Notice of Privacy Practices
HAP
Alliance Health and Life Insurance Company®
HAP Empowered Health Plan, Inc.
Effective Oct. 1, 2018
Your protected health information
PHI stands for protected health information. PHI can be used to identify you. It includes information such as your name, age, sex, address and member ID number, as well as your:
- Physical or mental health
- Health care services
- Payment for care
You can ask HAP to give your PHI to people you choose. To do this, fill out our release form.
Your privacy
Keeping your PHI safe is important to HAP. We’re required by law to keep your PHI private. We must also tell you about our legal duties and privacy practices. This notice explains:
- How we use information about you
- When we can share it with others
- Your rights related to your PHI
- How you can use your rights
When we use the term "HAP," "we" or "us" in this notice, we’re referring to HAP and its subsidiaries. These include Alliance Health and Life Insurance Company and HAP Empowered Health Plan, Inc
How we protect your PHI
We protect your PHI in written, spoken and electronic form. Our employees and others who handle your information must follow our policies on privacy and technology use. Anyone who starts working for HAP must state that they have read these policies. And they must state that they will protect your PHI even after they leave HAP. Our employees and contractors can only use the PHI necessary to do their jobs. And they may not use or share your information except in the ways outlined in this notice.How we share your PHI
We only share your information with those who must know for:
- Treatment
- Payments
- Business tasks
Treatment
We may share your PHI with your doctors, hospitals or other providers to help them:
- Provide treatment. For example, if you’re in the hospital, we may let them see records from your doctor.
- Manage your health care. For example, we might talk to your doctor to suggest a HAP program that could help improve your health.
Payment
We may use or share your PHI to help us figure out who must pay for your medical bills. We may also use or share your PHI to:
- Collect premiums
- Determine which benefits you can get
- Figure out who pays when you have other insurance
Business tasks
As allowed by law, we may share your PHI with:
- Companies affiliated with HAP
- Other companies that help with HAP’s everyday work
- Others who help provide or pay for your health care
We may share your information with others who help us do business. If we do, they must keep your information private and secure. And they must return or destroy it when they no longer need it for our business.
It may be used to:
- Evaluate how good care is and how much it improves. This may include provider peer review.
- Make sure health care providers are qualified and have the right credentials.
- Review medical outcomes.
- Review health claims.
- Prevent, find and investigate fraud and abuse.
- Decide what is covered by your policy and how much it will cost. But, we are not allowed to use or share genetic information to do that.
- Do pricing and insurance tasks.
- Help members manage their health care and get help managing their care.
- Communicate with you about treatment options or other health-related benefits and services.
- Do general business tasks, such as quality reviews and customer service.
Other permitted uses
We may also be permitted or required to share your PHI:
With you
- To tell you about medical treatments and programs or health-related products and services that may interest you. For example, we might send you information on how to stop smoking or lose weight.
- For health reminders, such as refilling a prescription or scheduling tests to keep you healthy or find diseases early.
- To contact you, by phone or mail, for surveys. For example, each year we ask our members about their experience with HAP.
With a friend or family member
- With a friend, family member or other person who, by law, may act on your behalf. For example, parents can get information about their children covered by HAP.
- With a friend or family member in an unusual situation, such as a medical emergency, if we think it’s in your best interests. For example, if you have an emergency in a foreign country and can’t contact us directly. In that case, we may speak with a friend or family member who is acting on your behalf.
- With someone who helps pay for your care. For example, if your spouse contacts us about a claim, we may tell him or her whether the claim has been paid.
With the government
- For public health needs in the case of a health or safety threat such as disease or a disaster.
- For U.S. Food and Drug Administration investigations. These might include probes into harmful events, product defects or product recalls.
- For health oversight activities authorized by law.
- For court proceedings and law enforcement uses.
- With the police or other authority in case of abuse, neglect or domestic violence.
- With a coroner or medical examiner to identify a body, find out a cause of death or as authorized by law. We may also share member information with funeral directors.
- To comply with workers' compensation laws.
- To report to state and federal agencies that regulate HAP and its subsidiaries. These may include the:
- U.S. Department of Health and Human Services
- Michigan Department of Insurance and Financial Services
- Michigan Department of Health and Human Services
- Federal Centers for Medicare and Medicaid Services
- To protect the U.S. president.
For research or transplants
- For research purposes that meet privacy standards. For example, researchers want to compare outcomes for patients who took a certain drug and must review a series of medical records.
- To receive, bank or transplant organs, eyes or tissue.
With your employer or plan sponsor
We may use or share your PHI with an employee benefit plan through which you get health benefits. It is only shared when the employer or plan sponsor needs it to manage your health plan.
Except for enrollment information or summary health information and as otherwise required by law, we only share your PHI with an employer or plan sponsor if they have guaranteed in writing that it will be kept private and won’t be used improperly.
To use or share your PHI for any other reason, we must get your written permission. If you give us permission, you may change your mind and cancel it. But it will not apply to information we’ve already shared.
Organized health care arrangement
HAP and HAP affiliates covered by this Notice of Privacy Practices and Henry Ford Health and its affiliates are part of an organized health care arrangement. Its goal is to deliver higher quality health care more efficiently and to take part in quality measure programs, such as the Healthcare Effectiveness Data and Information Set. HEDIS is a set of standards used to measure the performance of a health plan. In other words, HEDIS is a report card for managed care plans.
The Henry Ford Health organized health care arrangement includes:
- HAP
- Alliance Health and Life Insurance Company
- HAP Empowered Health Plan, Inc.
- Henry Ford Health
Henry Ford’s organized health care arrangement lets these organizations share PHI. This is only done if allowed by law and when needed for treatment, payment or business tasks relating to the organized health care arrangement.
This list of organizations may be updated. You can access the current list at hap.org/privacy or call us at (800) 422-4641 (TTY: 711). When required, we will tell you about any changes in a revised Notice of Privacy Practices
Your rights
These are your rights with respect to your information. If you would like to exercise any of these rights, please contact us. The contact information is in the “Who to contact” section at the end of this document. You may have to make your requests in writing.
You have the following rights:
Right to see your PHI and get a copy
With some exceptions, you have the right to see or get a copy of PHI in records we use to make decisions about your health coverage. This includes our enrollment, payment, claims resolutions and case or medical management notes. If we deny your request, we’ll tell you why and whether you have a right to further review.
You may have to fill out a form to get PHI and pay a fee for copies. We’ll tell you if there are fees in advance. You may choose to cancel or change your request.
Right to ask us to change your PHI
If we deny your request for changes in PHI, we’ll explain why in writing. If you disagree, you may have your disagreement noted in our records. If we accept your request to change the information, we’ll make reasonable efforts to tell others of the change, including people you name. In this case, the information you give us must be correct. And we cannot delete any part of a legal record, such as a claim submitted by your doctor.
Right to know about disclosures
You have the right to know about certain disclosures of your PHI. HAP does not have to inform you of all PHI we release. We are not required to tell you about PHI shared or used for treatment, payment and business tasks. And we do not have to tell you about information we shared with you or based on your authorization. But you may request a list of other disclosures made during the six years prior to your request.
Your first list in any 12-month period is free. However, if you ask for another list within 12 months of receiving your free list, we may charge you a fee. We’ll tell you if there are fees in advance. You may choose to cancel or change your request.
Right to know about data breaches that compromise your PHI
If there is a breach of your unsecured PHI, we’ll tell you about it as required by law or in cases when we deem it appropriate.
Right to ask us to limit how we use or share your PHI
You may ask us to limit how we use or share your PHI for treatment, payment or business tasks. You also have the right to ask us to limit PHI shared with family members or others involved in your health care or payment for it. We do not have to agree to these limits. But if we do, we’ll follow them – unless needed for emergency treatment or the law requires us to share your PHI. In that case, we will tell you that we must end our agreement.
Right to request private communications
If you believe that you would be harmed if we send your PHI to your current mailing address (for example, in a case of domestic dispute or violence), you can ask us to send it another way. We can send it by fax or to another address. We will try to meet any fair requests.
You have a right to get a paper copy of this notice.
See our contact information below.
Changes to the privacy
We have the right to make changes to this notice. If we make changes, the new notice will be effective for all the PHI we have. Once we make changes, we’ll send you the new notice by U.S. mail and post it on our website.
Who to contact
If you have any questions about this notice or about how we use or share member information, mail a written request to:
HAP and HAP Empowered Plan Information Privacy & Security Office
One Ford Place, 2A
Detroit, MI 48202
You may also call us at (800) 422-4641 (TTY: 711).
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us. Contact the Information Privacy & Security Office above or HAP’s Compliance Hotline at (877) 746-2501 (TTY: 711). You can stay anonymous. You may also notify the secretary of the U.S. Department of Health and Human Services of your complaint. We will not take any action against you for filing a complaint.
Original effective date: April 13, 2003
Revisions: February 2005, November 2007, September 2013, September 2014, March 2015, October 2015, October 2018, January 2019, August 2020
Reviewed: November 2008, November 2009, October 2011