HIPAA Notice

CITY OF ANKENY, IOWA

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW CAREFULLY.

Effective Date: April 14, 2004

This Notice of Privacy Practices ("Notice") is made in compliance with the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Standards") set forth by the U.S. Department of Health and Human Services ("HHS") pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). The City of Ankeny Employee Benefit Plan (the "Plan") is required by law to take reasonable steps to ensure the privacy of your Protected Health Information ("PHI"), as defined below, and to inform you about:

(1) the Plan's uses and disclosures of PHI;

(2) your privacy rights with respect to your PHI;

(3) the Plan's duties with respect to your PHI;

(4) your right to file a complaint with the Plan and with the Secretary of HHS; and

(5) the person or office to contact for further information about the Plan's privacy practices.

The terms of this Notice apply to the City’s medical (including retirees) and dental plans sponsored by the City of Ankeny and it’s Flexible Benefit Plan sponsored by the City of Ankeny.

The term "Protected Health Information" (PHI) includes all "Individually Identifiable Health Information" transmitted or maintained by the Plan, regardless of form (oral, written or electronic).

The term "Individually Identifiable Health Information" means information that:

• It is created or received by a health care provider, health plan, employer or health care clearinghouse;
• It relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and
• It identifies the individual, or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Section 1.  Notice of PHI Uses and Disclosures

Required PHI Disclosures. Upon your request, the Plan is required to give you access to certain PHI to inspect and copy it and to provide you with an accounting of disclosures of PHI made by the Plan.  For further information pertaining to your rights in this regard, see Section 2 of this Notice.  The Plan must disclose your PHI when required by the Secretary of HHS to investigate or determine the Plan's compliance with the Privacy Standards.

Permitted Uses and Disclosures of Your PHI. The Plan, its business associates, and their agents/subcontractors, if any, will use or disclose PHI without your consent, authorization or opportunity to agree or object, to carry out treatment, payment and health care operations.  The Plan will disclose PHI to a business associate only if the Plan receives satisfactory assurance that the business associate will appropriately safeguard the information. 

In addition, the Plan may contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.  The Plan will disclose PHI to the City of Ankeny, the ("Plan Sponsor") for purposes related to treatment, payment and health care operations. The Plan Sponsor has amended its plan documents to protect your PHI as required by the Privacy Standards.  The Plan Sponsor will obtain an authorization from you if it intends to use or disclose your PHI for purposes unrelated to treatment, payment and health care operations. 

Treatment. The Plan may disclose your PHI as necessary for your treatment. Treatment includes the provision, coordination, or management of health care and related services by one or more health care providers.  It also includes, but is not limited to, consultations and referrals between one or more of your providers.  For example, the Plan may disclose to a treating orthodontist the name of your treating dentist so that the orthodontist may ask for your dental X-rays from the treating dentist.

Payment.  The Plan may use and disclose your PHI as necessary for payment purposes.  Payment includes, but is not limited to, actions to make eligibility or coverage determinations, billing, claims management, collection activities, subrogation, reviews for medical necessity and appropriateness of care, utilization review and pre-authorizations. For example, the Plan may tell a doctor whether you are eligible for coverage or what percentage of the bill might be paid by the Plan.

Health Care Operations.  The Plan may use and disclose your PHI as necessary for health care operations.  For example, the Plan may use or disclose your PHI for quality assessment and quality improvement, credentialing health care providers, premium rating, conducting or arranging for medical review or compliance.  The Plan may also disclose your PHI to another health plan, health care facility or health care provider for activities such as quality assurance or case management.  The Plan may also contact your health care providers concerning prescription drug or treatment alternatives. Additionally the Plan may use information about your claims to refer you to a disease management program, project future benefit costs or audit the accuracy of claims processing functions.

Uses and Disclosures that Require Your Written Authorization. Your written authorization generally will be obtained before the Plan will use or disclose psychotherapy notes about you from your psychotherapist.  Psychotherapy notes are separately filed notes about your conversations with your mental health professional during a counseling session.  They do not include summary information about your mental health treatment.  The Plan may use and disclose such notes without authorization when needed by the Plan to defend against litigation filed by you.

Uses and Disclosures for Which You Have the Opportunity to Object. The Plan may disclose to a family member, other relative, close personal friend of yours or any other person identified by you PHI directly relevant to such person's involvement with your care or payment for your health care when you are present for, or otherwise available prior to, a disclosure and you are able to make health care decisions, if: (a) The Plan obtains your agreement; (b) The Plan provides you with the opportunity to object to the disclosure and you fail to do so; or  (c) The Plan infers from the circumstances, based upon professional judgment, that you do not object to the disclosure.  However, if you are not present, or the opportunity to agree or object to the disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, the Plan may, in the exercise of professional judgment, determine whether the disclosure is in your best interests, and, if so, disclose only PHI that is directly relevant to the person's involvement with your health care.

Other Permitted Uses and Disclosures.  The Plan is permitted or required by law to use or disclose your PHI, without your authorization, in the following circumstances:

• When required by law, provided that the use or disclosure complies with and is limited to the relevant requirements of such law.
• For public health activities (for example, reporting of disease, injury, birth, death or suspicion of child abuse or neglect);
• To a governmental authority if the Plan believes an individual is a victim of abuse, neglect or domestic violence;
• For health oversight activities (for example, audits, inspections, licensure actions or civil, administrative or criminal proceedings or actions);
• For judicial or administrative proceedings (for example, pursuant to a court order, subpoena or discovery request);
• For law enforcement purposes (for example, reporting wounds or injuries or for identifying or locating suspects, witnesses or missing people);
• To coroners and funeral directors;
• For procurement, banking or transplantation of organ, eye or tissue donations;
• For certain research purposes;
• To avert a serious threat to health or safety under certain circumstances;
• For military activities if you are a member of the armed forces; for intelligence or national security issues; or about an inmate or an individual to a correctional institution or law enforcement official having custody; and
• For compliance with workers’ compensation programs.

Except as otherwise indicated in this Notice, uses and disclosures will be made only with your written authorization, subject to your right to revoke such authorization.  You may revoke an authorization at any time, provided your revocation is done in writing, except to the extent that the Plan has taken action in reliance upon the authorization, or if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

Section 2: RIGHTS OF INDIVIDUALS

Right to Request Restrictions on PHI Uses and Disclosures.  You may request the Plan to restrict uses and disclosures of your PHI to carry out treatment, payment or health care operations, or to restrict disclosures to family members, relatives, friends or other persons identified by you who are involved in your care or payment for your care.  However, the Plan is not required to agree to your requested restriction.  If your request for a restriction is granted, you will receive a written acknowledgement from the City’s Privacy Officer.  A restriction agreed to by the Plan is not effective to prevent uses or disclosures when required by the Secretary of HHS to investigate or determine the Plan's compliance with the Privacy Standards or uses or disclosures that are otherwise required by law. To request a restriction, you or your personal representative must send a written request to the Privacy Officer at the address listed below in the last paragraph under Section 2. 

Right to Request Confidential Communications of PHI. You have the right to request to receive communications of PHI from the Plan by alternative means (for example by fax) or at alternative locations if you clearly state that the disclosure of all or part of the information to which the request pertains could endanger you. The Plan will accommodate all such reasonable requests.  However, the Plan may condition the provision of a reasonable accommodation on (a) when appropriate, information as to how payment, if any, will be handled; and (b) specification by you of an alternative address or other method of contact.  To request confidential communications of your PHI you or your personal representative must send a written request to the Privacy Officer at the address listed below at the last paragraph under Section 2. 

Right to Inspect and Copy PHI.  You have a right to inspect and obtain a copy of your PHI contained in a "designated record set," for as long as the Plan maintains PHI in the designated record set.  "Designated Record Set" means a group of records maintained by or for a health plan that is enrollment, payment, claims adjudication and case or medical management record systems maintained by or for a health plan; or used in whole or in part by or for the health plan to make decisions about individuals.  Information used for quality control or peer review analyses and not used to make decisions about individuals is not in the designated record set. 

The Plan must take action as follows: if the Plan grants the request, in whole or in part, the Plan must inform you of the acceptance and provide the access requested.  However, if the Plan denies the request, in whole or in part, the Plan must provide you with a written denial.  To request access to your information, you or your personal representative must send a written request to the Privacy Officer at the address listed in the last paragraph of Section 2 below.  A fee will be charged for copying and postage.

Right to Amend PHI.  You have the right to request the Plan to amend your PHI or a record about you in a designated record set for as long as the PHI is maintained in the designated record set. The Plan may deny your request for amendment if it determines that the PHI or record that is the subject of the request: (a) was not created by the Plan, unless you provide a reasonable basis to believe that the originator of PHI is no longer available to act on the requested amendment; (b) is not part of the designated record set; (c) would not be available for your inspection under the Privacy Standards; or (d) is accurate and complete.  To request an amendment, you or your personal representative must send a written request to the Privacy Officer at the address listed below in the last paragraph of Section 2.

Right to Receive an Accounting of PHI Disclosures. At your request, the Plan will provide you with an accounting of disclosures by the Plan of your PHI during the six years prior to the date on which the accounting is requested, unless you request a shorter time frame, but will only include disclosures made after April 14, 2004.  However, such accounting will not include PHI disclosures made: (a) to carry out treatment, payment or health care operations; (b) to individuals about their own PHI; (c) incident to a use or disclosure otherwise permitted or required by the Privacy Standards; (d) pursuant to an authorization; (e) to certain persons involved in your care or payment for your care; (f) to notify certain persons of your location, general condition or death; (g) as part of a "Limited Data Set" (as defined in the Privacy Standards), which largely relates to research purposes.  Except as otherwise provided below, for each disclosure, the accounting will include:

• The date of the disclosure;
• The name of the entity or person who received the PHI and, if known, the address of such entity or person;
• A brief description of the PHI disclosed; and
• A brief statement of the purpose of the disclosure that reasonably informs you of the basis for the disclosure, or, in lieu of such statement, a copy of a written request for disclosure.

To request an accounting, you or your personal representative must send a written request to the Privacy Officer at the address listed in the last paragraph of Section 2 below. The first accounting in any 12-month period will be free; however, a fee will be charged for any subsequent request for an accounting during that same time period.

The Right To Receive a Paper Copy of This Notice Upon Request. This notice is being distributed in paper format to all regular part-time and full-time City employees. However, you have a right to obtain a paper copy of this Notice upon request. To request a paper copy of this Notice, contact the Privacy Officer at the address listed in the last paragraph of Section 2 below or you may visit our website at www.ankenyiowa.gov for a printable version.

Personal Representatives. You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. Proof of such authority may include, but is not limited to, the following: (a) a power of attorney for health care purposes, notarized by a notary public; (b) a court order of appointment of the person as the conservator or guardian of the individual; or (c) an individual who is the parent of a minor child.

The Plan retains discretion to deny access to your PHI to a personal representative to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse or neglect. This also applies to personal representatives of minors.

Where to Send Written Requests. To exercise your rights you or your personal representative must send written requests to: Privacy Officer, City of Ankeny, Attn: Benefits, 410 West First St., Ankeny, Iowa 50023.

SECTION 3: THE PLAN’S DUTIES

Notice. The Plan is required to abide by the terms of this Notice as long as it remains in effect.  The Plan reserves the right to change the terms of this Notice as necessary and to make the new Notice effective for all PHI maintained by the Plan. If a privacy practice is changed, a revised version of this Notice will be provided to all individuals then covered by the Plan.   The Plan will mail a paper copy of the revised Notice to your home address. In addition, the revised Notice will be maintained on the Plan’s website at www.ankenyiowa.gov. You have the right to request a paper copy of the Notice, although you may have originally requested a copy of the Notice electronically by e-mail.

Minimum Necessary Standard. When using or disclosing PHI or when requesting PHI from another covered entity, the Plan will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations however, the minimum necessary standard will not apply in the following situations: (a) disclosures to or requests by a health care provider for treatment; (b) uses or disclosures made to the individual; (c) disclosures made to the Secretary of HHS; (d) uses or disclosures that are required by law; (e) uses or disclosures that are required for the Plan's compliance with the Privacy Standards; and (f) uses or disclosures made pursuant to an authorization.

This Notice does not apply to information that has been de-identified.  De-identified information is health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.  It is not individually identifiable health information.

In addition, the Plan may use or disclose "summary health information" to the Employer for obtaining premium bids or modifying, amending or terminating the group health plan.  Summary health information summarizes the claims history, claims expenses or type of claims experienced by individuals for whom an employer has provided health benefits under a group health plan, and from which identifying information has been deleted in accordance with the Privacy Standards.

Complaints.  If you believe your privacy rights have been violated, you can send a written complaint to the Privacy Officer at City Hall, 410 West First St., Ankeny, Iowa 50023 or to the Secretary of the U.S. Department of Health and Human Services at: The Hubert H. Humphrey Building, 200 Independence Avenue, S.W., Washington, D.C. 20201.  There will be no retaliation for filing a complaint.

For More Information. If you have any questions or need any assistance regarding this Notice or your privacy rights, you or your personal representative may contact the Privacy Officer, City Hall, 410 West First St., Ankeny, Iowa 50023 or by telephone at (515) 965-6408.

Summary Statement. PHI use and disclosure by the Plan is regulated by a federal law known as HIPAA.  You may find these rules at 45 Code of Federal Regulations Parts 160 and 164.  This Notice attempts to summarize the Privacy Standards.  In the event this summary contains erroneous or mistaken information, the Privacy Standards under HIPAA will be controlling.

Council Approved 4/5/04