Skip to Main Content Skip to Footer Toggle Navigation Menu

14.1 Notice of Privacy Practices

(Effective April 14, 2004)

The following is the Notice of Privacy Practices for health plan beneficiaries of Macalester College Health and Welfare Plans.  This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

14.1.1 WHO WILL FOLLOW THIS NOTICE

This notice describes the medical information practices of The Macalester College Health and Welfare Plans and that of any third party that assists in the administration of Health and Welfare Plans claims.  Macalester College Benefits Plans (the “Plan”) provide health benefits to eligible employees of Macalester College (the “College”) and their eligible dependents as described in the summary plan description(s) for the Plan. The Plan creates, receives, uses, maintains and discloses health information about participating employees and dependents in the course of providing these health benefits.

For ease of reference, in the remainder of this Notice, the words “you,” “your,” and “yours” refers to any individual with respect to whom the Plan receives, creates or maintains Protected Health Information, including employees, retirees and COBRA qualified beneficiaries, if any, and their respective dependents.

The Plan is required by law to take reasonable steps to protect your Protected Health Information from inappropriate use or disclosure.

Your “Protected Health Information” (PHI) is information about your physical or mental health condition, the provision of health care to you, or payment for health care provided to you, but only if the information identifies you or there is a reasonable basis to believe that the information could be used to identify you.

The Plan is required by law to provide notice to you of the Plan’s duties and privacy practices with respect to your PHI, and is doing so through this Notice. This Notice describes the different ways in which the Plan uses and discloses PHI. It is not feasible in this Notice to describe in detail all of the specific uses and disclosures the Plan may make of PHI, so this Notice describes all of the categories of uses and disclosures of PHI that the Plan may make and, for most of those categories, gives examples of those uses and disclosures.

Please note that this Notice applies only to your PHI that the Plan maintains. It does not affect your doctor’s or other health care provider’s privacy practices with respect to your PHI that they maintain.

For purposes of HIPAA and this notice, the Health Plan includes the following:

  • Health insurance plan for the group
  • Dental insurance plan for the group
  • Health care expense reimbursement program

14.1.2 OUR PLEDGE REGARDING MEDICAL INFORMATION

We understand that medical information about you and your health is personal.

We are committed to protecting medical information about you. This notice applies to all of the medical records maintained by the Health Plan. Your personal doctor or health care provider may have different policies or notices regarding the doctor’s use and disclosure of your medical information created in the doctor’s office or clinic.

This notice tells you about the ways in which we may use and disclose medical information about you. It also describes our obligations and your rights regarding the use and disclosure of medical information.

We are required by law to:

  • make sure that medical information that identifies you is kept private;
  • give you this notice of our legal duties and privacy practices with respect to medical information about you;
  • and follow the terms of the notice that are currently in effect.

14.1.3 HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION YOUR PHI

The following categories describe different ways that we use and disclose medical information. For each category of uses or disclosures, we will explain what we mean and present some examples. These examples are not exhaustive. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Please note: In most instances, how information is used and disclosed has not changed. The descriptions reflect how the Health and Welfare Plan has traditionally operated.

For Treatment (as described in applicable regulations):

We may use or disclose medical information about you to facilitate medical treatment (as defined in applicable federal rules) or services by providers. We may disclose medical information about you to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you.

For Payment (as described in applicable regulations)

The Plan may use or disclose your PHI for payment (as defined in applicable federal rules) activities, including making payment to or collecting payment from third parties, such as health care providers and other health plans.

The Plan’s use or disclosure of your PHI for payment purposes may include uses and disclosures for the following purposes, among others.

  • Obtaining payments required for coverage under the Plan
  • Determining or fulfilling its responsibility to provide coverage and/or benefits under the Plan, including eligibility determinations and claims adjudication
  • Obtaining or providing reimbursement for the provision of health care (including coordination of benefits, subrogation, and determination of cost sharing amounts)
  • Claims management, collection activities, obtaining payment under a stop-loss insurance policy, and related health care data processing
  • Reviewing health care services to determine medical necessity, coverage under the Plan, appropriateness of care, or justification of charges
  • Utilization review activities, including pre-certification and pre-authorization of services, concurrent and retrospective review of services

The Plan also may disclose your PHI for purposes of assisting other health plans (including other health plans sponsored by the College), health care providers, and health care clearinghouses with their payment activities, including activities like those listed above with respect to the Plan.

For Health Care Operations (as described in applicable regulations)

The Plan may use and disclose your PHI for health care operations (as defined in applicable federal rules) which includes a variety of facilitating activities.

Example: If claims you submit to the Plan indicate that the stop-loss coverage that the College has purchased in connection with the Plan may be triggered, the Plan may use or disclose your PHI to inform the stop-loss carrier of the potential claim and to make any claim that ultimately applies.

The Plan’s use and disclosure of your PHI for health care operations purposes may include uses and disclosures for the following purposes.

  • Quality assessment and improvement activities
  • Disease management, case management and care coordination Activities designed to improve health or reduce health care costs
  • Contacting health care providers and patients with information about treatment alternatives
  • Accreditation, certification, licensing or credentialing activities
  • Fraud and abuse detection and compliance programs

The Plan also may use or disclose your PHI for purposes of assisting other health plans (including other plans sponsored by the College), health care providers and health care clearinghouses with their health care operations activities that are like those listed above, but only to the extent that both the Plan and the recipient of the disclosed information have a relationship with you and the PHI pertains to that relationship.

  • The Plan’s use and disclosure of your PHI for health care operations purposes may include uses and disclosures for the following additional purposes, among others.
  • Underwriting, premium rating and performing related functions to create, renew, or replace insurance related to the Plan. However, the Plan is prohibited from using PHI that is genetic information for underwriting purposes.
  • Planning and development, such as cost-management analyses
  • Conducting or arranging for medical review, legal services, and auditing functions Business management and general administrative activities, including implementation of, and compliance with, applicable laws, and creating de-identified health information or a limited data set.

The Plan also may use or disclose your PHI for purposes of assisting other health plans for which the College is the plan sponsor, and any insurers with respect to those plans, with their health care operations activities similar to both categories listed above.

Limited Data Set:

The Plan may disclose a limited data set to a recipient who agrees in writing that the recipient will protect the limited data set against inappropriate use or disclosure. A limited data set is health information about you and/or others that omits your name and Social Security Number and certain other identifying information.

Legally Required:

The Plan will use or disclose your PHI to the extent required to do so by applicable law. This may include disclosing your PHI in compliance with a court order, or a subpoena or summons. In addition, the Plan must allow the U.S. Department of Health and Human Services to audit Plan records.

Health or Safety:

When consistent with applicable law and standards of ethical conduct, the Plan may disclose your PHI if the Plan, in good faith, believes that such disclosure is necessary to prevent or lessen a serious and imminent threat to your health or the health and safety of others.

14.1.4 SPECIAL SITUATIONS

Disclosure to Health Plan Sponsor:

Information may be disclosed to another health plan for purposes of facilitating claims payments under that plan. In addition, medical information may be disclosed to Macalester College personnel solely for administering benefits under the Health and Welfare Plan.

Organ and Tissue Donation:

If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans:

If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation:

We may release medical information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health:

We may disclose medical information about you for public health activities. These activities generally include the following:

  • to prevent or control disease, injury or disability;
  • to report births and deaths;
  • to report reactions to medications or problems with products;
  • to notify people of recalls of products they may be using;
  • to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
  • to notify the appropriate government authority if we believe an individual has been the victim of abuse, neglect or domestic violence.
  • We will only make this disclosure if you agree or when required or authorized by law.

Emergency Situation:

The Plan may disclose your PHI to a family member, friend, or other person, for the purpose of helping you with your health care or payment for your health care, if you are in an emergency medical situation and you cannot give your agreement to the Plan to do this.

Personal Representatives:

The Plan will disclose your PHI to your personal representatives appointed by you or designated by applicable law (a parent acting for a minor child, or a guardian appointed for an incapacitated adult, for example) to the same extent that the Plan would disclose that information to you.

Health Oversight Activities:

We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes:

If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement:

We may release medical information if asked to do so by a law enforcement official:

  • in response to a court order, subpoena, warrant, summons or similar process;
  • to identify or locate a suspect, fugitive, material witness, or missing person
  • about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • about a death we believe may be the result of criminal conduct; and
  • in emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroner, Medical Examiner or Funeral Director:

We may release medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death or other duties as authorized by law. We may also release medical information about patients of the hospital to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities:

We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates:

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

14.1.5 YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU

You have the following rights regarding medical information we maintain about you:

Authorization to Use or Disclose Your PHI:

Except as stated above, the Plan will not use or disclose your PHI unless it first receives written authorization from you. If you authorize the Plan to use or disclose your PHI, you may revoke that authorization in writing at any time, by sending notice of your revocation to the contact person named at the end of this Notice. To the extent that the Plan has taken action in reliance on your authorization (entered into an agreement to provide your PHI to a third party, for example) you cannot revoke your authorization.

The Plan May Contact You:

The Plan may contact you for various reasons, usually in connection with claims and payments and usually by mail.

You should note that the Plan may contact you about treatment alternatives or other health- related benefits and services that may be of interest to you.

Right to Access Your PHI:

You have a right to access your PHI in the Plan’s enrollment, payment, claims adjudication and case management records, or in other records used by the Plan to make decisions about you, in order to inspect it and obtain a copy of it.  Your request for access to this PHI should be made in writing to the Privacy Officer. The Plan may deny your request for access, for example, if you request information compiled in anticipation of a legal proceeding. If access is denied, you will be provided with a written notice of the denial, a description of how you may exercise any review rights you might have, and a description of how you may complain to Plan or the Secretary of Health and Human Services. If you request a copy of your PHI, the Plan may charge a reasonable fee for copying and, if applicable, postage associated with your request.

Right to Amend

You have a right to request amendments to your PHI in the Plan’s records if you believe that medical information we have about you is inaccurate or incomplete.  You have the right to request an amendment for as long as the information is kept by or for the Health Plan.

To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

  • is not part of the medical information kept by or for the Health and Welfare Plan;
  • was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
  • is not part of the information which you would be permitted to inspect and copy; or is accurate and complete.

If the Plan denies your request for an amendment to your PHI, it will notify you of its decision in writing, providing the basis for the denial, information about how you can include information on your requested amendment in the Plan’s records, and a description of how you may complain to Plan or the Secretary of Health and Human Services.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures made of your health information. Most of the disclosures that the Plan makes of your PHI are not subject to this accounting requirement because routine disclosures (those related to payment of your claims, for example) generally are excluded from this requirement. To request an accounting of disclosures of your PHI, you must submit your request in writing to the Privacy Officer. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2004. Your request should indicate in what form you want the accounting to be provided (for example on paper or electronically). The first list you request within a 12-month period will be free. If you request more than one accounting within a 12-month period, the Plan will charge a reasonable, cost- based fee for each subsequent accounting.  We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Personal Representatives: You may exercise your rights through a personal representative. Your personal representative will be require to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. The Plan retains discretion to deny a personal representative access to your PHI to the extent permissible under applicable law.

Right to Request Restrictions on Certain Uses and Disclosures:

You may request the Plan to restrict the uses and disclosures it makes of your PHI. The Plan is not required to agree to a requested restriction, but if it does agree to your requested restriction, the Plan is bound by that agreement, unless the information is needed in an emergency situation. There are some restrictions, however, that are not permitted even with the Plan’s agreement. To request a restriction, please submit your written request to the Privacy Officer. In the request please specify: (1) what information you want to restrict; (2) whether you want to limit the Plan’s use of that information, its disclosure of that information, or both; and (3) to whom you want the limits to apply (a particular physician, for example). We are not required to agree to your request. The Plan will notify you if it agrees to a requested restriction on how your PHI is used or disclosed. You should not assume that the Plan has accepted a requested restriction until the Plan confirms its agreement to that restriction in writing.

Right to Request Confidential Communications:

If you feel that disclosure of your PHI could endanger you, the Plan will accommodate a reasonable request to communicate with you by alternative means or at alternative locations. For example, you might request the Plan to communicate with you only at a particular address. If you wish to request confidential communications, you must make your request in writing to the Privacy Officer. You do not need to state the specific reason that you feel disclosure of your PHI might endanger you in making the request, but you do need to state whether that is the case. Your request also must specify how or where you wish to be contacted. The Plan will notify you if it agrees to your request for confidential communication. You should not assume that the Plan has accepted your request until the Plan confirms its agreement to that request in writing.  We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

To obtain a paper copy of this notice, contact the Privacy Officer.

Notice of Breach

You have the right to be notified if there is a breach – compromise to the security of privacy of your health information – due to your health information being unsecured.  The College and/or its business associates will notify you with 60 days of discovery of a breach.

14.1.6 CHANGES TO THIS NOTICE

The Plan is required to abide by the terms of this Notice until it is replaced. The Plan may change its privacy practices at any time and, if any such change requires a change to the terms of this Notice, the Plan will revise and re-distribute this Notice. Accordingly, the Plan can change the terms of this Notice at any time. The Plan has the right to make any such change effective for all of your PHI that the Plan creates, receives or maintains, even if the Plan received or created that PHI before the effective date of the change.  We will post a copy of the current notice on the benefits website. The notice will contain on the first page, the effective date.

The Plan is distributing this Notice, and will distribute any revisions, only to participating employees, retirees and COBRA qualified beneficiaries, if any. If you have coverage under the Plan as a dependent of an employee, retiree or COBRA qualified beneficiary, you can get a copy of the Notice by requesting it from the Privacy Officer.

14.1.7 COMPLAINTS

Any complaints to the Plan should be made in writing to the contact person named at the end of this Notice. The Plan encourages you to express any concerns you may have regarding the privacy of your information. You will not be retaliated against in any way for filing a complaint.

If you believe your privacy rights have been violated, you have the right to express complaints to the Plan and to the Secretary of the Department of Health and Human Services.   Any complaints to the Plan should be made in writing to the Privacy Officer. The Plan encourages you to express any concerns you may have regarding the privacy of your information. You will not be retaliated against in any way for filing a complaint.

To file a complaint with the Department of Health and Human Services, contact:

Office for Civil Rights
U.S. Department of Health & Human Services
233 N. Michigan Ave. – Suite 240
Chicago, IL 60601
(312) 886-2359; (312) 353-5693 (TDD)
(312) 886-1807 FAX

Contact Information:

The Plan has designated the individual listed below as its contact person for all issues regarding the Plan’s privacy practices and your privacy rights. All HIPAA related documentation and release forms can be obtained from the Macalester College Employment Services Department.  If you have any questions about this notice, please contact the Privacy Officer:

HR Director
Macalester College
1600 Grand Avenue
Saint Paul, MN 55105
Phone: 651-696-6268
Fax: 651-696-6612
Email: [email protected]

14.1.8 OTHER USES OF MEDICAL INFORMATION

Other uses and disclosures of medical information not covered by this notice or the other applicable laws will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.