Privacy Practices

G2 Certification: https://www.g2llc.com/approved-health-insurance-provider/?pdb=1126

General Rule

‍
As a general rule, individuals have a right to receive a notice of 1) the uses and disclosures of protected health information that may be made by a group health plan, 2) the individual’s rights under the Privacy Rule and 3) the group health plan’s responsibilities under the Privacy Rule. In addition, a group health plan may not use or disclose protected health information in a manner inconsistent with its notice of privacy practices.

Required Elements Of Notice

‍
The notice must be written in plain language and must contain the following elements:

1. A prescribed header.
2. The notice must describe the health plan’s uses and disclosures of information including:
   - A description, including at least one example, of the types of uses and disclosures of protected health information that the group health plan is permitted to make for treatment, payment, and health care operations;
   - A description of each of the uses or disclosures that the group health plan is permitted to make without the individual’s written authorization;
   - If applicable, the description of uses and disclosures that are permitted without authorization must reflect any more stringent law; and
   - A statement that other uses and disclosures will be made only with the individual’s written authorization and that the individual may revoke the authorization.
3. If the group health plan intends to engage in any of the following activities, the notice must include a separate statements, as applicable, that:
   - The group health plan may contact the individual to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the individual; and
   - The group health plan may disclose protected health information to the sponsor of the individual’s group health plan.
4. The notice must contain a statement of the individual’s rights under the Privacy Rule and a brief description of how the individual may exercise these rights.
5. The notice must contain a description of the group health plan’s duties including:
   - A statement that the group health plan is required to maintain the privacy of protected health information;
   - A statement that the group health plan must provide individuals with a privacy notice; and
   - A statement that the group health plan must abide by the notice.
6. If applicable, a statement that the group health plan reserves the right to change the terms of its notice and to make the revised notice effective for all protected health information that it maintains; and
7. If applicable, a statement describing how the group health plan will provide individuals with a revised notice.
8. The notice must contain a statement that individuals may complain to the group health plan and to the Secretary of HHS if they believe their privacy rights have been violated, a brief description of how the individual may file a complaint with the group health plan, and a statement that the individual will not be retaliated against for filing a complaint.
9. The notice must contain certain contact information and an effective date.

Optional Elements Of Notice

‍
A group health plan may describe any limitations on uses and disclosures that go beyond the requirements of the HIPAA Privacy Rule that it voluntarily adopts, but it may not include any limitation affecting its ability to make a use or disclosure required by law or permitted by the Rule to avert a serious threat to health or safety. If a group health plan wants to reserve the right to change any voluntary limitations reflected in its notice and apply the change retroactively, it must include certain statements in the notice, as described above.

‍

‍

Revisions To Notice

‍
A group health plan must promptly revise and distribute its notice whenever there is a material change to the privacy practices stated in the notice. A group health plan must provide a revised notice within 60 days of any material revision.

‍

Providing Notice

‍
A group health plan must provide a notice of privacy practices as follows:

1. A group health plan must make its notice available upon request
2. A group health plan must provide an initial notice of privacy practices to each individual covered by the group health plan as follows:
   - No later than April 14, 2003 for individuals who are then covered by the group health plan; and
   - At the time of enrollment, to individuals who are new enrollees.
   - Within 60 days of any material revision to the notice, the group health plan must provide the revised notice to individuals then covered by the plan.
   - No less frequently than once every three years, a group health plan must notify individuals then covered by the plan of the availability of the notice and how to obtain it.
   - If a group health plan has more than one notice, it must provide the notice that is relevant to the individual.
   - A group health plan may not combine the notice in a single document with a consent or an authorization, but may distribute the notice in a newsletter or other communication so long as the notice is sufficiently separate from other important documents.
   - A group health plan may arrange for others, including group health plan sponsors, to distribute its privacy notice, but if individuals do not receive the notice, the group health plan is liable for violation of the Privacy Rule.

‍

Electronic Notice

‍
The Privacy Rule establishes the following requirements regarding electronic notice:

1. A group health plan that maintains a web site that provides information about its customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the site. Posting the notice on a web site does not satisfy the requirement to deliver the notice to the covered individual in hard copy or by email.
2. A group health plan may provide its privacy notice to individuals by e-mail if the individual agrees to electronic notice and the agreement has not been withdrawn. If the group health plan knows that an e-mail transmission failed, a paper copy of the notice must be provided. No particular form of agreement is required. For example, if a group health plan asks an individual applying for coverage to provide an e-mail address where it can send the individual information and the individual provides an address, the group health plan can infer agreement to obtain the privacy notice electronically.
3. An individual who receives notice electronically retains the right to obtain a paper copy upon request.

‍

Documentation

‍
A group health plan must retain copies of its notice for six years following the date that the notice was last in effect.

‍

Privacy Statement

‍
We are authorized to collect Personally Identifiable Information (PII) from you by the State of Utah Department of Insurance. Any PII we collect is used to help individuals secure insurance. If you choose to give us PII, we may share this information with the quoting softwareand the insurance companies we
work with and the people who work directly for The Health Insurance Specialists to secure insurance policies under the following circumstances: the quoting, binding, or servicing of any insurance policy purchased through The Health Insurance Specialists.

‍

Our request to collect PII is strictly voluntary. If you choose not to provide us with the PII requested,
or not to respond to certain questions will result in the inability to quote, bind, and service insurance policies.