for the Formed Fiber Technologies, Inc. Health Plan
Effective Date: April 14, 2004
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU
MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO
THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
You are receiving this Notice of Privacy Practices (Notice) because you are enrolled in one or more of the Formed Fiber Technologies, Inc. Self-Insured Health Plans (“Health Plans”). Health Plans include medical and the health flexible spending account. Health Plan is committed to protecting the confidentiality of any health information it receives, maintains, uses or discloses. This Notice describes how a Health Plan may use and disclose your “protected health information” (PHI). PHI is any health information that: (1) identifies the individual or may reasonably be used to identify the individual; (2) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (3) relates to your past, present or future physical or mental health condition, or provision of or payment for health care.
Designated associates of Formed Fiber Technologies, Inc. (the “Plan Sponsor”) who administer and manage the Health Plans may use your PHI only for appropriate plan purposes (such as for payment or health care operations), but not for employment-related purposes of the Plan Sponsor. These designated associates must comply with the same requirements that apply to a Health Plan to safeguard your PHI and protect the confidentiality of PHI.
The Health Plans are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to provide this Notice to you. Additionally, each Health Plan is required by law to:
Maintain the privacy of your protected health information (PHI), and
Follow the terms of its Notice of Privacy Practices that is currently in effect.
For the purposes of HIPAA compliance, the Health Plan, consisting of the Employee Welfare Benefit Plan (medical) and Health Flexible Spending Account plan are intended to operate as an organized health care arrangement (OHCA). This allows Formed Fiber to have one Notice and one set of Policies and Procedures encompassing both self-insured plans that are part of the OHCA.
If you have questions about any part of this Notice or if you want more information about the privacy practices of the Health Plans, please contact the Health Information Privacy Officer (Privacy Officer), 125 Allied Road, Auburn, ME 04211, 207-784-1135.
How Your Protected Health Information (PHI) May be Used or Disclosed
A Health Plan is permitted by law to use and disclose your protected health information (PHI) either pursuant to an authorization by you, or in certain other ways, which are described below. Examples of permitted uses and disclosures are included. This Notice does not list every permitted use or disclosure the Health Plan may make. However, all the ways a Health Plan is permitted to use or disclose PHI will fall within one of the categories below.
1. Treatment Purposes: A Health Plan may disclose PHI to a health care provider for the health care provider’s treatment purposes, although it is more likely a health care provider would receive your PHI from another health care provider than from the Health Plan. For example, if your Primary Care Physician or your treating medical provider refers you to a specialist for treatment, the Health Plan can disclose your PHI so the specialist to whom you have been referred so (s)he can become familiar with your medical condition, prior diagnoses and treatment, and prognosis. Examples of health care providers include doctors, nurses, and laboratory technicians.
2. Payment Purposes: A Health Plan may use or disclose your PHI to evaluate and process any requests for coverage and claims for benefits you make, and may review PHI included with claims to reimburse providers for treatment and services rendered. Additionally, a Health Plan may disclose PHI to another group health plan or to a health care provider for the payment purposes of the Health Plan, the other group health plan, or the health care provider. For example, Health Plan can disclose your PHI to another health plan or payer for purposes of coordinating payment of benefits.
3. Health Care Operations Purposes: A Health Plan may use or disclose your PHI for its own health care operations and may disclose PHI to another group health plan, a health care provider, a medical group or a hospital for the health care operations purposes of the Health Plan, or for certain health care operations purposes of the other entities. Examples of the Health Plan’s “health care operations” include underwriting, premium rating and other activities related to plan coverage; conducting quality assessment and improvement activities; submitting claims for stop-loss coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; and business planning, management and general administration of the Health Plan.
A Health Plan may disclose PHI to other entities in the OHCA for all health care operations of the OHCA, even if the other entities of the OHCA do not have a relationship with you.
4. To a Business Associate of the Health Plan: A Health Plan may disclose PHI to a Business Associate of the Health Plan, if a valid Business Associate Agreement is in place between the Business Associate and Health Plan. A Business Associate is an entity that performs a function on behalf of the Health Plan and that uses PHI in doing so, or provides services to the Health Plan such as legal, actuarial, accounting, consulting or administrative services. Examples of Business Associates include the Health Plan’s Third-Party Administrator and broker.
5. To the Plan Sponsor: A Health Plan may disclose PHI to the Plan Sponsor if the Plan Sponsor has amended its plan document as required by the Privacy Rule, certified to the Health Plan as required by the Privacy Rule, and established certain safeguards and firewalls to limit the classes of employees who will have access to PHI and to limit the use of PHI to plan purposes and not for non-permissible purposes. Any disclosures to the Plan Sponsor must be for purposes of administering the Health Plan. Examples include: for claims appeals to the Plan’s Benefits Committee, for case management purposes, or to Human Resources representatives of the Plan Sponsor who are assisting plan members in getting their claims resolved.
The plan may also disclose enrollment/disenrollment information to the Plan Sponsor, for enrollment or disenrollment purposes only, and may disclose “summary health information” (as defined under the HIPAA medical privacy regulations) to the Plan Sponsor for the purpose of obtaining premium bids or modifying or terminating the plan.
6. As Required by Law or Requested as Part of a Regulatory or Legal Proceeding: A Health Plan may disclose PHI as required by law or when requested as part of a regulatory or legal proceeding. For example, a Health Plan may disclose medical information when required by a court order in a litigation proceeding, or pursuant to a subpoena, or as necessary to comply with Workers’ Compensation laws.
7. For Public Health Activities or to Avert a Serious Threat to Health or Safety: A Health Plan may disclose PHI to public health authorities for purposes such as preventing or controlling diseases, injury or disability; reporting to the Food and Drug Administration on products and reactions to medications; and reporting disease or infection exposure.
8. For Law Enforcement or Specific Government Functions: A Health Plan may disclose PHI to law enforcement personnel for purposes such as identifying or locating a suspect, fugitive, material witness or missing person; complying with a court order or subpoena; and other law enforcement purposes.
9. For Treatment Alternatives and Health-Related Benefits and Services: A Health Plan may use and disclose your PHI to tell you about possible treatment options or alternatives and health-related benefits and services that may be of interest to you.
10. To Individuals Involved in Your Care or Payment for Your Care: A Health Plan may use and disclose your PHI to a family member involved in, or who helps pay for, your health care. The Health Plan will disclose general and/or payment-related information to your spouse or parent (if you are a minor child), but will not disclose information on your diagnosis or prognosis to your spouse unless you authorize the release of such information. If you wish to make this authorization, you can request a form to do so from the HR Department.
11. Additional Uses and Disclosures: Health Plan may also use or disclose your PHI, in accordance with the law:
o To report abuse or neglect, or to report domestic violence to appropriate agencies or authorities;
o To workers’ compensation carriers or plans, to the extent necessary to comply with workers’ compensation laws;
o For judicial and administrative proceedings (for example, to respond to court orders or subpoenas);
o To health oversight agencies or other government agencies, for audits, investigations, inspections and licensure needed for the government to monitor health plans;
o To facilitate organ or tissue donation or transplantation, if you are an organ or tissue donor or recipient;
o For purposes of national security and intelligence (for example, to enable government agencies to conduct special investigations or to provide protection to certain individuals);
o To military authorities if you are a member of the armed services, and military authorities determine that disclosure of such information is necessary;
o To correctional institutions or law enforcement officials regarding individuals in custody;
o For research purposes in limited circumstances;
o To coroners, medical examiners, and funeral directors (for example, to identify a person or cause of death);
o As an incidental disclosure that occurs during a permitted use or disclosure of PHI;
o As part of a “limited data set” for research, public health and health care operations, to certain third parties who have agreed in writing to limit their use and disclosure of the information in the limited data set.
Other uses and disclosures will be made only with your written authorization or that of your personal representative, and you may revoke such authorization as provided by section 164.508(b)(5) of the Privacy Rule. Any disclosures that were made when your Authorization was in effect will not be taken back.
Certain Other Health Information
Please note that not all of your health information is subject to protection under these rules. In particular, the use or disclosure of health information that you provide (or that is provided by someone else at your request) to Formed Fiber as your employer, and is maintained as part of your employment records, is not subject to these rules. Your employer may use or disclose such health information for employment-related purposes, for example to fulfill its legal obligations under the federal Family and Medical Leave Act or under the Americans With Disabilities Act, or in connection with providing life insurance or disability benefits for you (or your beneficiaries). In addition, information created or received by your employer in connection with workers’ compensation benefits is not protected under the Privacy Rule.
Your Health Information Rights
You have the following rights with respect to your PHI. To exercise any of these rights, you must submit a written request to Privacy Officer, 125 Allied Road, Auburn, ME 04211, 207-784-1135.
1. The right to inspect and copy your PHI, as provided by section 164.524 of the Privacy regulations.
2. The right to request restrictions on certain uses and disclosures of your PHI, as provided by section 164.522(a) of the Privacy regulations (although the Health Plan is not required to agree to a requested restriction).
3. The right to request confidential communications of your PHI, if you believe a Health Plan’s usual method of communicating PHI may endanger you, as provided by section 164.522(b) of the Privacy regulations. A Health Plan will accommodate your reasonable requests to the extent feasible.
4. The right to amend PHI you feel is incorrect, as provided by section 164.526 of the Privacy regulations. A Health Plan may deny your request, but must respond to you in either case.
5. The right to receive an accounting of disclosures a Health Plan has made of your PHI, as provided by section 164.528 of the Privacy regulations. The Health Plan is not required to, and will not, account for disclosures made for treatment, payment or health care operations, national security, law enforcement, to corrections personnel, pursuant to your Authorization, or to you. Please note the time period for which you want an accounting, and the format in which you wish to receive it (e.g., paper or electronically). Note that we will not account for disclosures made more than six years prior to your request, nor for disclosures made before HIPAA became effective for a Health Plan (April 14, 2004). The Health Plan will provide one accounting of disclosures free of charge once every twelve months.
6. The right to file a complaint if you feel your privacy rights have been violated. For details, see subsequent section of this Notice entitled “For More Information or To Report a Problem.” Neither the Health Plan nor the Plan Sponsor will retaliate against you for filing a grievance.
7. The right to receive a paper copy of this Notice upon request to the Health Plan, even if you have previously agreed to receive this Notice electronically.
Health Plan’s Responsibilities Regarding Your PHI
HIPAA requires a Health Plan to:
maintain the privacy of your PHI
provide you with a Notice as to the Plan Sponsor’s legal duties and privacy practices with respect to information we collect and maintain about you
abide by the terms of this Notice
The Health Plan reserves the right to change the terms of this Notice at any time and to make the revised Notice provisions effective for all PHI the Health Plan maintains, even PHI obtained prior to the effective date of the revisions.
If the Health Plan makes a material revision to this Notice, it will notify you within sixty (60) days after the date the material change is made by mailing a notice that the Notice has been revised and can be downloaded from the web site or you can call or write back to request that a copy of the revised Notice be sent to you.
You can obtain additional copies of this Notice by calling the Privacy Officer at 207-784-1135. You can also view and print this Notice by visiting the Plan Sponsor web site at: