or disclose your PHI to encourage you to purchase or use a product or service by face-to-face communication or to provide you with promotional gifts.

Public Benefit: We may use or disclose your PHI as authorized by law for the following purposes deemed to be in the public interest or benefit:

• as required by law;
  
• for public health activities, including disease and vital statistic reporting, child abuse reporting, certain Food and Drug Administration (FDA) oversight purposes with respect to an FDA-regulated product or activity, and to employers regarding work-related illness or injury required under the Occupational Safety and Health Act (OSHA) or other similar laws;
  
• to report adult abuse, neglect, or domestic violence;
  
• to health oversight agencies;
  
• in response to court and administrative orders and other lawful processes;
  
• to law enforcement officials pursuant to subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on our premises, reporting crimes in emergencies, and for purposes of identifying or locating a suspect or other person;
  
• to avert a serious threat to health or safety;
  
• to the military and to federal officials for lawful intelligence, counterintelligence, and national security activities;
  
• to correctional institutions regarding inmates; and
  
• as authorized by and to the extent necessary to comply with state worker's compensation laws.

We will make disclosures for the following public interest purposes, only if you provide us with a written authorization or when disclosure is required by law:

• to coroners, medical examiners, and funeral directors;
  
• to an organ procurement organization; and
  
• in connection with certain research activities.

Use and Disclosure of Certain Types of Medical Information. For certain types of PHI we may be required to protect your privacy in ways more strict than we have discussed in this notice. We must abide by the following rules for our use or disclosure of certain types of your PHI:

• Communicable Disease Test Results. We may not disclose the result of any communicable disease test, unless the disclosure is required by law or the disclosure is to you, your personal representative, a physician or other person who ordered the test, or a health care worker who has a legitimate need to know the results of the test for safety purposes, or pursuant to an authorization signed by you.
  
• HIV Test Results. We may not disclose the result of any HIV test unless required by law or the disclosure is to you, your personal representative, a physician or other person who ordered the test, or a health care worker who has a legitimate need to know the results of the test for safety purposes; or pursuant to an authorization signed by you providing us permission to disclose to an insurance medical information exchange, a reinsurer, or to our attorneys.
  
• Genetic Information. We may not disclose genetic information unless the disclosure is authorized under state or federal criminal law and the disclosure relates to identifying an individual in the course of a criminal or judicial proceeding; is required under specific order of a state or federal court; is authorized under state or federal law to establish paternity; is made to a blood relative of a decedent for purposes of medical diagnosis; or is made to identify a decedent.
  
• Status as Victim of Family Violence. We may not disclose your status as a victim of family violence unless the disclosure is to you; to a physician or health care provider for the provision of health care services; to a licensed physician designated by you; as required by law or pursuant to an order of the Texas Insurance Commissioner or a court order; to our attorneys; or when necessary for our payment and healthcare operations if to a reinsurer, a party to a sale of all or part of our business or to medical and claims personnel we contract with, providing we cannot without undue hardship first segregate the medical information in a way that does not disclose your status as a victim of family violence.
  
• Mental Health Information. We may not disclose your mental health information except for the same purposes for which we received the information or as may be required by law.
  
• Confidential Communications from a Physician. We may not disclose confidential information about you that we receive from a physician for any purpose other than for which we received the information or as may be required by law.
  
• Medical Information Maintained by Our HMO. Your medical information that is maintained by our HMO may only be disclosed for the HMO's payment and health care operations purposes or as allowed by Texas law pertaining to HMOs.
  
• Medical Information We Receive While Performing Utilization Review. If we collect or receive your medical information while performing utilization review activities, we may not disclose that information unless the disclosure is required by law or to an individual or entity that we have contracted with to aide us in performing utilization review.

Individual Rights

You may contact us using the information at the end of this notice to obtain the forms described here, explanations on how to submit a request, or other additional information.

Access: You have the right, with limited exceptions, to look at or get copies of your PHI contained in a designated record set. A "designated record set" contains records we maintain such as enrollment, claims processing, and case management records. You may request that we provide copies in a format other than photocopies. We will use the format you request unless we cannot practicably do so. You must make a request in writing to obtain access to your PHI and may obtain a request form from us. If we deny your request, we will provide you a written explanation and will tell you if the reasons for the denial can be reviewed and how to ask for such a review or if the denial cannot be reviewed.

Disclosure Accounting: You have the right to receive a list of instances since April 14, 2003 in which we or our business associates disclosed your PHI for purposes, other than treatment, payment, health care operations, or as authorized by you, and for certain other activities. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests. We will provide you with more information on our fee structure at your request.

Restriction: You have the right to request that we place additional restrictions on our use or disclosure of your PHI. We are not required to agree to these additional restrictions, but if we do, we will abide by our agreement (except in an emergency). Any agreement we may make to a request for additional restrictions must be in writing signed by a person authorized to make such an agreement on our behalf. We will not be bound unless our agreement is in writing.

Confidential Communication: You have the right to request that we communicate with you about your PHI by alternative means or to alternative locations. You must make your request in writing. This right only applies if the information could endanger you if it is not communicated by the alternative means or to the alternative location you want. You do not have to explain the basis for your request, but you must state that the information could endanger you if the communication means or location is not changed. We must accommodate your request if it is reasonable, specifies the alternative means or location, and provides satisfactory explanation how payments will be handled under the alternative means or location you request.

Amendment: You have the right, with limited exceptions, to request that we amend your PHI. Your request must be in writing, and it must explain why the information should be amended. We may deny your request if we did not create the information you want amended and the originator remains available or for certain other reasons. If we deny your request, we will provide you a written explanation. You may respond with a statement of disagreement to be attached to the information you wanted amended. If we accept your request to amend the information, we will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of that information.

Right to Receive a Copy of the Notice: You may request a copy of our notice at any time by contacting the Privacy Office or by using our Web site, www.bcbstx.com. If you receive this notice on our web site or by electronic mail (e-mail), you are also entitled to request a paper copy of the notice.

Questions and Complaints

If you want more information about our privacy practices or have questions or concerns, please contact us using the information listed at the end of this notice. If you are concerned that we may have violated your privacy rights, you may complain to us using the contact information listed at the end of this notice. You also may submit a written complaint to the U.S. Department of Health and Human Services; see information at its Web site: www.hhs.gov. If you request, we will provide you with the address to file your complaint with the U.S. Department of Health and Human Services. We support your right to the privacy of your PHI. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.