Privacy & Security

THE VERMONT EDUCATION HEALTH INITIATIVE

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

You have received this notice because you receive medical and/or dental insurance coverage under a health benefits plan offered by the Vermont Education Health Initiative (“VEHI”) and/or you participate in VEHI’s wellness programs. VEHI is an inter-municipal insurance association that is approved and overseen by the Vermont Department of Financial Regulation. VEHI offers non-insured, self-funded health benefit plans, wellness programs and compliance services to schools and other educational organizations in Vermont. The enrollees of VEHI’s health benefits plan are active and retired school employees and their dependents. VEHI’s health benefit plans are financed by employer and/or employee contributions.

This notice refers to VEHI by using the terms “us,” “we” or “our.”

Generally, “protected health information” or “PHI” is information that relates to your past, present or future physical or mental health or condition (including your genetic information, as defined by federal law) the provision of health care to you or the payment for that health care, and that identifies you or with respect to which there is a reasonable basis to believe that the information can be used to identify you.

This notice describes our privacy practices, which include how we may use and disclose your protected health information. We are required by certain federal and state laws to maintain the privacy of your PHI. We also are required by the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Rule”) developed by the Department of Health and Human Services under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to give you this notice of our privacy practices and legal duties and your rights concerning your PHI.

Use and Disclosure of Your Protected Health Information

The following categories describe the different ways in which we may use and disclose your protected health information. Please note that every permitted use or disclosure of your PHI is not listed below. However, the different ways we will, or might, use or disclose your PHI do fall within one of the permitted categories described below.

  • To Make or Obtain Payment. We may use or disclose your protected health information to make payment to or collect payment from third parties, such as other health plans or health care providers, for the care you receive. For example, we may provide information regarding your coverage or health care treatment to other health plans to coordinate payment of benefits or we may use your PHI to pay claims for services provided to you by doctors or hospitals which are covered by your health plan.
  • To Conduct Health Care Operations. We may use or disclose your protected health information for our operations, to facilitate our administration and as necessary to provide coverage and services to all of our participants. These activities may include:
    • quality assessment and improvement activities;
    • activities designed to improve health care or reduce health care costs;
    • clinical guideline and protocol development, case management and care coordination;
    • contacting health care providers and participants with information about treatment alternatives and other related functions;
    • competence or qualifications reviews and performance evaluations of health care professionals;
    • accreditation, certification, licensing or credentialing activities;
    • underwriting, premium rating or related functions to create, renew or replace health insurance or health benefits, provided that we are prohibited from using or disclosing your protected health information that is genetic information, as defined by federal law, for such purposes;
    • review and auditing, including compliance reviews, medical reviews, legal services and compliance programs;
    • business planning and development including cost management and planning related analyses and formulary development; and
    • business management and general administrative activities, including customer service and resolution of internal grievances.

For example, we may use and disclose your protected health information to conduct case management, quality improvement, utilization review and provider credentialing activities or to engage in customer service and grievance resolution activities. We may also use and disclose your PHI to determine the types of wellness programs we may offer and to offer those wellness programs to you and, with your written authorization, to advocate on your behalf.

  • For Treatment Purposes. We may disclose your protected health information to doctors, dentists, pharmacies, hospitals and other health care providers who take care of you. For example, we may disclose your PHI to doctors who request medical information from us to supplement their own records.
  • To Plan Sponsors. Plan sponsors are employers or other organizations that sponsor a group health plan.
  • We may disclose your protected health information to the plan sponsor of your group health plan. For example:
    • We may disclose “summary health information” to the plan sponsor of your group health plan to use to obtain premium bids for providing health insurance coverage or to modify, amend or terminate its group health plan. “Summary health information” is information that summarizes claims history, claims expenses or types of claims experienced by the individuals who participate in the plan sponsor’s group health plan.
    • We may disclose your PHI to the plan sponsor of your group health plan to verify enrollment or disenrollment in your group health plan.
    • If the plan sponsor of your group health plan has met certain requirements of the Privacy Rule, we may disclose your PHI to the plan sponsor of your group health plan so that the plan sponsor can administer the group health plan. The plan sponsor of your group health plan may be your employer. You should talk to your employer to find out how your employer might use this information.
  • For Treatment Alternatives. We may use and disclose your protected health information to tell you about or recommend possible treatment options or alternatives that may interest you.
  • For Distribution of Health-Related Benefits and Services. We may use or disclose your protected health information to provide you with information on health-related benefits and services that may interest you.
  • When Required by Law.We will disclose your protected health information when we are required to do so by any federal, state or local law. For example, we may be required to disclose your PHI if the Department of Health and Human Services investigates our HIPAA compliance efforts.
  • To Conduct Health Oversight Activities. We may disclose your protected health information to health oversight agencies for their authorized activities including audits, civil administrative or criminal investigations, inspections and licensure or disciplinary actions.
  • In Connection with Public Health Activities. We may disclose your protected health information to public health agencies for public health activities that are permitted or required by law, such as to:
      • prevent or control disease, injury or disability;
      • maintain vital records, such as births and deaths;
      • report child abuse and neglect;
      • notify a person about potential exposure to a communicable disease;
      • notify a person about a potential risk for spreading or contracting a disease or condition;
      • report reactions to drugs or problems with products or devices;
      • notify individuals if a product or device they may be using has been recalled; and
      • notify appropriate government agencies and authorities about the potential abuse or neglect of an adult patient, including domestic violence.
  • In Connection With Judicial and Administrative Proceedings. As permitted or required by state or other law, we may disclose your protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order or in response to a subpoena, discovery request or other lawful process.
  • For Law Enforcement Purposes. As permitted or required by state or other law, we may disclose your protected health information to law enforcement officials for certain law enforcement purposes, including, but not limited to, if we have a suspicion that your death was the result of criminal conduct or in an emergency to report a crime.
  • In the Event of a Serious Threat to Health or Safety. We may, consistent with applicable law and ethical standards of conduct, disclose your protected health information if we, in good faith, believe that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public.
  • For Specified Government Functions. In certain circumstances, federal regulations require us to use or disclose your protected health information to facilitate specified government functions related to the military, veterans affairs, national security and intelligence activities, protective services for the president and others, and correctional institutions and inmates.
  • For Workers’ Compensation. We may release your protected health information to the extent necessary to comply with laws related to workers’ compensation or similar programs.
  • For Research. We may use or disclose your protected health information for research purposes, subject to strict legal restrictions.
  • To You. Upon your request and in accordance with applicable provisions of the Privacy Rule, we may disclose to you your protected health information that is in a “designated record set.” Generally, a designated record set contains enrollment, payment, claims adjudication and case or medical management records we may have about you, as well as other records that we use to make decisions about your health care benefits. You can request the PHI from your designated record set as described below in the section titled “Your Rights with Respect to Your Protected Health Information.”
  • To Our Business Associates. We may disclose your protected health information to contractors, agents and other business associates of ours who need the information to provide services to us, for us or on our behalf. When we disclose your PHI in this manner we obtain a written agreement that our business associate will protect the confidentiality of your PHI.

Authorization to Use or Disclose Your Protected Health Information

Other than as stated above, and as otherwise permitted by applicable law, we will not use or disclose your protected health information other than with your written authorization. You may give us a written authorization permitting us to use or disclose your PHI for any purpose, including any marketing or sale of PHI that is permitted by law. We will not sell you PHI, or use or disclose it for marketing purposes, without your written authorization.

You may revoke an authorization that you provide to us at any time. Your revocation must be in writing. After you revoke an authorization, we will no longer use or disclose your protected health information for the reasons described in that authorization, except to the extent that we have already relied on the authorization.

Your Rights with Respect to Your Protected Health Information

You have the following rights regarding your protected health information that we maintain:

  • Right to Request Restrictions. You have the right to request that we restrict certain uses and disclosures of your protected health information. You have the right to request a limit on our use or disclosure of your PHI in connection with your treatment, payment for your care and our health care operations. We are not required to agree to your request. If we do agree to your request, we will be bound by our agreement except in emergency situations and as otherwise required by law. If we do not agree to a request, we are required to give you notice. An agreed to restriction continues until you terminate the restriction (either orally or in writing) or until we inform you that we are terminating the restriction.If you wish to request a restriction, please contact our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602, by fax at (802) 229-1446 or by telephone at (802) 223-5040.
  • Right to Receive Confidential Communications. You have the right to request that we communicate with you in a certain way if you feel the disclosure of your protected health information could endanger you. For example, you may ask that we only communicate with you by mail, rather than by telephone, or at work, rather than at home. If you wish to receive confidential communications, please make your request in writing to our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602 or by fax at (802) 229-1446.Your written request must clearly state that the disclosure of all or part of your PHI could endanger you. We will make every reasonable effort to honor your requests for confidential communications.
  • Right to Inspect and Copy Your Protected Health Information. You have the right to inspect and copy your protected health information contained in a “designated record set,” other than psychotherapy notes and certain other information. Generally, a designated record set contains enrollment, payment, claims adjudication and case or medical management records we may have about you, as well as other records that we use to make decisions about your health care benefits. A request to inspect and copy records containing your PHI must be made in writing to our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602 or by fax at (802) 229-1446.If you request a copy of your PHI, we may charge a reasonable fee for copying, assembling costs and postage, if applicable, associated with your request.
  • Right to Amend Your Protected Health Information. If you believe that any of your protected health information contained in a “designated record set” is inaccurate or incomplete, you have the right to request that we amend the PHI. Generally, a designated record set contains enrollment, payment, claims adjudication and case or medical management records we may have about you, as well as other records that we use to make decisions about your health care benefits. The request to amend may be made as long as we maintain the information. A request for an amendment of records must be made in writing to our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602 or by fax at (802) 229-1446. We may deny the request if the request does not include a reason to support the amendment. We may also deny the request if we did not create your PHI records, if the PHI you are requesting to amend is not part of the designated record set, if you are not permitted to inspect or copy the PHI you are requesting to amend, or if we determine the records containing your PHI are accurate and complete. If we deny your request, you have the right to submit a written statement of disagreement.
  • Right to an Accounting. You have the right to request an accounting of certain disclosures of your protected health information we have made or that were made on our behalf. Any accounting will not include certain disclosures, including, without limitation:
      • disclosures to carry out treatment, payment or health care operations;
      • disclosures we made to you;
      • disclosures that were incident to another use or disclosure; and
      • disclosures which you authorized.

The request for an accounting of disclosures must be made in writing to our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602 or by fax at (802) 229-1446. The request should specify the time period for which you are requesting the information. Accounting requests may not be made for periods of time going back more than six years. We will provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests in a 12-month period may be subject to a reasonable cost-based fee. We will inform you in advance of the fee, if applicable.

  • Right to a Paper Copy of this Notice. You have the right to request and receive a paper copy of this Notice at any time, even if you have received this Notice previously or agreed to receive this Notice electronically. To obtain a paper copy, please contact our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602, by fax at (802) 229-1446 or by telephone at (802) 223-5040. You also may obtain a copy of the current version of our Notice at our website,www.vehi.org.
  • Right to File Complaints. You have the right to file complaints with us if you believe that your privacy rights have been violated. Any complaints to us should be made in writing to our Privacy Officer by mail at 52 Pike Drive, Berlin, Vermont 05602 or by fax at (802) 229-1446.We encourage you to express any concerns to us that you may have regarding the privacy of your information. You also may complain to the Secretary of the Department of Health and Human Services if you believe that your privacy rights have been violated. We will not retaliate against you in any way for filing a complaint against us or with the Secretary of the Department of Health and Human Services.

Appointment Reminders And Fundraising

We may call you to remind you of appointments. Please inform us if you do not wish to be called. We may also provide your contact information (name, address, and phone number) and the dates you received services from us to others in connection with our fundraising efforts. You have the right to opt-out of our use of your contact information in connection with our fundraising efforts. If you wish to opt-out, please inform us and we will respect your wishes.

Our Duties with Respect to Your Protected Health Information

We are required by law to maintain the privacy of your protected health information as set forth in this Notice and to provide you this Notice of our legal duties and privacy practices with respect to your PHI. We are required to abide by the terms of this Notice, which we may amend from time to time. We are also required by law to notify you if the event of any breach of the privacy of your PHI and to accommodate reasonable requests by you to communicate health information to you by alternative means and /or at alternative locations.

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all protected health information that we maintain. If we materially change this Notice we will provide a copy of the revised Notice to you within 60 days of the change.

Potential Impact of State Law

In some situations, we may choose or be required to follow state privacy or other applicable laws that provide greater privacy protections for your protected health information. If a state law requires that we not use or disclose certain of your PHI, then we will use or disclose that PHI according to applicable state law.

Contact Person

We have designated our Privacy Officer as the contact person for all issues regarding participant privacy and your privacy rights, including any further information about this Notice. You may contact this person by mail at 52 Pike Drive, Berlin, Vermont 05602, by fax at (802) 229-1446 or by telephone at (802) 223-5040.

Effective Date

This Notice is effective September 1, 2013, with non-material revisions on May 1, 2017.

IF YOU HAVE ANY QUESTIONS REGARDING THIS NOTICE, OR DESIRE MORE INFORMATION ABOUT THIS NOTICE, PLEASE CONTACT OUR PRIVACY OFFICER BY MAIL AT 52 Pike Drive, Berlin, Vermont 05602, BY FAX AT (802) 229-1446 OR BY TELEPHONE AT (802) 223-5040.

Related Pages