This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Questions? Call 404-656-6322 (Atlanta) or 800-610-1863 (outside of Atlanta).
The DCH and the State Health Benefit Plan Are Committed to Your Privacy.
The Georgia Department of Community Health (DCH) sponsors and runs the State Health Benefit Plan (the Plan). We understand that your information is personal and private. Some DCH employees and companies hired by DCH collect your information to run the Plan. The information is called "Protected Health Information" or "PHI." This notice tells how your PHI is used and shared. We follow the information privacy rules of the Health Insurance Portability and Accountability Act of 1996, ("HIPAA").
Only Summary Information is Used When Developing and Changing the Plan.
The Board of Community Health and the Commissioner of the DCH make decisions about the Plan. When making decisions, they review reports. These reports explain costs, problems, and needs of the Plan. These reports never include information that identifies any person. If your employer is allowed to leave the Plan, your employer may also get summary reports.
Plan Enrollment Information and Claims Information is Used in Order to Run the Plan.
PHI includes two kinds of information. "Enrollment Information" includes: 1) your name, address, and social security number; 2) your enrollment choices; 3) how much you have paid in premiums; and 4) other insurance you have. This Enrollment Information is the only kind of PHI your employer is allowed to see. "Claims Information" includes information your health care providers send to the Plan. For example, it may include bills, diagnoses, statements, x-rays or lab test results. It also includes information you send to the Plan. For example, it may include your health questionnaires, enrollment forms, leave forms, letters and telephone calls. Lastly, it includes information about you that is created by the Plan. For example, it includes payment statements and checks to your health care providers.
Your PHI is Protected by Law.
Employees of the DCH and employees of outside companies hired by DCH to run the Plan are "Plan Representatives." They must protect your PHI. They may only use it as allowed by HIPAA.
The DCH Must Make Sure the Plan Complies with HIPAA.
As Plan sponsor, the DCH must make sure the Plan complies with HIPAA. We must give you this notice. We must follow its terms. We must update it as needed. The DCH is the employer of some Plan Members. The DCH must name the DCH employees who are Plan Representatives. No DCH employee is ever allowed to use PHI for employment decisions.
Plan Representatives Regularly Use and Share your PHI in Order to Pay Claims and Run the Plan.
Plan Representatives use and share your PHI for payment purposes and to run the Plan. For example, they make sure you are allowed to be in the Plan. They decide how much the Plan should pay your health care provider. They also use PHI to help set premiums for the Plan and manage costs but they are never use genetic information for these purposes. Some Plan Representatives work for outside companies. By law, these companies must protect your PHI. They also must sign "Business Associate" agreements with the Plan. Here are some examples what they do.
Process all medical and drug claims; communicate with Members and their health care providers; and give extra help to Members with some health conditions.
Data Analysis, Actuarial Companies:
Keep health information in computer systems, study it, and create reports from it.
Attorney General's Office, Auditing Companies, Outside Law Firms:
Provide legal and auditing help to the Plan.
Information Technology Companies:
Help improve and check on the DCH information systems used to run the Plan.
Some Plan Representatives work for the DCH. By law, all employees of the DCH must protect PHI. They also must get special privacy training. They only use the information they need to do their work. Plan Representatives in the SHBP Division work full-time running the Plan. They use and share PHI with each other and with Business Associates in order to help pay claims and run the Plan. In general, they can see your Enrollment Information and the information you give the Plan. A few can see Claims Information. DCH employees outside of the SHBP Division do not see Enrollment Information on a daily basis. They may use Claims Information for payment purposes and to run the Plan.
Plan Representatives May Make Special Uses or Disclosures Permitted by Law.
HIPAA has a list of special times when the Plan may use or share your PHI without your authorization. At these times, the Plan must keep track of the use or disclosure.
To Comply with a Law, or to Prevent Serious Threats to Health or Safety:
The Plan may use or share your PHI in order to comply with a law, or to prevent a serious threat.
For Public Health Activities:
The Plan may give PHI to government agencies that perform public health activities. For example, the Plan may give PHI to DCH employees in the Public Health Division who need it to do their jobs.
For Research Purposes:
Your PHI may be given to researchers for a research project approved by a review board. The review board must review the research project and its rules to ensure the privacy of your information.
Plan Representatives Share Some Payment Information with the Employee.
Except as described in this notice, Plan Representatives are allowed to share your PHI only with you, and with your legal personal representative. However, the Plan may inform the employee family member about whether the Plan paid or denied a claim for another family member.
You May Authorize Other Uses of Your PHI.
You may give a written authorization for the Plan to use or share your PHI for a reason not listed in this notice. If you do, you may take away the authorization later by writing to the contact below. The old authorization will not be valid after the date you take it away.
You Have Privacy Rights Related to Plan Enrollment Information and Claims Information that Identifies You.
Right to See and Get a Copy your Information, Right to Ask for a Correction:
Except for some reasons listed in HIPAA, you have the right to see and get a copy of information used to make decisions about you. If you think it is incorrect or incomplete, you may ask the Plan to correct it.
Right to Ask for a List of Special Uses and Disclosures:
You have the right to ask for a list of special uses and disclosures that were made after April, 2003.
Right to Ask for a Restriction of Uses and Disclosures, or for Special Communications:
You have the right to ask for added restrictions on uses and disclosures. You also may ask the Plan to communicate with you in a special way.
Right to a Paper Copy of this Notice, Right to File a Complaint Without Getting in Trouble:
You have the right to a paper copy of this notice. Please contact the SHBP HIPAA Privacy Unit or print it from www.dch.ga.gov. If you think your privacy rights have been violated, you may file a complaint. You may file the complaint with the Plan and/or the Department of Health and Human Services. You will not get in trouble with the Plan or your employer for filing a complaint.
Addresses for Complaints:
SHBP HIPAA Privacy Unit
P.O. Box 1990
Atlanta, Georgia 30301
800-610-1863 (outside Atlanta)
U.S. Department of Health & Human Services
Office for Civil Rights
Region IV Atlanta Federal Center
61 Forsyth Street SW
Atlanta, GA 30303-8909