Lewis & Clark Community College

Lewis & Clark Community College Employee Health Plan

Lewis & Clark Community College ("L&C") continues its commitment to maintaining the confidentiality of your private medical information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or disclosure. This Notice only applies to health-related information received by or on behalf of the group health plans sponsored by L&C, including the plans offering medical, dental and vision benefits, and the Employee Assistance Program ("EAP") (collectively the "Health Plan"). A new federal law, the Health Insurance Portability and Accountability Act ("HIPAA"), requires us to provide you with a summary of the Health Plan’s privacy practices and related legal duties, and your rights in connection with the use and disclosure of your health information.

This Notice applies to L&C employees, former employees, and dependents who participate in the Health Plan, including the EAP.

Please note: This Notice does not apply to an HMO or fully insured medical, vision, dental, or prescription drug benefit options. If you are enrolled in an HMO or fully insured program, you will receive a separate notice from your HMO or insurance provider. However, this Notice applies to the extent any protected health information or "PHI" from an HMO or insurer offering benefits under a Heath Plan is disclosed to the Health Plan.

In this Notice, the terms "we," "us," and "our" refer to the Health Plan, all L&C employees involved in the administration of the Health Plan, and all third parties who perform services for the Health Plan.

CONTACT INFORMATION If you have any questions regarding this Notice, please contact:

Lewis and Clark Community College Human Resources Department

Attn: HIPAA Privacy Officer 5800 Godfrey Road Godfrey, Illinois 62035-2466 (618) 468-3000

Or

HIPAA requires the Health Plan to have a special policy for safeguarding PHI received or created in the course of administering the Health Plan. PHI is health information that can be used to identify you and that relates to:

- your physical or mental health condition, - the provision of health care to you, or - payment for your health care.

Your participant intake form in connection with benefits under the EAP is an example of PHI. Employment records maintained by L&C in its capacity as employer are not PHI.

If L&C obtains your health information in another way – for example, if you are hurt in a work accident or if you provide medical records with your request for Family and Medical Leave Act (FMLA) absence, then L&C will safeguard that information in accordance with the applicable laws. Similarly, health information obtained by a non-health-related benefits program, such as a long-term disability program is not protected under this Notice. This Notice does not apply in those types of situations because the health information is not received or created in connection with the Health Plan.

The remainder of this Notice generally describes our rules with respect to your PHI received or created by the Health Plan.

To protect the privacy of your PHI, the Health Plan not only guards the physical security of your PHI, but we also limit the way your PHI is used or disclosed to others. We may use or disclose your PHI in certain permissible ways described below. To the extent required under HIPAA, we will use the minimum amount of your PHI necessary to perform these tasks:

The Health Plan may use and disclose your PHI for treatment, payment and health care operations as described in HIPAA.

1. • Treatment. We may use or disclose your PHI so that you may be provided with health care and related services. For example, we may disclose to a specialist the name of your primary care physician so that the specialist may request medical records from your primary care physician

   • Payment. We may use or disclose your PHI to reimburse you or your health care provider for covered treatments and services. We may also use or disclose PHI to obtain reimbursement from a stop-loss carrier or to fulfill our responsibilities for providing benefits. For example, we may disclose your PHI to a provider requesting information as to your eligibility for coverage under the Health Plan.

1. • Health Care Operations. We may use or disclose your PHI for various administrative and quality control functions necessary for the Health Plan’s proper operation. Health care operations include, but are not limited to, quality assessment and improvement, reviewing provider performance, licensing, stop-loss underwriting, business planning and business development.

    

The Health Plan contracts with third party service providers ("business associates") to perform various functions on behalf of the Health Plan. To perform these functions, our business associates may receive, create, maintain, use or disclose PHI, but only after we require the business associate to agree in writing to safeguard your PHI. For example, we may disclose PHI to a business associate so that the business associate may administer claims.

We may use or disclose your PHI to assist health care providers in connection with their treatment or payment activities. For example, we may disclose your PHI to a health care provider when needed by the provider to render treatment to you, or we may exchange your PHI with another covered entity for coordination of benefits purposes. We may also share your PHI with another health plan or health care provider who has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide services to you, or for fraud and abuse detection and prevention purposes.

We may disclose your PHI to the plan sponsor (i.e., L&C) for purposes of plan administration or pursuant to an authorization signed by you. We may also disclose "summary health information" to the plan sponsor so that the plan sponsor may obtain premium bids or modify, amend or terminate a group health plan. Summary health information summarizes the claims history, claims expenses or types of claims experienced by individuals under a group health plan and from which identifying information has been deleted.

To a family member, friend, or other person involved in your health care if you do not object (or if it can be inferred that you do not object) to the sharing of your PHI, or if you are not present or unable to object due to incapacity or emergency, and the disclosure is in your best interests. Only PHI that we determine is directly relevant to the person’s involvement with your health care or payment for health care will be disclosed. Your PHI may be shared with your personal representative. For children, a parent is usually a personal representative.

To comply with an applicable federal, state, or local law, including workers’ compensation or similar programs.

For public health reasons, including (1) to a public health authority for the prevention or control of disease, injury or disability; (2) to a proper government or health authority to report child abuse or neglect; (3) to report reactions to medications or problems with products regulated by the Food and Drug Administration; (4) to notify individuals of recalls of medication or products they may be using; or (5) to notify a

person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition.

To report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.

To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services.

To the U.S. Department of Health and Human Services to demonstrate our compliance with federal health information privacy law.

To respond to an order of a court or administrative tribunal.

To respond to a subpoena, warrant, summons or other legal request if sufficient safeguards, such as a protective order, are in place to maintain your PHI privacy.

To a law enforcement official for a law enforcement purpose.

For purposes of public safety or national security.

To allow a coroner or medical examiner to identify you or determine your cause of death.

To allow a funeral director to carry out his or her duties.

To respond to a request by military command authorities if you are or were a member of the armed forces.

You may also use a written authorization to allow another person, such as your spouse, parent, or other representative, to obtain or use your PHI.

State law may further limit the permissible ways the Health Plan uses or discloses your PHI. If an applicable state law imposes stricter restrictions on the Health Plan, we will comply with such applicable state law.

Federal law provides you with certain rights regarding your PHI. Parents of minor children and other individuals with legal authority to make health decisions for a Health Plan participant may exercise these rights on behalf of the participant, consistent with state law.

You have the right to request a restriction or limitation on the Health Plan’s use or disclosure of your PHI. Because we use your PHI only as necessary to pay Health Plan benefits, to administer the Health Plan, and to comply with the law, it may not be possible to agree to your request. The law does not require the Health Plan to agree to your request for restriction. However, if we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction on a going-forward basis.

Restriction request forms are available from the HIPAA Privacy Officer. You may make a request for restriction on the use and disclosure of your PHI to the HIPAA Privacy Officer. Contact information for the HIPAA Privacy Officer is listed on the front page of this Notice. When making such a request, you must specify: (1) the PHI you want to limit; (2) how you want the Health Plan to limit the use, disclosure, or both of that PHI; and (3) to whom you want the restrictions to apply.

You have the right to request that the Health Plan communicate with you about your PHI at an alternative address or by alternative means if you believe that communication through normal business practices could endanger you. For example, you may request that the Health Plan contact you only at work and not at home.

You may request confidential communication of your PHI by completing the appropriate form available from the HIPAA Privacy Officer. You should send your written request for confidential communication to the HIPAA Privacy Officer at the address listed on the front page of this Notice. We will accommodate all reasonable requests if you clearly state that you are requesting the confidential communication because you feel that disclosure in another way could endanger your safety. You must make sure your request specifies how or where you wish to be contacted.

You have the right to inspect and copy your PHI that is contained in records that the Health Plan maintains for enrollment, payment, claims determination, or that we use to make enrollment, coverage, or payment decisions about you.

However, we will not give you access to PHI records created in anticipation of a civil, criminal, or administrative action or proceeding. We will also deny your request to inspect and copy your PHI if a licensed health care professional hired by the Health Plan has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.

In the unlikely event that your request to inspect or copy your PHI is denied, you may have that decision reviewed. A different licensed health care professional chosen by the Health Plan will review the request and denial, and we will comply with the health care professional’s decision.

You may request to inspect or copy your PHI by completing the appropriate form available from the HIPAA Privacy Officer. Your written request should be sent to the HIPAA Privacy Officer at the address listed on the front page of this Notice. We may

charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.

You have the right to request an amendment of your PHI if you believe the information the Health Plan has about you is incorrect or incomplete. You have this right as long as your PHI is maintained by the Health Plan. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment.

You may request amendments of your PHI by completing the appropriate form available from the HIPAA Privacy Officer. Your written request to amend your PHI should be sent to the HIPAA Privacy Officer at the address listed on the front page of this Notice. Be sure to include evidence to support your request because we cannot amend PHI that we believe to be accurate and complete.

You have the right to request a list of certain disclosures of your PHI by the Health Plan. The accounting will not include (1) disclosures necessary to determine proper payment of benefits or to operate the Health Plan, (2) disclosures we make to you, (3) disclosures permitted by your authorization, (4) disclosures to friends or family members made in your presence or because of an emergency, or (5) disclosures for national security purposes. Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you of the costs involved, and you may choose to withdraw or modify your request before you incur any expenses.

Accounting request forms are available from the HIPAA Privacy Officer. You may request an accounting of disclosures of your PHI from the HIPAA Privacy Officer. Contact information for the HIPAA Privacy Officer is listed on the front page of this Notice. When making such a request, you must specify the time period for the accounting, which may not be longer than six (6) years and may not include dates prior to April 14, 2004, and the form (e.g., electronic, paper) in which you would like the accounting.

If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Health Plan’s privacy policy or of this Notice.

Complaints should be sent to:

Lewis & Clark Community College Human Resources Department A attn: HIPAA Privacy Officer 5800 Godfrey Road

Godfrey, Illinois 62035-2466 (618) 468-3000

Or

E-mail: Privacy@lc.edu

L&C prohibits retaliation against any person for filing such a complaint.

Changes to this Notice: We reserve the right to change the Health Plan’s privacy practices as described in this Notice. Any change may affect the use and disclosure of your PHI already maintained by the Health Plan, as well as any of your PHI that the Health Plan may receive or create in the future. If there is a material change to the terms of this Notice, you will automatically receive a revised Notice.

How to obtain a copy of this Notice: You can obtain a copy of the current Notice by writing to the HIPAA Privacy Officer at the address listed on the front page of this Notice.

No guarantee of employment: This Notice does not create any right to employment for any individual, nor does it change L&C’s right to discipline or discharge any of its employees in accordance with its applicable policies and procedures.

No change to Health Plan benefits: This Notice explains your privacy rights as a current or former participant in the Health Plan. The Health Plan is bound by the terms of this Notice as they relate to the privacy of your protected health information. However, this Notice does not change any other rights or obligations you may have under the Health Plan. You should refer to the Health Plan documents for additional information regarding your Health Plan benefits.