Health Insurance Portability and Accountability Act (HIPAA) Privacy
FCPS Group Health Plan Notice of Privacy Practices
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Effective Date: April 14, 2003 | Amended Date: April 18, 2005 | July 13, 2012 /May 21, 2013/September 9, 2013/February 25, 2015
This notice describes how medical information may be used and disclosed and how you can get access to this information. Please review it carefully.
Fairfax County Public Schools (FCPS) Group Health Plan (the “Plan” or “we”) is committed to protecting the privacy of your “protected health information (PHI).” Protected health information referred to as “medical information” in this Notice, is information that identifies you and relates to your physical or mental health or to the provision or payment of health services for you. We create, receive, and maintain your medical information when the Plan provides health benefits to you and your covered dependents. We are required to provide you with certain rights related to your medical information.
We have the following legal obligations under federal health privacy law—the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the related regulations to:
- Maintain the privacy of your medical information
- Provide you with this Notice of our legal duties and privacy practices with respect to your medical information
- Abide by the terms of this Notice currently in effect
This Notice becomes effective as of the effective date of your health coverage and will remain in effect unless and until we publish a revised Notice.
Who Will Follow This Notice
This Notice discusses the practices of the Plan regarding your medical information and the standards to which it will hold any third parties (such as health insurance companies) that assist in the administration of the Plan.
Information Subject to This Notice
This notice of Privacy Practices applies to FCPS’ Health Plans covered by HIPAA regulations, for example, health benefits plans, dental plans, vision plan, pharmacy benefit programs, and flexible medical spending account, collectively the “Plan.” We, as the Plan, create, receive, and maintain certain medical information about you to help provide health benefits to you, as well as to fulfill legal and regulatory requirements. We obtain this medical information from applications and other forms that you may complete, through conversations you may have with our benefits administrative staff and health care professionals, and from reports and data provided to us by health care service providers, insurance companies, and other third parties.
The medical information we have about you includes, among other things, your name, address, phone number, birth date, Social Security number, and health claims information. This is the information that is subject to the privacy practices described in this Notice. This Notice does not apply to medical information created, received, or maintained by FCPS on behalf of the non-health employee benefits that it sponsors, including disability benefits and life insurance benefits. This Notice also does not apply to medical information that FCPS requests, receives, and maintains about you for employment purposes, such as employment testing or determination of your eligibility for medical leave benefits or disability accommodations.
Summary of the Plan’s Privacy Policies
The Plan’s Uses and Disclosures of Your Medical Information
Generally, you must provide a written authorization to us in order for us to use or disclose your medical information. However, we may use and disclose your medical information without your authorization for administering the Plan and for processing claims. We also may disclose your medical information without your authorization for other purposes as permitted by the federal health privacy law, such as health and safety, law enforcement, or emergency purposes. The law also requires us to disclose medical information when required by the Secretary of the U.S. Department of Health and Human Services to investigate or determine our compliance with the requirements of HIPAA.
Your Federal Rights Under HIPAA Regarding Your Medical Information
Under 45 CFR Parts 160 and 164, (Standards for Privacy of Individually Identifiable Health Information) you have several rights regarding medical information. You have the right to:
- Inspect, access, and/or copy your medical information
- Request that your medical information be amended
- Request an accounting of certain disclosures of your medical information
- Request certain restrictions related to the use and disclosure of your health information
- Request to receive your medical information through alternative means or location for receiving confidential communications
- Request an electronic copy of your electronic medical records
- Request restriction of information sharing regarding services you pay for yourself
- Receive notification upon a breach of your unsecured Protected Health Information
- File a complaint with the Plan or the secretary of the Department of Health and Human Services if you believe that your privacy rights have been violated or a breach has occurred
- Receive a paper copy of this Notice
Contact Information
If you have any questions or concerns about the Plan’s privacy practices or about this Notice or if you want to obtain additional information about the Plan’s privacy practices, contact:
HIPAA Compliance Officer
Fairfax County Public Schools
Department of Human Resources
Office of Employee Relations (OER
8115 Gatehouse Road, Suite 2500
Falls Church, VA 22042
Phone: 571-423-3070
Fax: 571-423-5051
Detailed Notice of the Plan’s Privacy Practices
This Notice Describes How Medical Information About You May Be Used and Disclosed and How You Can Get Access to This Information. Please Review it Carefully.
How the Plan May Use and Disclose Health Information About You
Except as described in this section, as provided for by federal health privacy law, or as you have otherwise authorized, we only use or disclose your health information for administering the Plan and processing health claims. The uses and disclosures that do not require your authorization are described below with specific examples of such disclosures.
Please note that most of the medical information about you will be handled by the insurance companies and business associates that administer the Plan, not the FCPS Office of Benefits Services. Occasionally, however, the Office of Benefits Services will receive or maintain such information. The Plan’s contracts with these insurance companies require them to protect the privacy of your medical information. The purpose of this Notice is to advise you about how the Plan and the business associates that work for the Plan may use that information.
For Treatment
We are not aware of any circumstances under which FCPS will be providing treatment information about you to health care providers. In the event that such inquiries are made, however, we may use or disclose medical information about you to facilitate medical treatment or services by providers. For example, we might disclose information about your prior prescriptions to a pharmacist to determine if a pending prescription is contraindicative with prior prescriptions.
For Payment
We may use and disclose medical information about you to determine eligibility for Plan benefits, to facilitate payment for the treatment and services you receive from health care providers, to determine benefit responsibility under the Plan, or to coordinate your coverage. Our business associates may confer with your health care provider to determine whether a particular treatment is medically necessary or to determine whether the Plan will cover the treatment. We may also share medical information with a utilization review or precertification service provider. Likewise, we may share medical information with another entity to assist with the adjudication or subrogation of health claims or with another health plan to coordinate benefit payments.
For Health Care Operations
We may use and disclose medical information about you to run the Plan efficiently and in the best interests of all its participants. For example, we may use medical information in connection with conducting quality assessment and improvement activities; underwriting, premium rating, and other activities relating to Plan coverage; or conducting or arranging for medical reviews, legal services, audit services, and the fraud and abuse detection program.
Disclosures to Health Plan Sponsor
We do not disclose your medical information to the Plan Sponsor (FCPS). We may share de-identified aggregate information with the Plan Sponsor for plan administration purposes including, but not limited to quality assurance, monitoring, or auditing functions. FCPS will not use your medical information for non-Plan purposes or for purposes not covered by this Notice, such as employment decisions.
Disclosures to Business Associates
We may disclose certain medical information, without your authorization, to our “business associates.” Business associates are third parties that assist us in the Plan’s operations, such as insurance companies. For example, we may share your claims information with business associates that provide claims processing services to the Plan, and we may disclose your medical information to our business associates for actuarial and audit purposes and legal services. We enter into contracts with these business associates to ensure that they protect the privacy of your medical information.
As Required by Law: Lawsuits and Disputes
We may disclose medical information about you when required to do so by federal, state, or local law and by related judicial and administrative proceedings. For example, we may disclose your medical information in response to a subpoena, discovery request, court or administrative order, or other legal process.
Health or Safety
We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or to the health and safety of the public or another person. We also may disclose your health information for public health activities such as preventing or controlling disease, injury, or disability; reporting births and deaths; or reporting child abuse or neglect.
Emergency Situations
We may use or disclose your medical information to a family member or close personal friend involved in your care in the event of an emergency or to a disaster relief entity in the event of a disaster.
Others Involved in Your Care
In limited circumstances, we may use or disclose your medical information to a family member, close personal friend, or others whom we have verified are involved in your care or payment for your care. For example, your medical information may be disclosed if you are seriously injured and unable to discuss your case with us. Also, in certain circumstances, we may advise a family member or close personal friend about your general condition, location (such as in the hospital), or death.
Personal Representatives
Your medical information may be disclosed to people whom you have authorized to act on your behalf or to people who have a relationship with you that gives them the right to act on your behalf. Examples of personal representatives are parents for minors and those who have power of attorney for adults.
Treatment and Health-Related Benefits Information
Our business associates and we may contact you to provide information about treatment alternatives or other health-related benefits and services that may interest you, including, for example, alternative treatment, services, and education.
Research
We do not use your medical information for research purposes.
Organ and Tissue Donation
If you are an organ donor, we may use or disclose your medical information to an organ donor or procurement organization to facilitate an organ or tissue donation transplantation.
Deceased Individuals
The medical information of a deceased individual may be disclosed to coroners, medical examiners, and funeral directors so that those professionals can perform their duties.
Military and Veterans
If you are a member of the armed forces or a veteran, we may release medical information about you in order to comply with laws and regulations related to military service or veterans’ affairs. We may also release medical information about foreign military personnel to the appropriate foreign military authority.
Workers’ Compensation
We do not release your medical information for workers’ compensation program without your authorization.
Health Oversight Activities
We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections, and licensure.
Data Breach Notification Purposes
We may use or disclose your Protected Health Information to provide legally required notices of unauthorized access to or disclosure of your health information.
Law Enforcement
- To help law enforcement officials in their law enforcement duties.
- To respond to a court order, subpoena, warrant, summons, or similar process.
- To identify or locate a suspect, fugitive, material witness, or missing person.
- To provide information about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement.
- To provide information about a death that may be the result of criminal conduct.
- To provide information about criminal conduct on FCPS property.
- In emergency circumstances, to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
National Security and Intelligence Activities
We may release medical information about you to authorized federal officials for intelligence, counterintelligence, protection of public officials, and other national security activities authorized by law.
Genetic Information Nondiscrimination Act (GINA)
We do not use or disclose genetic information for underwriting purposes or for any other reason.
Other Uses and Disclosures for Fundraising and Marketing Purposes
We do not use your medical information for fund-raising and marketing purposes.
Any Other Uses and Disclosures Require Your Express Written Authorization
Uses and disclosures of your medical information other than those described above will be made only with your express written authorization. You may revoke your authorization in writing. If you do so, we will not disclose the medical information covered by the revoked authorization except to the extent the Plan has already relied on your authorization. You also should understand that insurance laws might affect your ability to revoke your authorization.
Once your medical information has been disclosed pursuant to your authorization, the federal health privacy protections may no longer apply to the disclosed medical information, and that information may be redisclosed by the recipient without your or our knowledge or authorization.
Your Federal Rights Under HIPAA Regarding Your Medical Information
Under 45 CFR Parts 160 and 164 (Standards for Privacy of Individually Identifiable Health Information), you have several rights regarding medical information that the Plan creates, receives, and maintains about you. You should address such requests to exercise your rights to:
HIPAA Compliance Officer
Fairfax County Public Schools
Department of Human Resources
Office of Employee Relations
8115 Gatehouse Road, Suite 2500
Falls Church, VA 22042
Phone: 571-423-3070
Fax: 571-423-5051
Your Individual Rights
You have the following individual rights regarding medical information we maintain about you:
Right to Access
You have the right to request healthcare records. This right is not absolute. You have the right to obtain and review a copy of your protected health information in the Plan’s or its Business Associates designated record set that may be used to make decisions about your Plan benefits. You must submit your request in writing to the Compliance Officer at the address above. If you request a copy of the information, we may charge a fee for the costs of copying and mailing that information.
We may deny your request to inspect and copy that health information in certain very limited circumstances, such as certain psychotherapy notes and information compiled for certain legal proceedings. If you are denied access to health information, we will inform you in writing, and in certain circumstances, you may request that the denial be reviewed.
Right to Your Medical Records
If your Protected Health Information is maintained in an electronic format (known as an electronic medical record or an electronic health record), you may request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your Protected Health Information in the form or format of your request if it is readily producible in such form or format. If the Protected Health Information is not readily producible in the form or format you request your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable fee for the labor associated with transmitting the electronic medical record.
Right to Request That Your Medical Information Be Amended
If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan.
To request an amendment, your request must be made in writing and submitted to the Compliance Officer. In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
- Is not part of the medical information kept by or for the Plan.
- Was not created by the Plan, unless the person or entity that created the information is no longer available to make the amendment.
- Is not part of the information that you would be permitted to inspect or copy.
- Is accurate and complete.
Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures” made by the Plan or its Business Associates. An accounting of disclosures is a list of disclosures of your medical information that we have made. The maximum accounting period is six years. The accounting that the Plan or its Business Associates provide will not include disclosures made before April 14, 2003; disclosures made for treatment, payment, or health care operations; disclosures made earlier than six years before the date of your request; and disclosures made to you or pursuant to your written request. The accounting will tell you the person to whom your medical information was disclosed, the date of the disclosure, a description of the information disclosed, and the purpose of the disclosure.
To request an accounting of disclosures, you must submit your request in writing to the Compliance Officer. Your request must state a time period that may not be longer than six years and may not include dates before April 2003. Your request should indicate in what form you want the accounting (for example, paper or electronic). The first accounting you request within a 12-month period will be free. For additional accountings, we may charge you for the costs of providing the accountings. The Plan will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions
You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment of your care, like a family member or friend. We are under no obligation to agree to requests for restrictions. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
To request restrictions, you must make your request in writing to the Compliance Officer. You must include with your request: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply (for example, disclosures to your spouse). We will notify you in writing as to whether we agree to your request for restrictions.
Right to Request a Restriction for Services Paid Out-of-Pocket
You have the right to request a restriction to share information about your treatment for services you pay for yourself.
Right to Request Confidential Communications
You have the right to request that we communicate with you about medical matters in a certain confidential way or at a specific or certain agreed-upon location. For example, you can ask that we contact you only at work or by mail.
To request confidential communications by alternative means or at an alternative location, you must make your request in writing to the Compliance Officer. Your request should state the reason(s) for your request and the alternative means by which or the location at which you would like to receive your health information. If you believe that the disclosure of all or part of your health information by non-confidential communications could endanger you, your request should state that. The Plan will accommodate reasonable requests and notify you appropriately.
Right to Receive Notice of a Breach
You have the right to be notified of a breach of any of your unsecured Protected Health Information.
Rights About Fundraising Communication
We do not use or disclose your Protected Health Information for marketing and fundraising purposes. You have the right to opt out of fundraising communications, and your Protected Health Information cannot be sold without your permission.
Right to a Paper Copy of the Privacy Notice
You have the right to obtain a paper copy of this Notice of Privacy Practices at any time upon request. Even if you agree to receive this Notice electronically, you are still entitled to a paper copy of this Notice. To obtain a paper copy of this notice by mail, you should contact the Department of Human Resources, Office of Employee Relations e at the below address. You may also obtain an electronic copy of this notice at the Plan’s website.
HIPAA Compliance Officer
Fairfax County Public Schools
Department of Human Resources
Office of Employee Relations (OER)
8115 Gatehouse Road, Suite 2500
Falls Church, VA 22042
Phone: 571-423-3070
Fax: 571-423-5051
Changes to this Notice
We reserve the right to change any of the privacy policies and related practices at any time, as allowed by federal and state law, and to make the change effective for all information that we maintain. The terms of the revised Notice may apply to medical information we already have about you as well as any information we receive in the future. If we materially change any of the privacy practices covered by this Notice, we will provide you with the revisions within 60 days and post the revised Notice on the Plan’s website.
We will post a copy of the current Notice on the Plan’s website at www.fcps.edu. That Notice will contain the effective date on the top right-hand corner. You should monitor the website for revisions. Copies of the revised Notice will be made available to you upon your written request.
Your Right to File a Complaint and Contact Information
The Plan provides a process as required by HIPAA for you to make complaints regarding the Plan’s policies and procedures or compliance with policies and procedures related to protecting the privacy of your health information. If you believe your privacy rights have been violated, you may file a complaint with the HIPAA Compliance Officer or with the Secretary of the Department of Health and Human Services. To file a complaint you must submit it in writing to the following:
HIPAA Compliance Officer
Fairfax County Public Schools
Department of Human Resources
Office of Employee Relations (OER)
8115 Gatehouse Road, Suite 2500
Falls Church, VA 22042
Phone: 571-423-3070
Fax: 571-423-5051
Office for Civil Rights
U.S. Department of Health & Human Services
150 S. Independence Mall West - Suite 372
Philadelphia, PA 19106-3499
(215) 861-4441; (215) 861-4440 (TDD)
(215) 861-4431 FAX