Privacy practices

We understand the importance of keeping your personal and health information secure and private. We are required by law to provide you with this notice. This notice informs you of your rights about the privacy of your personal information and how we may use and share your personal information. We will make sure that your personal information is only used and shared in the manner described. We may, at times, update this notice.

Changes to this notice will apply to the information that we already have about you as well as any information that we may receive or create in the future. Our current notice is posted at www.MHBP.com. You may request a copy at any time. Throughout this notice, examples are provided. Please note that all of these examples may not apply to the services Aetna® provides to your particular health benefit plan.

To best service your benefit we need information about you. This information may come from you, your employer, or other payers or health benefit plan sponsors, and our Affiliates. Examples include your name, address, phone number, Social Security number, date of birth, marital status, employment information, or medical history. We also receive information from health care providers and others about you. Examples include the health care services you receive. This information may be in the form of health care claims and encounters, medical information, or a service request. We may receive your information in writing, by telephone, or electronically. In some instances, we may ask you about your race/ethnicity or language, however providing this information is entirely voluntary.

Keeping your information safe is one of our most important duties. We limit access to your personal information, including race/ethnicity and language, to those who need it. We maintain appropriate safeguards to protect it. For example, we protect access to our buildings and computer systems. Our Privacy Office also assures the training of our staff on our privacy and security policies.

To properly service your benefits, we may use and share your personal information for “treatment,” “payment” and “health care operations.” Below we provide examples of each. We may limit the amount of information we share about you as required by law. For example, HIV/ AIDS, substance abuse, and genetic information may be further protected by law. Our privacy policies will always reflect the most protective laws that apply.

• Treatment: We may use and share your personal information with health care providers for coordination and management of your care. Providers include physicians, hospitals, and other caregivers who provide services to you.
• Payment: We may use and share your personal information to determine your eligibility, coordinate care, review medical necessity, pay claims, obtain external review, and respond to complaints. For example, we may use information from your health care provider to help process your claims. We may also use and share your personal information to obtain payment from others that may be responsible for such costs. We may disclose your personal information to OPM if you dispute a claim.
• Payment: We may use and share your personal information to determine your eligibility, coordinate care, review medical necessity, pay claims, obtain external review, and respond to complaints. For example, we may use information from your health care provider to help process your claims. We may also use and share your personal information to obtain payment from others that may be responsible for such costs. We may disclose your personal information to OPM if you dispute a claim.
• Health care operations: We may use and share your personal information, including race/ethnicity and language, as part of our operations in servicing your benefits. Operations include credentialing of providers; quality improvement activities; accreditation by independent organizations; responses to your questions, or grievance or external review programs; and disease management, case management, and care coordination, including designing intervention programs and designing and directing outreach materials. We may also use and share information for our general administrative activities such as pharmacy benefit administration; detection and investigation of fraud, including disclosures to OPM Inspector General; auditing; underwriting; securing and servicing reinsurance policies; or in the sale, transfer, or merger of all or a part of an Aetna company with another entity. For example, we may use or share your personal information in order to evaluate the quality of health care delivered, to remind you about preventive care, or to inform you about a disease management program. We cannot use or disclose your genetic, race/ethnicity or language information for underwriting purposes, to set rates, or to deny coverage or benefit.

We may also share your personal information with providers and other health plans for their treatment, payment, and certain health care operation purposes. For example, we may share personal information with other health plans identified by you or your plan sponsor when those plans may be responsible to pay for certain health care benefit or we may share language data with health care practitioners and providers to inform them about your communication needs.

We may use or share your protected health information (PHI):

• With the U.S. Office of Personnel Management (OPM)
• With your employing agency in for payment or health care operations
• When required by federal law

We’re also required to share your PHI to OPM for its claims data warehouse. The data is used for its Federal Employees Health Benefits (FEHB) Program.

We may also use or share your personal information for the following:

• Medical home / accountable care organizations: MHBP may work with your primary care physician, hospitals and other health care providers to help coordinate your treatment and care. Your information may be shared with your health care providers to assist in a team-based approach to your health.
• Health care oversight and law enforcement: To comply with federal or state oversight agencies. These may include, but are not limited to, your state department of insurance, OPM or the US Department of Labor.
• Legal proceedings: To comply with a court order or other lawful process.
• Treatment options: To inform you about treatment options or health-related benefit or services.
• Plan sponsor: To permit the Plan’s sponsor, the National Postal Mail Handlers Union, to keep accurate membership records.
• Research: To researchers so long as all procedures required by law have been taken to protect the privacy of the data.
• Others involved in your health care: We may share certain personal information with a relative, such as your spouse, close personal friend, or others you have identified as being involved in your care or payment for that care. For example, to those individuals with knowledge of a specific claim, we may confirm certain information about it. Also, if you are a dependent, we may mail an explanation of benefit to the subscriber. Your family may also have access to such information on our Web site. If you do not want this information to be shared, please tell us in writing.
• Personal representatives: We may share personal information with those having a relationship that gives them the right to act on your behalf. Examples include parents of an emancipated minor or those having a Power of Attorney.
• Business associates: To persons providing services to us and who assure us that they will protect the information. Examples may include those companies providing your pharmacy or behavioral health benefits.
• Other situations: We also may share personal information in certain public interest situations. Examples include protecting victims of abuse or neglect; preventing a serious threat to health or safety; tracking diseases or medical devices; or informing military or veteran authorities if you are an armed forces member. We may also share your information with coroners; for workers’ compensation; for national security; and as required by law.
• Workers’ Compensation – to comply with workers’ compensation laws.

As Required by Law – to comply with legal obligations and requirements.

• Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
• Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.

Required Disclosures: We must use and disclose your personal information in the following manner:

• To you or someone who has the legal right to act for you (your personal representative) in order t o administer your rights as described in this notice; and
• To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.

We will obtain your written permission to use or share your health information for reasons not identify by this notice and not otherwise permitted or required by law. If you withdraw your permission, we will no longer use or share your health information for those reasons.

We do not destroy your information when your coverage ends. It is necessary to use and share your information, for many of the purposes described above, even after your coverage ends. However, we will continue to protect your information regardless of your coverage status.

• Requesting restrictions: You can request a restriction on the use or sharing of your health information for treatment, payment, or health care operations. However, we may not agree to a requested restriction.
• Confidential communications: You can request that we communicate with you about your health and related issues in a certain way, or at a certain location. For example, you may ask that we contact you by mail, rather than by telephone, or at work, rather than at home. We will accommodate reasonable requests.
• Access and copies: You can inspect and obtain a copy of certain health information. We may charge a fee for the costs of copying, mailing, labor, and supplies related to your request. We may deny your request to inspect or copy in some situations. In some cases denials allow for a review of our decision. We will notify you of any costs pertaining to these requests, and you may withdraw your request before you incur any costs. You may also request your health information electronically and it will be provided to you in a secure format.
• Amendment: You may ask us to amend your health information if you believe it is incorrect or incomplete. You must provide us with a reason that supports your request. We may deny your request if the information is accurate, or as otherwise allowed by law. You may send a statement of disagreement.
• Accounting of disclosures: You may request a report of certain times we have shared your information. Examples include sharing your information in response to court orders or with government agencies that license us. All requests for an accounting of disclosures must state a time period that may not include a date earlier than six years prior to the date of the request. We will notify you of any costs pertaining to these requests, and you may withdraw your request before you incur any costs.

Please contact Member Services to find out how to exercise any of your r ights listed in this notice, or if you have any questions about this notice. The telephone number or address is listed in your benefit documents or on your membership card. If you believe we have not followed the terms of this notice, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with the Secretary, write to 200 Independence Avenue SW, Washington, DC 20201 or call 1-877-696-6775. You will not be penalized for filing a complaint. To contact us, please follow the complaint, grievance, or appeal process in your bene fit documents.