Appendix B: Notice of Privacy Practices for Protected Health Information
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Effective Date of Notice: February 14, 2020
In this Notice, we sometimes refer to the Plan as "we" and sometimes as "the Plan." When we say "you" or "your" in this Notice, we mean any person entitled to benefits under the Plan.
Alliance Coal, LLC ("Plan Sponsor") sponsors the Alliance Coal Health Plan and the Alliance Coal Dental, Vision, and Flexible Benefits Plan ("Plans," and individually the "Plan") that are covered entities under the Health Insurance Portability and Accountability Act’s ("HIPAA’s") privacy regulation ("Privacy Rule"). Together the Plans constitute an organized health care arrangement ("Arrangement") under the Privacy Rule. The Privacy Rule regulates each Plan’s use and disclosure of Protected Health Information ("PHI") about you. This Notice describes how we may use and disclose your PHI, as permitted by the Privacy Rule. This Notice also describes your individual rights concerning your PHI.
Under the Privacy Rule, PHI generally means information that: (i) relates to your past, present, or future physical or mental health condition or health plan coverage and (ii) may identify you.
Section 1. Plan Duties
Federal law says that we must maintain the privacy of your PHI, give you notice of our legal duties and privacy practices concerning your PHI, and notify you of a breach (as defined in the Privacy Rule) of your unsecured PHI. We must follow the terms of this Notice, as currently in effect. However, we have the right to change the terms of this Notice at any time and to make the new Notice provisions effective for all PHI that we have then or will later have. We will provide you with a revised Notice at work or by mail if we make material changes to our privacy practices.
Section 2. How and When the Plan May Use or Disclose PHI
Sections A and B below describe the different ways in which we may use or disclose your PHI without your written authorization. We must have your written authorization for any other uses and disclosures. For example, subject to certain exceptions described in the Privacy Rule, we must obtain your authorization for: (i) a use or disclosure of your psychotherapy notes, (ii) a use or disclosure of your PHI for marketing, and (iii) any sale of your PHI. You may revoke your authorization at any time, but only if you make the request to revoke in writing and give or send it to the Plan’s Privacy Contact at the address below. Your revocation of an authorization will not apply to any action the Plan has already taken in reliance on such authorization.
A. Primary Uses and Disclosures of PHI
Required Disclosures. The Privacy Rule says we must disclose your PHI to you when you ask to inspect or amend it, or if you ask for an accounting of certain types of disclosures. We must also disclose your PHI to the Secretary of the Department of Health and Human Services without your authorization for an investigation of our compliance with the Privacy Rule.
Treatment. We may disclose PHI about you for the treatment activities of a health care provider, as permitted by the Privacy Rule. These activities include a health care provider’s providing, coordinating, or managing your health care and related services, health care providers’ consulting with one another about you, and referrals by one provider to another. For example, we may disclose your Plan enrollment status to a hospital in connection with a planned admission without your authorization.
Payment. We may use or disclose your PHI for our payment activities and those of other covered entities and health care providers, as permitted by the Privacy Rule. For example, without your authorization, we may disclose your PHI in order to collect your premiums or reimbursement for providing health care to you. In the same way, we may also disclose your PHI to another covered entity or a health care provider for its payment activities. For example, without your authorization, we may disclose your PHI to a health care provider who has filed a claim for payment for health care services provided to you.
Health Care Operations. We may use or disclose your PHI for our own health care operations activities, as permitted by the Privacy Rule. We may also disclose your PHI to another covered entity for its own health care operations activities. If we participate in an organized health care arrangement, we may also disclose PHI about an individual to another covered entity that participates in the organized health care arrangement for any health care operations activities of the organized health care arrangement. Health care operations activities for this purpose include: (i) quality assessment and improvement activities, (ii) population-based activities relating to reducing health care costs, (iii) case management and Care Coordination, (iv) evaluating health plan performance, (v) underwriting, enrollment, premium rating, and similar activities, and (vi) the general business management and general administrative activities of the entity for whom the health care operations activities are performed. For example, without your authorization, we may use or disclose information about your claims to project future benefit costs or audit the claims processing functions. We will not use or disclose your genetic information for underwriting purposes.
To the Plan Sponsor. For the purpose of administering the Plan, including claims administration, certain employees of the Plan Sponsor have access to your PHI. However, those employees are permitted to use or disclose your information only as necessary to perform plan administration functions or as otherwise required by HIPAA, unless you have authorized further disclosures. Your Protected Health Information cannot be used for employment purposes without your specific authorization. We may also disclose your PHI to the Plan Sponsor for other purposes permitted by the Privacy Rules, such as evaluation of plan design changes.
Within the Arrangement. Each Plan may share PHI with the other Plans that make up the Arrangement, as necessary to carry out the treatment, payment, and health care operations activities (as described above) relating to the Arrangement. For example, we may share your PHI with the Arrangement for general administrative activities such as auditing or cost analysis of the Arrangement as a whole.
B. Other Uses and Disclosures of PHI
Disclosures Required by Law. We may use or disclose your PHI when required by law, as permitted by the Privacy Rule, without your authorization.
For Public Health Activities. We may disclose your PHI without your authorization for certain public health activities, as permitted by the Privacy Rule. Examples of public health activities include: (i) activities to prevent or control disease, injury, or disability (including reporting a disease), (ii) the conduct of public health surveillance, public health investigations, and (iii) public health interventions.
About Victims of Abuse, Neglect, or Domestic Violence. We may disclose your PHI if we reasonably believe that you are a victim of abuse, neglect, or domestic violence. We may only make this disclosure to a government authority (including a social service or protective services agency) authorized by law to receive reports of such abuse, neglect, or domestic violence, as permitted by the Privacy Rule. We will make this type of disclosure only if you agree to the disclosure or if the disclosure is otherwise required or authorized by law.
For Health Oversight Activities. We may disclose your PHI without your authorization to a public health oversight agency for certain oversight activities authorized by law, as permitted by the Privacy Rule. Examples of oversight activities include: (i) audits, (ii) investigations, (iii) inspections, (iv) licensure, and (v) other activities generally necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
For Judicial and Administrative Proceedings. We may disclose your PHI without your authorization in response to a court or administrative order issued in any judicial or administrative proceeding, as permitted by the Privacy Rule. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful purpose, without a court or administrative order, but only: (i) if we obtain an order protecting the information requested, or (ii) if efforts have been made to tell you about the request for your PHI.
For Law Enforcement Purposes. We may disclose your PHI without your authorization to a law enforcement official for certain law enforcement purposes, as permitted by the Privacy Rule. Examples of this type of disclosure include: (i) disclosure in response to a court order, subpoena, warrant, summons, or similar process, and (ii) disclosure made in emergency circumstances to prevent a crime.
To Coroners, Medical Examiners, and Funeral Directors. We may disclose your PHI without your authorization to a coroner or medical examiner for the purpose of: (i) identifying a deceased person, (ii) determining a cause of death, or (iii) other duties as authorized by law, as permitted by the Privacy Rule. Also, we may disclose your PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties regarding the decedent.
For Organ and Tissue Donation Purposes. We may use or disclose your PHI without your authorization to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye, or tissue donation and transplantation, as permitted by the Privacy Rule.
For Research. We may use or disclose your PHI for research without your authorization, as permitted by the Privacy Rule. A number of conditions must be met before we use or disclose your PHI for research.
To Avert a Serious Threat to Health or Safety. We may use or disclose your PHI without your authorization when necessary to prevent a serious threat to someone’s health and safety, as permitted by the Privacy Rule. We may only make that kind of disclosure, however, to someone able to lessen or prevent the threat.
For Specialized Governmental Functions. We may use or disclose your PHI without your authorization for specialized governmental functions, as permitted by the Privacy Rule. Examples of this kind of disclosure are: (i) disclosure of PHI of military personnel for activities deemed necessary by military command authorities, and (ii) disclosure to authorized federal officials for lawful national security activities.
For Workers' Compensation. We may use or disclose your PHI without your authorization when authorized by and to the extent necessary to comply with workers’ compensation or other similar programs established by law that provide benefits for work-related injuries or illness without regard to fault, as permitted by the Privacy Rule.
For Care and Notification. We may use or disclose your PHI without your authorization to your family member, other relative, or a close personal friend or other person you identify. Our disclosure will be limited to PHI that is directly relevant to your care or payment related to your care. This includes information about your location, general condition, or death, as permitted by the Privacy Rule.
Incident to a Use or Disclosure Permitted by the Privacy Rule. We may make a use or disclosure of your PHI without your authorization if the use or disclosure is incidental to a use or disclosure otherwise permitted by the Privacy Rule. We will make reasonable efforts to limit PHI used and/or disclosed to the minimum necessary to accomplish the intended purpose of the use and/or disclosure. We have in place appropriate administrative, technical, and physical safeguards to protect the privacy of your PHI.
Section 3. Your Rights
Right to Request Restrictions on PHI Uses and Disclosures
You have the right to request that we restrict uses and disclosures of your PHI to carry out treatment, payment, or health care operations, or to restrict uses and disclosures to family members, relatives, friends, or other persons identified by you who are involved in your care or in payment for your care, as permitted by the Privacy Rule. However, we are not required to agree to your request.
Your request for restrictions must be in writing to the Plan’s Privacy Contact at the address below.
Right to Receive Confidential Communications
You have the right to request that we make certain communications of your PHI to you by alternative means or to alternative locations, if the Plan’s traditional means of communication could endanger you.
Your request for confidential communications of PHI must be in writing to the Plan’s Privacy Contact or Office at the address below. Your request must include a statement that the disclosure of all or part of the information could endanger you.
Right to Inspect and Copy PHI
You have the right to request access to inspect or obtain a copy of certain types of PHI that the Plan has about you.
Your request for access must be in writing to the Plan’s Privacy Contact or Office at the address below. If you ask for a copy of the information, we may charge a fee for the costs of copying, mailing, or other charges related to fulfilling your request.
We may deny your request for access to inspect or obtain a copy of your PHI in certain circumstances, as permitted by the Privacy Rule.
Right to Amend PHI
If you feel that your PHI we have is incorrect or incomplete, you may ask us to amend your information.
Your request for an amendment must be in writing to the Plan’s Privacy Contact or Office at the address below. Your written request must also specify the basis for the amendment.
We may deny your request for an amendment in certain circumstances, as permitted by the Privacy Rule.
Right to Receive an Accounting of PHI Disclosures
You have the right to receive an accounting of certain disclosures of your PHI that we have made.
Your request for an accounting of disclosures must be in writing to the Plan’s Privacy Contact or Office at the address below. Your written request must specify the time period for which you are requesting an accounting. That time period may not be longer than six years from the date of your request. Your written request should state the format (paper, electronic, etc.) in which you want to receive your accounting. We may charge a fee for the costs of responding to more than one accounting request in a 12-month period.
We may deny your request for an accounting in certain circumstances, as permitted by the Privacy Rule.
Right to Obtain a Paper Copy of Notice
You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please make your request in writing to the Plan’s Privacy Contact or Office at the address below.
Section 4. Complaints
If you believe your privacy rights have been violated, you may file a complaint with the Plan or with the Secretary of the Department of Health and Human Services. To file a complaint with the Plan, write to the Plan’s Privacy Contact or Office at the address below. Your complaint must be submitted in writing. You will not be retaliated against for filing a complaint.
Section 5. Address
If you have any questions about the Plan’s privacy practices or the information contained in this Notice, please contact the Plan’s Privacy Contact or Office at:
Alliance Coal, LLC
ATTN: Privacy Contact
PO Box 1950
Tulsa, OK 74101-1950