How we may use and share your protected health information
The following sections describe different ways that we use, share or disclose your PHI. We will describe each category of uses and disclosures and give some examples. The law limits how we can use and disclose some PHI related to treatment of drug and alcohol abuse, HIV infection, and mental illness. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the following categories.
For treatment
We may use, share or disclose your PHI when necessary for you to receive treatment or services. For instance, we may share your PHI with any doctor, health care professional or health facility involved in making decisions about your care.
For payment
We may use or share your PHI for payment, collection and billing purposes related to services provided to you. For instance, we may use information regarding your medical procedures and treatment to process and pay claims, to determine whether services are medically necessary or to pre-authorize or certify services covered under your health benefits plan. We may share such information with another health plan to process and pay claims on your behalf. We may also share PHI with any of your direct treatment providers so they can bill and collect payment for services provided to you.
For health care operations
We will use and share your PHI as permitted by law for health care operations, including credentialing health care providers, peer review, business management, accreditation and licensing, utilization review and management, quality improvement and assurance, enrollment, underwriting, reinsurance, compliance, auditing, rating, and other functions related to your health plan benefits. We may also disclose your PHI to another health care facility, health care professional, or health plan for such things as quality assurance and case management, but only if that facility, professional, or plan also has or had a provider relationship with you.
Some parts of our services are done through contracts with outside persons or organizations, such as auditing, accreditation, actuarial services, legal services, etc. At times it may be necessary for us to provide some parts of your PHI to one or more of these outside persons or organizations that assist us with our health care operations. In all cases, we require these business associates to appropriately safeguard the privacy of your PHI.
Sponsor of the health plan
We may share your PHI with the employer or sponsor who pays for your health plan benefits. The employer or sponsor is only permitted to use your PHI to determine your eligibility for health plan benefits, to enroll you in a health plan and to make your premium payments.
Individuals involved in your care or payment for your care
We may share your PHI with a family member, friend, personal representative, or anyone else you want to be involved in your care. We may share your PHI with anyone who helps pay for your care. Unless you tell us in writing to do otherwise, we may tell your family or friends about your condition. If you are unavailable, incapacitated, or facing an emergency medical situation and we determine that a limited disclosure may be in your best interest, we may share limited PHI with such individuals without your approval.
Other health-related products or services
We may, from time to time, use your PHI to determine whether you might be interested in or benefit from treatment alternatives or other health-related programs, products or services which may be available to you as a member of the health plan. For example, we may use your PHI to inform you of a disease management program that may help you manage your illness better. We will not use your PHI to tell you about non health-related products or services without your written permission.
As required by law
We will use and share your PHI when required to do so by federal, state or local law.
To avert a serious threat to health or safety
We may use and share your PHI when necessary to prevent or lessen a serious threat to your health and safety, or to that of others. However, we will disclose your PHI only to a responsible person who is able to help prevent the threat.
Organ and tissue donation
We may disclose your PHI to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to help with organ or tissue donation and transplantation.
Military service and veterans
If you are or have been a member of the Armed Forces, we will disclose your PHI when so required by the appropriate military command authorities. We may also release PHI about foreign military personnel to the appropriate military authorities as authorized or required by law.
Workers’ Compensation
We may disclose your PHI as permitted by law for Workers’ Compensation or similar programs when necessary to provide treatment, services, or benefits for work-related injuries or illness.
Public health risks
We may use and disclose your PHI for public health purposes. In general, these activities include, but are not limited the following:
- to prevent or control disease (such as cancer or tuberculosis), injury or disability;
- to report births and deaths;
- to report the abuse or neglect of children, elders and dependent adults;
- to report reactions to medications or problems with healthcare products;
- to notify members of recalls, repairs or replacement of products they may be using;
- to notify a person who may have been exposed to a disease or may be at risk for getting or spreading a disease or condition;
- to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will share your PHI only if you agree, or when it is required or authorized by law.
Health oversight activities
We may use and disclose your PHI to a healthcare oversight agency as authorized or required by law. Examples of oversight activities include audits, investigations, inspections, accreditation and licensure surveys. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Lawsuits and disputes
We may disclose your PHI in response to a court or administrative order, a subpoena, discovery request, warrant, summons, or other lawful process. We will do so only after we make efforts to tell you about the request (which may include a written notice to you) or to obtain an order protecting the information requested.
Law enforcement
We may use and share PHI if asked to do so by a law enforcement official:
- in compliance with a court order, subpoena, warrant, summons, grand jury subpoena or similar process;
- to identify or locate a suspect, fugitive, material witness, or missing person;
- about a victim of or a crime, if, under some limited circumstances, we are unable to obtain the permission directly from the victim of a crime;
- about a death we believe may be the result of criminal conduct;
- about criminal conduct in any of our contracted facilities; and
- in emergency circumstances to report: a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
Coroners, medical examiners and funeral directors
We may use and share your PHI to the county coroner for purposes of identification; when investigating public health concerns or criminal deaths; or when otherwise authorized by the decedent’s representative.
National security and intelligence activities
We may use and disclose your PHI to federal officials for intelligence, counterintelligence, and other national security activities as authorized or required by law.
Protective services for the President and other persons
As authorized or required by law, we may use and disclose your PHI to authorized federal officials so they may provide protection to the President, the President's family, other designated persons or foreign heads of state, or to conduct special investigations.
While you are in a correctional institution or under the custody of law enforcement officials, we may use and disclose your PHI to the correctional institution or law enforcement officials if they tell us that it is necessary: (1) to provide the healthcare services you need, (2) to protect your health and safety or that of others, or (3) for the safety and security of the correctional institution.
Other uses of your protected health information
Other uses and disclosures of PHI not covered by this Notice, or by the laws that apply to us, will be made only with your written permission. If you allow us to use, share or disclose your PHI, you may cancel that permission in writing at any time. If you cancel your permission, we will stop any further use or disclosure of your PHI for the purposes covered by your written permission, unless we have already done so based on your earlier permission. You should understand that we are unable to take back any disclosures we have already made with your permission and that we are required by law to keep records of the services or treatment we provided to you.
Your rights regarding your protected health information
Note: Please keep in mind that Valley Health Plan collects and maintains information regarding you and your health care services. Your medical record is maintained by your direct medical treatment provider.
You have the following rights regarding your PHI that VHP maintains in our facilities:
Right to inspect and copy
Except for information related to treatment of mental illness, or information gathered in a civil, criminal, or administrative action or proceeding, or some PHI subject to the Clinical Laboratory Amendments of 1988, you have the right to ask to inspect your PHI. To inspect your PHI maintained at Valley Health Plan, you must send a specific request in writing to the VHP Member Services Department, 2480 N. First Street, Suite 200, San Jose, CA 95131. In many instances, we may refer you to your direct treatment provider in order for you to inspect, amend or copy your PHI contained in the medical record.
You may ask for a review if we deny access to inspect and copy your PHI, except for the following: 1) in circumstances listed above; 2) you are an inmate and the copies would jeopardize your health, safety, security, custody, or rehabilitation or that of others; 3) if the PHI is controlled by the Privacy Act and access is not permitted by law; or 4) if the PHI was obtained from someone other than a healthcare provider under a promise of confidentiality, and access to the PHI would reveal who that person is. You must ask for a review in writing addressed as follows:
VHP Privacy Coordinator
2480 N. First Street, Suite 200
San Jose, CA 95131
Right to amend
If you feel that your PHI in our custody is incorrect or incomplete, you may ask us to correct and amend the PHI. You have a right to request a change for as long as we keep your PHI. To ask for change, you must send a written request with a reason that supports your request to the VHP Member Services Department, 2480 N. First Street, Suite 200, San Jose, CA 95131.
We may deny your request to amend PHI maintained by Valley Health Plan. In addition, we may deny your request if you ask us to change or amend PHI [information] that:
- was not created by us;
- is not part of the information kept by or for us;
- is not part of the information which you are permitted by law to inspect and copy; or
- is accurate and complete.
If we deny your request for a change to your PHI, you have the right to submit written correction about any item or statement in your record you believe is incomplete or incorrect. The correction cannot exceed 250 words per alleged incomplete or incorrect item in your record.
Reminder: Your medical record is maintained by your direct medical treatment provider and we may direct you to send your request to that provider.
Right to an accounting of disclosures
You have the right to request a list of how we have disclosed or shared your PHI, other than disclosures made in the following circumstances: 1) to you or authorized by you; 2) for national security or intelligence purposes; 3) to correctional institutions or law enforcement; 4) as part of limited data set as permitted by law; or 5) for treatment, payment and healthcare operations (as described above). To request this accounting of disclosures, you must send your request in writing to the VHP Member Services Department, 2480 N. First Street, Suite 200, San Jose, CA 95131.
Your request must state a time period, which cannot be longer than a six-year period and cannot include dates before April 14, 2003. Your request should describe the type of list you would like (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to request restrictions
You have the right to ask that we limit how we use or disclose your PHI for treatment, payment or healthcare operations. You also have the right to ask us to limit the PHI we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you. To request restrictions, you must send a request in writing to the VHP Member Services Department, 2480 N. First Street, Suite 200, San Jose, CA 95131.
In your request, you must tell us the following: (1) what information you want to limit; (2) whether you want to limit our use, our disclosure or both; and (3) to whom you want the limits to apply (for example, disclosures to your spouse or a family member).
Right to request confidential communications
You have the right to ask that we communicate with you about your PHI in a certain way or at a certain location. We will accommodate reasonable requests of this nature. For instance, if it is a matter of safety or security, you can ask that we contact you at a phone number and address other than your home phone and address. To request confidential communications, you must send a written request to the VHP Member Services Department, 2480 N. First Street, Suite 200, San Jose, CA 95131.
We will not ask the reason for your request and we will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a paper copy of this notice
You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time in person or in writing by sending in a written request addressed as follows: VHP Privacy Coordinator, 2480 N. First Street, Suite 200, San Jose, CA 95131.
Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this notice. You may obtain an electronic copy of this Notice from our website at www.valleyhealthplan.org.
Changes to this notice
We reserve the right to change our privacy practices and this Notice. We reserve the right to make the revised or changed Notice effective for the PHI we already have about you, as well as any other information we create in the future. The effective date of the Notice will be displayed on the first page. You may ask at any time for a copy of the current Notice in effect and we will give it to you.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us, or with the Secretary of the Department of Health and Human Services. To file a complaint with us, you must send a written notice to:
VHP Member Services Department
2480 N. First Street, Suite 200
San Jose, CA 95131