University of Notre Dame du Lac Group Benefits Plan Notice of Privacy Practices

See this Notice in PDF

Original Effective Date April 14, 2003

Last Revised Effective July 31, 2014

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions about this Notice as well as specific policies, please contact the University of Notre Dame du Lac Group Benefits Plan HIPAA Privacy Official, at (574) 631-5900 for further information.

This Notice of Privacy Practices describes how the University of Notre Dame du Lac Group Benefits Plan (“the Plan”) may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. This Notice also describes your rights to access and control your protected health information, as well as certain obligations the Plan has regarding the use and disclosure of your protected health information. “Protected health information” (“PHI”) is medical information about you that relates to your past, present, or future physical or mental health or condition and related health care services.

The Plan is required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. The Plan is also required to abide by the terms of this Notice as currently in effect. This Notice also covers our third party “business associates” who perform various activities for the Plan to provide you treatment or to administer the Plan’s business. Before the Plan discloses any of your PHI to one of its business associates, the Plan will enter into a written contract with them that contains terms to protect the privacy of your PHI.

USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION

The following describes the different reasons for which the Plan may use and disclose your PHI, if also allowed by state law.

Treatment: The Plan may use your PHI to provide you with medical services.

Payment: The Plan may use and disclose your PHI so that it may provide reimbursement or determine eligibility for reimbursement for health care services you received.

Health Care Operations: The Plan may use and disclose your PHI for health care operations. Health care operations include such things as quality assessment and improvement activities, underwriting, premium rating, management and general administrative activities.

Individuals Involved in Your Health Care or Payment for Your Health Care: The Plan may disclose your PHI to a family member who is involved in your medical treatment or care. The Plan may also disclose this information to a person who is involved in the financing of your health care.

As Required by Law: The Plan may disclose your PHI when requested by a law enforcement official as part of law enforcement activities; in emergency circumstances; or when required to do so by federal, state, or local law. The Plan may also disclose your PHI in response to a subpoena, discovery request, or other lawful order from a court.

Public Health Activities: The Plan may disclose your PHI to public health authorities to prevent or control disease, injury, or disability.

Health Oversight Activities: The Plan may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, and licensure.

Coroners, Medical Examiners, Funeral Directors, Donation: The Plan may disclose your PHI to a coroner or medical examiner related to the coroner’s duties such as identification. The Plan may disclose your PHI to funeral directors to carry out their duties. The Plan may disclose your PHI for organ, eye or tissue donation purposes.

Workers’ Compensation: The Plan may disclose PHI for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

To Avert a Serious Threat to Health and Safety: The Plan may use and disclose your PHI when the Plan believes it
is necessary to prevent a serious threat to your health and safety or the health and safety of another person or the public.

Military and Veterans: If you are a member of the armed forces, the Plan may disclose health information about you as required by military command.

Research: The Plan may use or disclose your PHI for research purposes without your authorization if we obtain approval by an Institutional Review Board or other appropriate privacy board.

Correctional Institution: The Plan may disclose your PHI to correctional institutions or other law enforcement custodial situations.

Fundraising: The Plan may use or disclose your PHI to contact you for fundraising activities and you have the right to opt out of receiving such communications.

Underwriting: If the Plan intends to use or disclose your PHI for underwriting purposes, the Plan is prohibited from using or disclosing your genetic information for such underwriting purposes.

Disclosure of Student Immunization to Schools: The Plan may disclose your PHI for proof of immunization to a school where the law requires the school to have the information prior to admission. The Plan will obtain verbal permission from the parent or other legal guardian for such disclosure.

Plan Sponsor (“The University”): The Plan may disclose your PHI to the University to carry out plan administration functions that the University performs.

Uses and Disclosures Usually Requiring Authorization: Most uses and disclosures of psychotherapy notes require the Plan to obtain an authorization. In addition, in most instances, the Plan cannot use or disclose your PHI for marketing purposes or sell your PHI without your written authorization.

Other Uses and Disclosures of Your Protected Health Information: Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to the Plan, will be made only with your written authorization. If you have given the Plan your authorization, you may revoke that authorization, in writing, at any time. If you revoke your authorization, the Plan will no longer use or disclose the PHI for the reasons covered by your written authorization, except to the extent that the Plan has taken action in reliance on your authorization.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

You have the following rights regarding your PHI that the Plan maintains, as required by law. To exercise your rights, you must submit your request in writing to:

University of Notre Dame du Lac Group Benefits Plan HIPAA Privacy Official
100 Grace Hall
Notre Dame, IN 46556

Right to Notice of Breach: In the event there is a breach of your unsecured PHI, the Plan is required to notify you of such breach.

Right to Request Restrictions. You have the right to request a restriction or limitation on the use or disclosure of your PHI for purposes of treatment, payment, health care operations, or communications with family. The Plan is not required to agree to a restriction.

Right to Request Confidential Communications. You have the right to request that the Plan send communications that contain your PHI by alternative means or to alternative locations. The Plan must accommodate your request if it is reasonable and you clearly state that the disclosure of all or part of that information could endanger you.

Right to Inspect and Copy. You have the right to inspect and copy any of your PHI that the Plan maintains.

Right to Amend. You have the right to request that the Plan amend your PHI if it is incorrect or incomplete.

Right to an Accounting of Disclosures. You have the right to receive an accounting of disclosures of your PHI made by the Plan in the six years prior to the date the accounting is requested (or shorter period as requested). This does not include disclosures made to carry out treatment, payment and health care operations; disclosures made to you; communications with family; for national security or intelligence purposes in accordance with HIPAA; or disclosures made prior to the HIPAA compliance date of April 14, 2003. The first accounting you request within a 12 month period will be free. For additional accountings, we may charge a reasonable cost-based fee.

Right to a Paper Copy of this Notice. You have the right to obtain a paper copy of this Notice of Privacy Practices at any time. You may also obtain a paper copy of this Notice at the website: hr.nd.edu/nd-faculty-staff/fed/

CHANGES TO THIS NOTICE

The Plan reserves the right to change the terms of this Notice. The Plan also reserves the right to make the new Notice provisions effective for all PHI currently maintained, as well as any PHI the Plan receives in the future. A copy of the current Notice will be posted on the bulletin board outside of 200 Grace Hall. If we change this Notice, we will either post the revised Notice on our website: hr.nd.edu/nd-faculty-staff/fed/ or we will send you a revised Notice.

COMPLAINTS

If you believe your privacy rights have been violated, you may submit a complaint in writing to:

University of Notre Dame du Lac Group Benefits Plan HIPAA Privacy Official
100 Grace Hall
Notre Dame, IN 46556

You may also file a complaint with the Secretary of the Department of Health and Human Services. You will not
be retaliated against or penalized for filing a complaint.