THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US.

By law, we are required to protect the privacy of the medical information and other personal information that we keep regarding our participants. We will call this information “Protected Health Information” or “PHI” for the rest of this notice. This notice will tell you how we may use and disclose your PHI and will tell you about your rights and our legal duties regarding your PHI. We are legally required to follow the terms of this notice while it is in effect. In other words, we are only allowed to use and disclose PHI in a manner that we have described in this notice. This privacy practice notice took effect April 14, 2003 and will remain in effect until we replace it.

We may change the terms of this notice in the future. We reserve the right to change this notice and make the new notice provisions effective for all PHI we maintain, use or disclose. If we make any material change in the way we maintain, use or disclose your PHI or to your rights, our duties or other privacy practices stated in this notice, you will get a new notice by mail within 60 days of the change.

Organizations Covered by this Notice

This notice applies to the privacy practices of the State Health Plan and the North Carolina Health Choice for Children Program. In this notice, we will refer to both of these as “the Plan” or “we,” “us,” or “our.”

How We Use and Disclose Your Protected Health Information

This section of our notice explains how we may use and disclose your PHI. Generally, we use and disclose your PHI only as permitted or required by law, or as authorized by you.

When the Plan Must Use or Disclose Your PHI: We must use or disclose your PHI: (1) to you or someone who has the legal right to act for you (your personal representative); (2) to the Secretary of the Department of Health and Human Services if necessary to make sure your privacy is protected; and, (3) when we are required by law. We do not need your authorization to use or disclose your PHI in these three situations.

When the Plan has The Right to Use or Disclose Your PHI: We have the right to use or disclose your PHI: (1) for our payment purposes, and (2) to operate the Plan. We do not need your authorization to use or disclose your PHI in these two situations.

1. Payment: We may use or disclose your PHI to pay for your health care, or to otherwise meet our responsibilities for coverage and benefits. How we may use or disclose your PHI for payment purposes includes, but is not limited to: collecting your premiums; making decisions relating to coverage and payment for your treatment, such as determining if charges for treatment are correct and reasonable and if your treatment is covered by the Plan (including determination of medical necessity); providing reimbursement for your treatment; deciding if you are eligible for coverage with the Plan; coordinating benefits with other insurers; reviewing claims; determining if we can give you a pre-certification or pre-authorization to get treatment; preparing your Explanation of Benefit Summary Notice; for subrogation purposes; or, for adjudicating claims.
   
   Example of a Use or Disclosure for Payment: Let’s say you have a broken leg. Your doctor may give us a bill to pay for treatment of your broken leg. We may review the bill and records about your doctor’s visit, to make sure we are paying the right amount for the right treatment. The PHI we see may include the fact that you got a cast or got x-rays of your leg.
   
2. To Operate the Plan: We may use or disclose your PHI to operate the Plan and to carry out Plan business. This allows us to do such things as improve the quality of care and reduce health care costs. How we may use or disclose your PHI to operate the Plan includes, but is not limited to: making sure you and other Plan participants get health care; for business management and administrative purposes, such as providing customer services to you and resolving any complaints you have; conducting quality assessment and improvement activities; for case management and coordination of care; conducting other activities relating to improving health or reducing health care costs; contacting health care providers with information about treatment alternatives; evaluating the performance of your health care provider; making sure the Plan is operating properly and effectively; for underwriting, premium rating and other activities relating to the creation, renewal or replacement of health benefits; conducting or arranging for medical review, legal services, and auditing; giving you gifts of nominal value; for business planning and development; for transfer of or merger with another entity; or, to comply with this notice and applicable laws.
   
   We may also use or disclose your PHI to:

• Give very limited information to the sponsors of the Plan (such as whether you are enrolled in the Plan); or,
• Contact you to give you appointment reminders, tell you about treatment alternatives or tell you about other health related benefits and services that may be of interest to you (such as to tell you about new or changed services under the Plan, a disease management program or a new treatment or generic prescription).

Example of a Use or Disclosure to Operate the Plan: We may decide, in the future, that a certain prescription will now cost you less money to fill. We may send you a letter to tell you that this prescription will now cost you less money.

When the Plan is Permitted to Use or Disclose Your PHI: In certain situations, the Plan is permitted to use or disclose your PHI without your authorization. These situations are:

• Public Health: for public health purposes (such as reporting disease outbreaks);
• Abuse or Neglect: when using or disclosing your PHI relates to victims of abuse, neglect or domestic violence;
• State or Federal Agencies: to report to State or other federal agencies that have the right to investigate or oversee the Plan, (such as to make sure we are making proper payments, fraud and abuse investigations or health oversight activities);
• Court Proceedings: for judicial and administrative proceedings (such as in response to a court order or to defend against a law suit);
• Law Enforcement: for law enforcement purposes (such as providing limited information to locate a missing person);
• Decedents: when it relates to decedents (such as, disclosing your PHI to a coroner for the purpose of identifying you should you die);
• Organ Donation: for organ, eye or cadaver donation;
• Worker’s Compensation: to comply with worker’s compensation laws;
• Research Studies: for research studies or other such programs that meet all privacy law requirements;
• Safety: to avoid serious and imminent threat to health or safety (such as if disclosing your PHI may prevent injury to another);
• Government Functions: when it relates to special government functions (such as if your PHI relates to military and veteran’s activities, national security and intelligence activities, protective services for the President, and medical suitability or determinations of the Department of State);
• Correctional Institutions: to correctional institutions and to other law enforcement entities in custodial situations (such as, in certain situations, we may disclose your PHI to a correctional institution having lawful custody of you);
• Disaster Relief: for disaster relief (such as to the American Red Cross);
• Other Health Plans or Health Care Providers: generally, for another health care provider’s or health plan’s treatment, payment or health care operations (such as if your doctor needs information to assist in the treatment of you);
• Our Business Associates: to our business associates (we may contract with other people or entities to provide certain services. To perform these services, the business associate may receive, create, maintain, use or disclose your PHI, but only after they agree in writing to protect your PHI);
• Permitted by Law: as we are otherwise permitted by applicable law; and
• De-identification: to create a collection of information that can no longer be traced back to you.

Your Written Authorization: Except for the uses and disclosures that are described in this notice, we are not allowed to use or disclose your PHI without your written authorization. You may give us a written authorization to use or disclose your PHI for any purpose. To get a written authorization form, you may download a copy of it by clicking here. Or PPO plan members may call 1-888-234-2416, to request that a copy be mailed to you. Former Indemnity plan members may call 1-800-422-4658. You must fill out the entire authorization form, sign it and send it to the CPC at the address listed on the form. If you give us an authorization, you may take it back (revoke it) at any time, unless we have already acted based on your authorization. To take back your authorization, you must tell us in writing. You must mail your written authorization or your written revocation to the CPC address listed at the end of this notice.

Family and Friends: As we talked about above, in many situationswe are required by law to get your authorization before we can disclose your PHI to other people. This means that we cannot disclose your PHI to your spouse, other family members or friends until we get your authorization permitting us to do so, except in limited situations (such as emergency situations or if you are available to verbally agree to that disclosure). Generally, we are still allowed to disclose PHI about a minor child to a parent, guardian or other person responsible for the minor child.

Your Rights

You have certain rights regarding your PHI. The following is a list of your rights:

See and Copy Your PHI: You have the right to ask (request) to see and get a copy of the PHI we have about you. Your request must be in writing. We must act on your request within the time period stated in the applicable law. If we deny your request, we will give you an explanation in writing. We may deny your request only for certain reasons, such as: if the PHI you request may endanger another person or is information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding. You may visit our Business Associate’s office or our office (depending upon where the PHI is located and the Business Associate’s availability) to see your PHI, or, you may ask us to mail this PHI to you. We will charge a reasonable fee to cover the cost of copying the PHI. If you wish to see or request a copy of your PHI, PPO Plan members should call 1-888-234-2416 and former Indemnity plan members should call 1-800-422-4658 to request an Access-to-PHI form.

Change, Correct or Delete Your PHI: You have the right to ask us to change, correct or delete your PHI, including medical, billing, enrollment and other records used to make decisions about you. Your request must be in writing and you must explain why you would like us to change, correct or delete your PHI. We must act on your request within the time period stated in the applicable law. If we accept your request, we will tell you and we will make reasonable efforts to tell others, including people you name, of the changes. We will include these changes in any future disclosures of this PHI. We do not have to agree to your request. We may deny your request only for certain reasons, such as if:

1. We believe the information is correct and complete;
2. We did not create the information (unless you prove that the person or entity that did create the information is no longer available to amend the information);
3. The information is not a part of what is used to make decisions about you, or, is not part of a group of records called a “designated record set”; or,
4. The information was compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding.

If we do not agree to your request, we will tell you in writing. You may then give us a statement in writing explaining why you disagree with our decision and stating what you believe is the correct, relevant and fair information. This statement must be of reasonable length. We will put this statement with your PHI and share it with anyone who receives this PHI in the future. You may also ask us to put your request and our denial with any future disclosures of this PHI. We are allowed to put our replies to your request with any future disclosures. To request a change to your PHI, please send it in writing to the Plan at the address listed at the end of this notice.

Right to Request an Accounting of Disclosures: You have the right to get a list of certain disclosures of your PHI that have been made by us or our business associates (this is called an “accounting of disclosures”). Your request must be in writing. We must act on your request within the time period stated in the applicable law. The list will not contain every type of disclosure (such as, PHI that was given to you or your personal representative, that was given out to pay for your health care, for our operations, or for law enforcement purposes). You have the right to this accounting of disclosures for the 6 years prior to the date you make the request, but not before April 14, 2003. This list will have the date on which the disclosure was made, the name of the person or entity that received your PHI, a description of the PHI that was disclosed, the reason for the disclosure, and certain other information. If you request this list more than once in a 12 month period, we may charge a reasonable fee for preparing the list. An appropriate state or federal agency may temporarily suspend your right to an accounting of disclosures. If you wish to get an accounting of disclosures, PPO plan members should call 1-888-234-2416 and former Indemnity plan members should call 1-800-422-4658 to ask for an Accounting of Disclosure form.

Right to Confidential Communication: If you believe that a disclosure of your PHI may put you in danger, you have the right to ask us to communicate with you confidentially at a different location or by a different means (for example, if we usually send your information to your home address, you may ask that we send your information to your work address). Your request must be in writing. However, if you are in immediate danger we may accept your verbal request. In order to agree to your request, we may require that you tell us how payment will be made in the future and specify where we can contact you. If you wish to request a confidential communication, PPO Plan members should call 1-888-234-2416 and former Indemnity plan members should call 1-800-422-4658 to ask for a Confidential Communication Request form. Once we have received your Confidential Communication request, we will terminate all previous authorizations.

Right To Request Restrictions: You have the right to ask us to limit (restrict) how your PHI is used and disclosed for treatment, payment or Plan operation purposes or when it is disclosed to those involved with your care or payment for care. Your request must be in writing. We are not required to agree to your request. In most instances, we will not agree to restrictions, other than the Confidential Communication request as described above. If we agree to your request, we will comply with your restriction to the extent required by law. However, even if we agree to your request, there are certain situations where we are not allowed to follow your requested restriction (such as for emergency situations, law enforcement purposes or to pay a health care provider for treatment provided to you). Also, if we agree to your request, we may cancel (stop) the restriction at any time. We will inform you of any cancellation in writing. You may cancel the restriction at any time in writing. Please send your request or cancellation to the Plan at the address listed at the end of this notice.

Right to Receive a Copy of this Notice: You have the right to get a separate paper copy of this notice. PPO Plan members should call 1-888-234-2416 and former Indemnity plan members should call 1-800-422-4658. You may also get a copy of this notice by going to our Web site: www.shpnc.org.

Right to Submit a Complaint: If you believe your privacy rights have been violated, you may file a complaint with us at: NC State Health Plan and NC Health Choice, 4901 Glenwood Avenue, Suite 150, Raleigh NC 27612-3820, Attention: HIPAA Privacy Officer. You may also file a complaint with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint; in other words, doing this will not affect your benefits under the Plan.

How to Request and Submit Forms Regarding Your Rights:

1. To request any forms to exercise your rights, an authorization form, or a copy of this notice, PPO Plan members should call 1-888-234-2416 and former Indemnity plan members should call 1-800-422-4658.
2. Once you fill out and sign an authorization form, members must then mail the completed form to:
   
   State Health Plan
   c/o BCBSNC Appeals Department
   PO Box 30055
   Durham NC 27702-3055
   
3. Once you fill out and sign any of the forms to exercise your rights, you must then mail the completed form to the Plan at the address listed below.

Additional Information: For more information on filing a complaint or about matters covered in this notice or to submit a request form, please call or write us at:

Attn: HIPAA Privacy Officer
State Health Plan and NC Health Choice
4901 Glenwood Avenue, Suite 150
Raleigh NC 27612-3820

Or call: (919) 881-2300 and ask to speak to our HIPAA Privacy Officer about our privacy notice.

 
 
 

HIPAA FAQs
Health Plan Options