Privacy Policy

KENMORE TEACHERS ASSOCIATION WELFARE TRUST
EIN: #16 1268457

PRIVACY NOTICE
(As required at 45 Code of Federal Regulations Parts 160 & 164)

The date on which this notice is first in effect: April 14, 2004

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

ABOUT THIS NOTICE

This notice updates and amends the KENMORE TEACHERS ASSOCIATION WELFARE TRUST. If you have any questions about this notice, please contact the Kenmore Teachers Association Welfare Trust (“Plan”) Privacy Official Melissa Moore, 205 Yorkshire Road, Tonawanda, NY 14150, Tel. 716-837-3710.

During the course of providing you with health or health-related coverage, the Plan will have access to medical information about you that may be considered to be protected health information (“PHI”) by applicable Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) regulations. This Plan’s HIPAA-covered benefits include: dental Plan #258, vision, catastrophic major medical.

In order for your medical information to be considered PHI, it must satisfy the following conditions: (a) your medical information must be “health information.” Health information is broadly defined in the applicable HIPAA regulations as meaning any oral or recorded information relating to your past, present, or future physical or mental health, the provision of health care for you, or the payment of health care for you; (b) your medical information must be “individually identifiable.” Individually identifiable health information is broadly defined in the applicable HIPAA regulations as health information that identifies or reasonably can be used to identify you (we may de-identify your individually identifiable health information by removing specific identifiers including, but not limited to your name, social security number, and address); and (c) your medical information must be “created or received” by a covered entity (this benefit Plan, insurance providers, and your doctor are covered entities under the applicable HIPAA regulations). Individually identifiable health information that is created or received by a covered entity is protected. If your medical information satisfies all three of these criteria, it is considered PHI and is covered by the applicable HIPAA regulations regardless of the media or form in which it is maintained or transmitted. Consequently, oral, written, and electronic information is protected.

We will protect your PHI in accordance with the applicable HIPAA regulations. We are required by the applicable HIPAA regulations to: (a) make sure that medical information that identifies you is kept private; (b) inform you through this notice of the Plan’s uses and disclosures of PHI;
(c) inform you through this notice of your privacy rights with respect to PHI; (d) inform you through this notice of your right to file a complaint with the Plan and the Secretary of the U.S. Department of Health and Human Services (“HHS”); (e) inform you through this notice of the person to contact for further information about the Plan’s privacy practices; (f) give you this notice of our legal duties and privacy practices with respect to PHI about you; and (g) follow the terms of the notice that are currently in effect.

HOW WE MAY USE AND DISCLOSE YOUR PHI

Kenmore Teachers Association Welfare Trust has limited access to PHI and limited reasons for disclosure of PHI. The following categories describe different ways that we may use and disclose your PHI. For each category of uses or disclosures, we explain what we mean and give some examples. Not every use or disclosure in a category is listed, nor does Kenmore Teachers Association Welfare Trust disclose PHI in all categories listed. However, all of the ways we are permitted to use and disclose your PHI will fall within one of the categories below. The Plan may use your PHI without your consent, authorization, or opportunity to agree or object to carry out “Treatment,” “Payment,” and “Health Care Operations,” as defined and explained below.

Treatment (as described in the applicable HIPAA regulations): Although Kenmore Teachers Association Welfare Trust is not involved at this time with using and disclosing PHI with regard to Treatment, we are permitted to use and disclose PHI about you for the provision, coordination, or management of health care and related services. Treatment also includes but is not limited to consultations and referrals between one or more of your health care providers. For example, we may disclose PHI about you in connection with your admission in a hospital for medical treatment or services. We may also disclose to a treating orthodontist the name of your treating dentist so that the orthodontist may ask for your dental X-rays from the treating dentist.

Payment (as described in the applicable HIPAA regulations): We may use and disclose PHI about you to: (a) determine eligibility for Plan benefits; (b) facilitate payment for the treatment and services you receive from health care providers; (c) determine benefit responsibility under the Plan; or (d) coordinate Plan coverage. For example, we may tell your doctor whether you are eligible for coverage. We may also disclose your PHI to insurance carriers in order to coordinate benefits in accordance with the Plan.

Health Care Operations (as described in the applicable HIPAA regulations): We may use and disclose PHI about you for other Plan operations. We may use your PHI in connection with: (a) case management and care coordination; (b) conducting quality assessment and improvement activities; (c) underwriting and soliciting bids from potential carriers, premium rating , and other activities relating to Plan coverage; (d) conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; (e) business planning and development; and (f) business management and general Plan administrative activities. For example, we may use your PHI to determine appropriate case management and care or to audit the accuracy of claims processing.

Disclosure to Health Plan Sponsor: We will disclose PHI about you to the Plan Sponsor only upon the receipt of a certification by the Plan Sponsor that the Plan documents have been
amended to incorporate provisions relating to the Plan Sponsor’s agreement not to use or further disclose your PHI other than as permitted or required by the Plan documents or as required by the applicable HIPAA regulations or other applicable law. Also, a health insurance issuer may disclose PHI about you to the Plan Sponsor. For example, a health insurance issuer may disclose your claims information to the Plan Sponsor for its purposes of auditing claims.

As Required by Law: We may disclose PHI about you when required to do so by federal, state or local law. Use and disclosure of your PHI may be required by the Secretary of HHS to investigate or determine the Plan’s compliance with the applicable HIPAA regulations.

Disclosure upon Your Request: Upon your request, we are required to give you access to certain PHI in order for you to inspect and copy it.

To Avert a Serious Threat to Health or Safety: We may disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Public Health Activities: We may disclose PHI about you for public health activities. These activities generally include the following: (a) to prevent or control disease, injury or disability; (b) to report to a public health authority that is authorized by law to collect or receive information for the purpose of reporting births and deaths; (c) to report to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect (for this purpose, we will not inform the child that such a disclosure has been made or will be made and we may make the disclosure to the child’s parents or other representatives); (d) to report to a person subject to the jurisdiction of the Food and Drug Administration reactions to medications or problems with products; (e) to report to you or a public health authority as authorized by law, of the exposure to a disease or risk of contracting or spreading a disease or condition; and (f) to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence (we may only make this disclosure if you agree or when required or authorized by law).

Health Oversight Activities: We may disclose PHI about you to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Organ and Tissue Donation: If you are an organ donor, we may disclose PHI about you to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans: If you are a member of the armed forces, we may disclose PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation: We may disclose PHI about you for workers’ compensation or similar programs in accordance with applicable law.

Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if reasonable efforts have been made by the person requesting the information to tell you about the request or to obtain an order protecting the disclosure of the information requested.

Law Enforcement: We may disclose PHI about you if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons or similar process. Also, we may disclose PHI: (a) to identify or locate a suspect, fugitive, material witness, or missing person; (b) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (c) about a death we believe may be the result of criminal conduct; (d) about criminal conduct at the hospital; and (e) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI about you to a coroner, medical examiner, or funeral director as necessary to carry out their duties.

National Security and Intelligence Activities: We may disclose PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose PHI about you to the correctional institution or law enforcement official. This disclosure would be necessary: (a) for the institution to provide you with health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the correctional institution.

Psychotherapy Notes: In an emergency situation, we will not use or disclose PHI about you contained in psychotherapy notes without your authorization except for limited circumstances to carry out the following Treatment, Payment, or Health Care Operations: (a) use by the originator of the psychotherapy notes for Treatment; (b) use or disclosure by a health care provider in training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; (c) use or disclosure by the Plan to defend a legal action or other proceeding brought by you against the Plan; or (d) as permitted by the applicable HIPAA regulations.

Family Members or Other Relatives: In an emergency situation, we may disclose PHI about you to family members, other relatives, and your close personal friends if: (a) the information is directly relevant to the family or friend’s involvement with your care or payment for that care; and (b) you have either agreed to the disclosure or have been given an opportunity to object and have not objected.

OTHER USES OF YOUR PHI

Other uses and disclosures of PHI not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us written authorization to use or disclose PHI about you, you may revoke that written authorization, in writing, at any time. If you revoke your written authorization, we will no longer use or disclose PHI about you for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your written authorization.

YOUR RIGHTS REGARDING YOUR PHI

You have the following rights regarding your PHI:

Right to Inspect and Copy: You have the right to inspect and copy PHI that may be used to make decisions about your Plan benefits. You have the right to inspect and obtain a copy of your PHI contained in a “designated record set.” A designated record set includes: (a) medical records and billing records about individuals maintained by or for a covered health care provider; (b) enrollment, payment, billing, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) other information used in whole or in part by or for the covered entity to make decisions about individuals.

To inspect and copy PHI that may be used to make decisions about you, you must submit your request in writing to Melissa Moore. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request.

If we grant your request to inspect and copy your PHI, in whole or in part, we will inform you of our acceptance of your request and will provide you access to your PHI no later than 30 days following our receipt of your request (or no later than 60 days following our receipt of your request if your PHI is not maintained or accessible at the Plan Office). Within the applicable time, we will set up a mutually convenient time for you to inspect or obtain a copy of your PHI (or will mail a copy of your PHI at your request). If we are unable to provide you with your PHI within the applicable time, we may extend the applicable time by no more than 30 days. If we extend the applicable time, we will provide you with a written statement of the reasons for our delay and the date by which we will provide you with your PHI. We are permitted only one extension of time.

We will provide you access to your PHI in the form or format that you request, if it is readily producible in such form or format. If not, we will provide you with a readable, hard-copy form or such other form or format as mutually agreed to. We may however, provide you with a summary of your PHI in lieu of providing you access to your PHI, or may provide you with an explanation of your PHI to which access has been provided if you agree in advance to such summary or explanation and you also agree in advance to any fees associated with providing such summary or explanation.

We may deny your request to inspect and copy your PHI in certain, very limited circumstances. The applicable HIPAA regulations provide several important exceptions to your right to access
your PHI. For example, you will not be permitted to access information compiled in anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. We may not allow you to access your PHI if these or any of the exceptions permitted under the applicable HIPAA regulations apply. If we deny your request, in whole or in part, we will provide you with a written denial no later than 30 days following our receipt of your request (or no later than 60 days following our receipt of your request if your PHI is not maintained or accessible at the Plan Office). If we are unable to provide you with our written denial within the applicable time, we may extend the applicable time by no more than 30 days. If we extend the applicable time, we will provide you with a written statement of the reasons for our delay and the date by which we will provide you with our written denial. We are permitted only one extension of time.

In our written denial, we will provide you with: (a) our basis for denying your request; (b) a statement of your review rights and how you may exercise your review rights (if applicable); and (c) a description of how you may formally complain to us pursuant to our complaint procedures or to the Secretary of HHS. You have limited review rights under the applicable HIPAA regulations. Your denial may be reviewed if the grounds for the denial involve the following situations: (a) a licensed health care professional has determined that access to your PHI is reasonably likely to endanger the life or physical safety of you or another person; (b) your PHI makes reference to another person (who is not a health care professional) and a licensed health care professional has determined that the access requested is reasonably likely to cause substantial harm to such other person; or (c) your request for access is made by your personal representative and a licensed health care professional has determined that your personal representative’s access is reasonably likely to cause substantial harm to you or another person. In these situations, you have the right to have our denial reviewed by a licensed health care professional who we designate to act as a reviewing official and who did not participate in the original decision to deny your request. We will promptly refer your request for review to our reviewing official. The reviewing official will make a determination, within a reasonable period of time, whether to deny your request. We will then promptly provide you with written notice of the reviewing official’s decision.

If we deny your request, in whole or in part, we will, to the extent possible, give you access to any other PHI requested, after excluding the PHI as to which we deny access. If we do not maintain your requested PHI and we know where it is maintained, we will inform you where to direct your request for access.

Right to Amend: If you feel the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan. To request an amendment, your request must be made in writing and must be submitted to Melissa Moore. In addition, you must provide a reason that supports your request.

If we grant your request for amendment, in whole or in part, we must act on your request no later than 60 days after we receive it. If we are unable to act on your request within this time, we may extend this time by no more than 30 days. If we extend this time, we will provide you with a written statement of the reasons for our delay and the date by which we will amend your PHI. We are permitted only one extension of time. Within the applicable time, we are required to
inform you that the amendment has been accepted and will obtain your identification of and agreement to have us notify the relevant persons or entities with which the amendment needs to be shared. We will make a reasonable effort to inform and provide the amendment within a reasonable time to persons or entities who you identify as having received your PHI needing the amendment and persons or entities that we know have your PHI that is the subject of the amendment and that may have relied or could rely on the information to your detriment.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that: (a) is not part of the PHI kept by or for the Plan; (b) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (c) is not part of the information which you would be permitted to inspect and copy; or (d) is accurate and complete. If we deny your request for amendment, in whole or in part, we must do so no later than 60 days after we receive it. If we are unable to act on your request within this time, we may extend this time by no more than 30 days. If we extend this time, we will provide you with a written statement of the reasons for our delay and the date by which we will act on your request. We are permitted only one extension of time. Within the applicable time, we are required to provide you with a written denial. In our written response to you, we will provide you with: (a) the basis for our denial; (b) a statement that you have a right to submit a written statement disagreeing with the denial (you can submit your written statement of disagreement of all or part of a requested amendment and the basis for your disagreement; we may however, limit the length of your statement); (c) a statement that if you do not submit your disagreement, you may request that we provide your request for amendment and the denial with any future disclosures of your PHI that is the subject of the amendment; and (d) a description of how you may complain to us pursuant to our complaint procedures or to the Secretary of HHS. We may prepare a written rebuttal statement to your statement of disagreement. If we prepare such rebuttal, we will provide you with a copy.

Right to an Accounting of Disclosures: You have the right to request a written accounting of disclosures of your PHI (other than disclosures you authorized in writing) where such disclosures were made for any purpose other than to carry out Treatment, Payment, or Health Care Operations. The written accounting will include: (a) disclosures of your PHI that occurred during the six years (or shorter period of time at your request) before the date of the request for an accounting; (b) the date of the disclosure; (c) the name of the person or entity that received your PHI; (d) a brief description of the PHI disclosed; and (e) a brief statement of the purpose that informs you of the basis of the disclosure. To request this list or accounting of disclosures, you must submit your request in writing to Melissa Moore. Your request must state a time period which may not be longer than six years. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the reasonable costs of providing the list. We will notify you of the costs involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

We will provide you with this written accounting no later than 60 days after we receive your request. If we are unable to act on your request within this time, we may extend this time by no more than 30 days. If we extend this time, we will provide you with a written statement of the
reasons for our delay and the date by which we will provide you with a written accounting. We are permitted only one extension of time.

The applicable HIPAA regulations provide several important exceptions to your right to an accounting of the disclosures of your PHI. We are not required to account for disclosures of your PHI: (a) to you; (b) to carry out Treatment, Payment, or Health Care Operations; (c) to correctional institutions or law enforcement officials; or (d) for national security or intelligence purposes. We will not include in your accounting any of the disclosures for which there is an exception under the applicable HIPAA regulations.

Right to Request Restrictions: You have the right to: (a) request a restriction or limitation on the PHI we use or disclose about you for Treatment, Payment or Health Care Operations; (b) request a restriction or limitation on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend (for example, you could ask that we not use or disclose information about a cancellation of coverage for lack of payment); (c) request a restriction or limitation on PHI we disclose to notify or assist in the notification of (including identifying or locating) a family member, personal representative, or another person responsible for your care of your location, general condition, or death; and (d) request a restriction or limitation on PHI we disclose to a public or private entity authorized by law or charter to assist in disaster relief efforts to assist in your location, general condition, or death.

We are not required to agree to your request. However, if we agree to your request, we will document the restriction and retain the documentation for six years from the date of the agreement. We may not use or disclose your PHI in violation of your request, except that if it is an emergency situation and your PHI is needed to provide you with emergency treatment, we may use your PHI or may disclose your PHI to a health care provider so that it may provide you with emergency treatment. We will request that the health care provider not further use or disclose your PHI. We may terminate our agreement if: (a) you agree to or request the termination in writing; (b) you orally agree to the termination and your oral agreement is documented; or (c) we inform you that we are terminating our agreement (such termination is only effective with respect to PHI created or received after we have informed you).

To request restrictions, you must make your request in writing to Melissa Moore. In your request, you must tell us: (a) what information you want to limit; (b) whether you want to limit our use, disclosure or both; and (c) to whom you want the limits to apply (for example, disclosures to your spouse).

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to Melissa Moore. We will not ask you the reason for your request and will accommodate all requests we deem reasonable. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of this Notice: You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically by e-mail, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, please contact Melissa Moore.

CHANGES TO THIS NOTICE

We reserve the right to: (a) change this notice; and (b) make the revised or changed notice effective for PHI we already have about you as well as any information we receive in the future. If we make a material change to the uses or disclosures, your rights, our legal duties, or other privacy practices stated in this notice, we will redistribute a revised notice within 60 days of the material change.

PERSONAL REPRESENTATIVES

You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of his or her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. Proof of authority may take one of the following forms: (a) a completed Kenmore Teachers Association Welfare Trust “Appointment of Personal Representative Form”; (b) a power of attorney for health care purposes (Health Care Proxy or Health Care Power of Attorney), notarized by a notary public; (c) a court order of appointment of as the conservator or guardian; or (d) an individual who is the parent of a minor child. We reserve the right to deny access to your PHI to a personal representative.

YOUR RIGHT TO FILE A COMPLAINT

If you believe your privacy rights have been violated, you may file a complaint with the Plan or with the Secretary of HHS. To file a complaint with the Plan, contact the Plan’s Privacy Official, Melissa Moore, at the address listed at the beginning of this notice. All complaints must be submitted in writing. To file a complaint with the Secretary of HHS, write to the Secretary of the U.S. Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Avenue, S.W., Washington, D.C. 20201. You will not be penalized or in any way retaliated against for filing a complaint.

Sincerely,

Keith R. Augustine, Administrator
Kenmore Teachers Association Welfare Trust

11/13