I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. WE HAVE A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI)
We are legally required per the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to protect the privacy of your health information. The HIPAA Privacy regulations generally do not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other federal laws, rather than the HIPAA Privacy regulations, might impose a privacy standard under which we will be required to operate.
Protected health information, or PHI for short, is information about you that we’ve created or received, including demographic information, that may identify you and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or the payment for this health care. We must provide you with this Notice about our privacy practices that explains how, when and why we use and disclose your PHI. With some exceptions, we may not use or disclose more of your PHI than is necessary. We are legally required to follow the privacy practices described in this Notice.
However, subject to the requirements of law, we reserve the right to change the terms of our privacy practices and this Notice at any time. Any changes also will apply to PHI we already possess. If and when there is a material change in our privacy practices, we will promptly revise and redistribute this Notice and post the Notice in the Master Policy issued to the policyholder. At any time, you may request a copy of our then current Notice of Privacy Practices from the Privacy Officer identified in Section V of this Notice, or you may view the Notice on our Web site at www.markelmedical.com.
III. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION
We use and disclose health information for many different reasons. As an insurance company, we provide many different types of coverage. The amount of PHI that we use or disclose depends upon the individual circumstances and is limited to the minimum necessary for the operation of our business. We do not use or disclose your PHI for any fundraising, marketing or research activities.
Below, we describe different categories of our uses and disclosures of PHI and give you some representative examples of each category; however, these examples are not exhaustive of the types of uses and disclosures that may be made by our company.
A. Uses and Disclosures Relating to Claims Payment or Underwriting Operations May Be Made without Your Prior Written Authorization. We may use and disclose your PHI for the following reasons:
- Claims Payment Functions.
We may use and disclose your PHI to determine eligibility for plan benefits, facilitate payment for the treatment and services provided to you, determine plan responsibility for benefits, and to coordinate benefits. For example, we may disclose your PHI to third party administrators and other business associates that perform various activities on our behalf such as claims processing and claims payment. We may also request additional information from you or your medical provider in order to determine eligibility for a specific claim and to determine the benefits allowed under your policy.
Whenever arrangements between our company and a business associate involve the use or disclosure of PHI, we will contractually require our business associates to protect the privacy of PHI.
- Underwriting Operations.
We may use and disclose your PHI to carry out other necessary insurance-related activities. For example, such activities may include underwriting, premium rating, premium collection and other activities relating to plan coverage; conducting quality assessment and improvement activities; submitting claims for stop-loss coverage or re-insurance; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; and business planning, management and general administration.
- Health Plan Policyholders.
We may use and disclose your PHI to the Policyholder of the Health Plan if the Plan documents state that such information is required, provided appropriate safeguards and procedures are in place to protect PHI provided to the Policyholder. For example, we may disclose your PHI to the Policyholder for the purposes of analyzing claim history and trends in order to enhance plan benefits and manage costs.
- Disclosures for Claim Status.
We do not disclose information regarding diagnosis, procedure codes, and any PHI beyond the minimum necessary to process a claim or answer a claim status inquiry. Your medical care provider is the appropriate source for all inquiries regarding medical diagnosis and treatment. For example, when our claims department responds to a claim inquiry, we only disclose information related to the status of a claim.
B. Other Permitted and Required Uses and Disclosures Also May Be Made without Your Prior Written Authorization. We also may use and disclose your PHI in the following situations without your prior written authorization. If required by law, you will be notified of any such uses and/or disclosures.
- Disclosures required by federal, state or local law.
We may use or disclose your PHI to the extent that such use or disclosure is required by law. For example, we make disclosures when a law requires that we report information to government agencies. Any such use or disclosure will be made in compliance with applicable law.
- Government Oversight.
We may disclose PHI to government agencies in connection with audits, investigations, inspections, and other activities authorized by law. For example, government agencies that oversee the health care system, government benefit programs, and other government regulatory programs may seek this information.
- Legal Proceedings and Law Enforcement.
As required by law, we may disclose PHI in the course of any judicial or administrative proceeding or arbitration or for other law enforcement purposes. For example, we may disclose PHI when responding to a subpoena, discovery request, or court order.
- Required Uses and Disclosures.
Under law, we must make disclosures to you upon your request. We also must make disclosures in connection with investigations by the Secretary of the Department of Health and Human Services of our compliance with the requirements of Section 164.500 et. seq., of the Health Insurance Portability and Accountability Act of 1996,as amended (HIPAA).
C. Other Permitted Uses and Disclosures May Be Made with Your Prior Written Authorization. If there is a situation not described in section III A or III B, we will ask for your written authorization before using or disclosing any of your PHI. If you choose to sign an authorization to use and disclose your PHI, you can later revoke that authorization in writing to stop any future uses and disclosures (to the extent that we haven't taken any action relying on the authorization). Samples of the Authorization and Revocation forms may be obtained from the Privacy Officer identified in Section V or you may download copies from our Web site at www.markelmedical.com.
We may provide your PHI relating to a specific submitted claim to a Legal Guardian, person with Medical Power of Attorney or other person that you indicate is involved in your health care or the payment for your health care. The PHI that may be disclosed will be the minimum necessary to process a claim or answer the claim status inquiry. For example, when our claims department processes a claim inquiry or claim update, we do not disclose information regarding the diagnosis or procedure codes. The only information disclosed will be directly related to the status of a claim.
If you would like to designate someone as a personal representative, you must complete and sign an Authorized Representative form. A sample of the Authorized Representative form may be obtained from the Privacy Officer identified in Section V or you may download a copy from our Web site at www.markelmedical.com.
IV. YOUR RIGHTS REGARDING YOUR PHI AND HOW YOU MAY EXERCISE THOSE RIGHTS
The following identifies certain rights you have with respect to your PHI and briefly describes how you may exercise those rights.
A. Your Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask that we limit how we use and disclose your PHI. We will consider your request, but are not legally required to agree to it. You may not limit the uses and disclosures that we are legally required to make. Your request must be in writing, must state the specific restriction requested, and indicate to whom you want the restriction to apply. If we agree to your request, we will put any limits in writing and abide by them except in emergency situations. You may request a restriction by writing to the Privacy Officer identified in Section V.
B. Your Right to Review and Get Copies of your PHI. In most cases, you have the right to review and/or get copies that we may have of your PHI contained in a designated record set. A "designated record set" contains claim records, Explanation of Benefits (EOB's), and possibly medical records if they were required as part of the claims payment determination. Your request must be in writing. If the information was created or was received through another source such as your medical provider, we may refer you to them to review and/or get copies of your PHI. We will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. If we deny your request, we will tell you in writing our reasons for the denial and explain your rights to have the denial reviewed.
Under federal law, however, you may not review or get copies of the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and PHI that is subject to any law that prohibits access to such PHI. Depending on the circumstances, a decision to deny access may be reviewed. Please contact the Privacy Officer identified in Section V if you have questions about access to your PHI.
If you request copies of your PHI, we will charge you $1.00 for each page. As an alternative for the PHI you request, we may provide you with a summary or explanation of the PHI as long as you agree to that and the cost in advance. You may request to review or get copies of your PHI by writing to the Privacy Officer identified in Section V.
C. Your Right to Choose How We Communicate with You. You have the right to request that we communicate with you about your PHI by alternative means or to alternative locations, for example, sending information to your work address rather than your home address. Your request must be in writing. We will accommodate reasonable requests and we will not ask for an explanation for the basis of the restriction. We must agree to your request so long as we can easily provide it in the format you requested and the costs are in line with our standard procedures, otherwise there may be a charge for the service. Our standard procedure is to use the address given to us on the claim form. You may request an alternative means or location by writing to the Privacy Officer identified in Section V.
D. Your Right To Get an Accounting of Disclosures We Have Made. You have the right to get a list of certain instances in which we have disclosed your PHI. The list will not include uses or disclosures such as those made for claims payment or underwriting operations or those that you have already authorized. The list also will not include uses or disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made before March 31, 2003.
We will respond within 60 days of receiving your request, which must be made in writing. The list we will give you will include disclosures made in the last six years, but not before March 31, 2003, unless you request a shorter timeframe. The list will include the date of disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. We will provide the list to you at no charge, but if you make more than one request within a 12 month period, we will charge you $10.00 for each additional request. You may request an accounting of your disclosures by writing to the Privacy Officer identified in Section V.
E. Your Right to Correct or Update your PHI. If you believe that there is a mistake in your PHI that we create or maintain in a designated record set, or that a piece of important information is missing, you have the right to request that we correct the existing information or add the missing information for as long as we maintain this information. If we are not the source of the information or the cause of the incorrect information, we will attempt to refer you to the appropriate source to resolve your request. You must provide the request and your reason for the request in writing.
We will respond in writing within 60 days of receiving your written request. We may deny your request if the PHI is (i) correct and complete, (ii) not created by us, (iii) not allowed to be disclosed, or (iv) not part of our records. Our denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you do not file a written statement of disagreement, you have the right to request that your correction request and our denial be attached to all future disclosures of your PHI. If we approve your request, we will make the change to your PHI, tell you that we have done it, and tell others that need to know about the change to your PHI. If you have questions about amending your medical records, please write to our Privacy Officer identified in Section V.
F. Your Right to Receive This Notice by Electronic Means. You have the right to receive a copy of this Notice by e-mail or from our web site. Even if you agree to receive the Notice electronically, you also have the right to request a paper copy of this Notice. You may request a paper copy of this Notice by contacting the Privacy Officer identified in Section V.
V. HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
You may complain to us or to the Secretary of the Department of Health and Human Services if you believe that we may have violated your privacy rights or if you disagree with a decision we have made about access to your PHI. You may file your complaint with the Privacy Officer identified below. All complaints must be submitted in writing.
You may also send a written complaint to the Secretary of the Department of Health and Human Services. We will provide you with the address and the information necessary to file your complaint with the Secretary of the Department of Health and Human Services. We support your right to the privacy of your PHI. We will not retaliate in any way if you choose to file a complaint with us or with the Department of Health and Human Services.
Contact Office:
Privacy Officer
Markel Insurance Company
4600 Cox Road
Glen Allen, VA 23060
(800) 431-1270
E-mail: information@markelcorp.com or eService@markelcorp.com
Web site: http://markelmedical.com/www.markelmedical.com
VI. EFFECTIVE DATE OF THIS NOTICE
This notice becomes effective on March 31,2003.
< < top