Notice of privacy practices

This notice describes how medical information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully.

At Providence Health Plan, we respect the privacy and confidentiality of your protected health information (PHI). We are required by law to maintain the privacy of your protected health information, (commonly called PHI or your personal information) including in electronic format. When we use the term “personal information” we mean information that identifies you as an individual such as your name and Social Security Number, as well as financial, health and other information about you that is nonpublic, and that we obtain so we can provide you with insurance coverage. Providence Health Plan maintains policies that protect the confidentiality of personal information, including Social Security numbers, obtained from its members in the course of its regular business functions. We must provide you with this notice, and abide by the terms of this notice. This notice explains how we may use and disclose information about you in administering your benefits and it also informs you about your rights as our valued member. Finally, this notice provides you with information about exercising these rights.

How Providence Health Plan uses and discloses your PHI without your written Authorization

We may use and disclose your protected health information for different purposes. We use PHI and may share it with others while providing health benefits. The examples below are provided to illustrate the types of uses and disclosures we may make without your authorization for payment, health care operations and treatment:

• Payment: We may use or disclose your PHI to make coverage determinations, to coordinate benefits with other coverage you may have, and to help pay your medical bills that have been submitted to us by doctors and hospitals for payment. We may also use and disclose PHI to collect premiums and calculate cost-sharing amounts.
• Health Care Operations: We may use or disclose your PHI to provide customer service, to support and improve programs and services we offer you and as necessary to operate and manage our business activities related to providing and managing your healthcare coverage. For example, we might talk to your doctor to suggest a disease management or wellness program that could help improve your health.
• Treatment: We do not provide treatment. This is the role of a healthcare provider, such as your doctor or a hospital. We may use and disclose your PHI with your doctors or hospitals to help them provide medical care to you.
• Plan Sponsor/Administrator: If you are enrolled with Providence Health Plan through an employer-sponsored group health plan, Providence Health Plan may share PHI with your group health plan. We may share your information with your plan sponsor if requested so that your plan sponsor can obtain premium bids or modify, amend, or terminate the plan. If your employer pays your premium or part of your premium, but does not pay your health insurance claims, your employer is not allowed to receive your PHI for purposes other than obtaining premium bids or to modify, amend, or terminate the plan, unless your employer promises to protect your PHI and makes sure the PHI will be used for legal reasons only.

Person(s) Involved in Your Care or Payment for Your Care:

We may also disclose protected health information to a person, such as a family member, relative, or close personal friend, who is involved with your care or payment. We may disclose the relevant protected health information to these persons if you do not object or we can reasonably infer from the circumstances that you do not object to the disclosure; however, when you are not present or are incapacitated, we can make the disclosure if, in the exercise of professional judgment, we believe the disclosure is in your best interest.

Other uses and disclosures that we may make without your Authorization

There are a number of ways that your health information may be used or disclosed without your authorization. Generally, these uses and disclosures are either required by law or for public health and safety purposes.

• As Required by Law: We must disclose protected health information about you when required to do so by law.
• Business Associate: We may use or disclose your PHI with individuals who perform business functions on our behalf or provide us with services if the information is necessary for such functions or services. Our business associates are required, under contract with us and pursuant to federal law, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract and as permitted by federal law.
• Coroners, Funeral Directors, Organ Donation: We may disclose protected health information to coroners or funeral directors as necessary to allow them to carry out their duties or in connection with organ or tissue donation.
• Health Oversight: We may disclose protected health information to state and federal agencies that regulate us, including but not limited to the U.S. Department of Health and Human Services, the Oregon Division of Financial Regulation and the Washington Office of Insurance Commissioner.
• Judicial and Administrative Proceedings: We may disclose protected health information in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process.
• Law Enforcement: We may disclose protected health information under limited circumstances to a law enforcement official in response to a warrant or to identify or locate a suspect or to provide information about the victim of a crime.
• Public Health Activities: We may disclose protected health information to public health agencies for reasons such as preventing or controlling disease, injury or disability.
• Research: We may disclose your health information to researchers, provided that the research has been approved by an Institutional Review Board and/or a Privacy Board, and the research protocols have been approved to ensure your privacy. We may disclose healthcare information about you to people preparing to conduct a research project.
• Specialized Government Functions: We may disclose information as required by military authorities or to authorized federal officials for national security and intelligence activities.
• To Avert a Serious Threat to Health or Safety: We may disclose protected health information about you, with some limitations, when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
• Victims of Abuse, Neglect, or Domestic Violence: We may disclose protected health information to government agencies about abuse, neglect, or an act of domestic violence.
• Workers Compensation: We may disclose PHI as authorized by, or to the extent necessary to comply with, state workers’ compensation laws that govern job-related injuries or illnesses. 

Other uses and disclosures requiring your written Authorization

We are required to obtain your written authorization to use or disclose your protected health information, with limited exceptions, for the following reasons:

• Marketing. We will request your written authorization to use or disclose your protected health information for marketing purposes with limited exceptions, such as when we have face-to-face marketing communications with you or when we provide promotional gifts of nominal value.
• Sale of Protected Health Information. We will request your written authorization before we make any disclosure that is deemed a sale of your protected health information; we do not currently sell or plan to sell your health information.
• Other Uses or Disclosures. All other uses or disclosures of your protected health information not described in this Notice will be made only with your written authorization, unless otherwise permitted or required by law.

Disclosures of certain PHI deemed “Highly Confidential.”

For certain kinds of PHI, federal and state law may require enhanced privacy protection. These might include PHI that is:

• About alcohol and drug abuse prevention, treatment and referral
• About HIV/AIDS testing, diagnosis or treatment
• About genetic testing
• About psychotherapy notes.

If the PHI is subject to enhanced protection, we can only disclose it with your prior written authorization unless specifically permitted or required by law.

Revocation of an Authorization

You may revoke an authorization at any time in writing, except to the extent that we have already taken action on the information disclosed or if we are permitted by law to use the information to contest a claim or coverage under the Plan.

NOTE: If we disclose information as a result of your written permission, it may be re-disclosed by the receiving party and may no longer be protected by state and federal privacy rules. However, federal or state law may restrict re-disclosure of additional information such as HIV/AIDS information, mental health information, genetic information and drug/alcohol diagnosis, treatment or referral information.

 

Privacy rights regarding your Protected Health Information

Right to Access your Protected Health Information: You have the right to inspect, review or obtain a copy of your information that is kept by Providence Health Plan in your designated record set with some limited exceptions. The designated record set includes any records used to make decisions about you as a member. You may request that we provide a copy of this protected health information in a format other than photocopies, such as providing them to you electronically, if it is readily producible in such form and format. We require that your request for information be made in writing. We will charge you a reasonable fee based for the cost of producing and providing your designated record set. You may request a copy of the portion of your enrollment and claim record related to an appeal or grievance, free of charge. If we deny your request for your information, we will notify you in writing and will provide you with a right to have the denial reviewed if applicable. You have similar rights with respect to your medical records. However, Providence Health Plan will generally not have your medical records unless they were received from your physician or provider for a purpose described above. Call your physician's or provider's office to ask how to receive a copy.

Right to an Accounting of Disclosures by the Plan: You have a right to a listing of the disclosures we make of your protected health information, except for those disclosures made for treatment, payment, or health care operations, or those disclosures made pursuant to your authorization. The type of disclosures typically contained in a listing would be disclosures made for mandatory public health purposes, law enforcement or legal proceedings. We require that your request for an accounting of disclosures be made in writing and must state a time period for which you want an accounting. This time period may not be longer than six years and may not include dates before April 14, 2003. The first accounting that you request within a 12-month period will be free.

Right to Amend Your Protected Health Information: If you believe that protected health information maintained by the Plan is incorrect or incomplete, you may request that we amend or change, the information. We require that your request be in writing and that you provide a reason for your request. If we make the amendment, we will notify you that it was made, and we will notify appropriate others, including business associates, of the amendment. If we deny your request to amend, we will notify you in writing of the reason for the denial. You have the right to appeal our denial by filing a written statement of disagreement.

Right to Confidential Communications: You have the right to request that we use a certain method to communicate with you about the Plan or that we send Plan information to a certain location if the communication could endanger you. For example, you may request that we send your information by a specific means (for example, U.S. mail only) or to a specified address. Methods of requesting confidential communications are:

• All Providence Health Plan members have the right to request that their PHI be sent to a different address if sending PHI to your current address might put you in danger. Providence Health Plan will accommodate a reasonable request of this nature. We will not ask you to explain why you believe you are in danger. These requests can be made verbally.
• If applicable, some state laws provide additional privacy protections whereby members have the right to request that their plan information that contains PHI or personal information be sent to another address other than their home, or to refrain from disclosing such information to the policyholder/subscriber. We require that these requests be made in writing. Additional information may be found at the bottom of this page in the "Additional privacy notices and policies" section under the tab "Oregon request for confidential communications".

Right to a Notice in the event of a Breach: You have a right to receive a notice of a breach involving your protected health information (PHI) should one occur.

Right to Request Restrictions on the Use and Disclosure of Your Protected Health Information: You have the right to request that we restrict or limit how we use or disclose your protected health information for treatment, payment or health care operations. If we do agree, we will comply with your request unless the information is needed for an emergency. While we may honor your request for restrictions, we are not required to agree to these restrictions. Your request for a restriction must be made in writing.

How we protect your privacy and secure your information

Providence Health Plan has policies and procedures in place to ensure the confidentiality of your PHI. We keep your oral, written and electronic PHI safe using physical, electronic and procedural means. These safeguards follow federal and state laws. Some of the ways we keep your PHI safe include:

• Providence Health Plans employees are educated about the Privacy and Security rules and sign a confidentiality statement upon employment.
• Employees are trained that they may only speak about PHI with those that need to know the information, such as a provider or a supervisor. And that they should not speak about PHI in public spaces, including health plan restrooms or hallways.
• Where appropriate, employees must lock storage areas and filing cabinets.
• Employees are required to securely dispose of written PHI.
• Employees must report any privacy and/or security violations.
• Unique and secured log-in names and passwords are required to access the computer system. In addition, firewalls, encryption and data backup systems are used. To enter the health plan buildings, an ID badge must be used to open the door.
• Our agreements with participating providers contain confidentiality provisions that require these providers to treat your PHI with the same care as Providence Health Plan.
• Our agreements with business associates who perform functions or activities on our behalf require them to appropriately safeguard your PHI with the same care as Providence Health Plan.

Exercising your rights

You may exercise any of the rights described above by contacting Customer Service or the Office for Civil Rights, U.S. Department of Health and Human Services. You may find the Member Authorization and Privacy forms at the bottom of this page or access them here.

Contacting Customer Service

If you have any questions about your PHI or if you believe your privacy rights have been violated, please contact Customer Service at:

Local: 503-574-7500

Toll free: 800-878-4445 TTY: 711

Monday through Friday, 8 a.m. to 5 p.m. (Pacific time)

You may file a complaint with us in writing at:

Providence Health Plan

Attn: Appeals and Grievance Dept.
P.O. Box 4327
Portland, OR 97208-4327

 

Contacting support outside of Providence Health Plan

You may notify the Office for Civil Rights, U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not take any action against you for filing a complaint.

You may file the complaint at the Office for Civil Rights at:

Office for Civil Rights

U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201

OCR Hotlines-Voice: 1-800-368-1019

E-mail: OCRComplaint@hhs.gov

Website: Office for Civil Rights www.hhs.gov/ocr/index.html

Additional contacts

If you have further questions about Providence Health Plan privacy practices, please call our Privacy Program at:503-574-7770

Copies and Changes to the Notice

You have the right to obtain a new copy of this notice at any time. Even if you have agreed to receive this notice by electronic means, you still have the right to a paper copy. We reserve the right to change the terms of this notice and to make the new notice effective for all protected health information we maintain. If revised, we will prominently post the change of our revised notice on our web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in our next annual mailing to subscribers/members then covered by the plan. The new notice will also be available online at https://providencehealthplan.com/notice-of-privacy-practice/.

Effective date of this notice

The original effective date of this Notice was April 14, 2003. The most recent revision date is Jan. 16, 2020.