This notice describes how protected health information that is about you may be used and disclosed and how you gain access to this information.
Alliance Health and Life Insurance Company®
HAP Midwest Health Plan, Inc.
Last review: October 2015
Your protected health information
PHI stands for protected health information. PHI is information about you, such as your name, demographic data and member ID number that can reasonably be used to identify you. This information relates to your past, present or future physical or mental health, the health care services you receive or the payment for that care. Our policies cover protection of your PHI whether it’s oral, written or electronic.
Important information about privacy
Safeguarding the privacy of your PHI is important to HAP. We’re required by law to protect the privacy of your PHI and to provide you with notice of our legal duties and privacy practices. That’s what this notice is for. It explains how we use information about you and when we can share that information with others. It also tells you about your rights with respect to your PHI and how you can use your rights. We’re required to comply with the terms set out in this notice.
When we use the term "HAP," "we" or "us" in this notice, we’re referring to HAP and its subsidiaries, including Alliance Health and Life Insurance Company and HAP Midwest Health Plan, Inc.
How we protect your PHI
We protect your PHI – whether it’s written, spoken or in electronic form – by requiring employees and others who handle your information to follow specific confidentiality and technology usage policies. When they begin working for HAP, all employees and contractors must acknowledge that they have reviewed HAP's policies and that they will protect your PHI even after they leave HAP. An employee or contractor's use of protected information is limited to the minimum amount of information necessary to perform a legitimate job function. Employees and contractors are also required to comply with this privacy notice and may not use or disclose your information except as described in this notice.
Using and disclosing PHI
These next sections describe how HAP uses and shares your health information. Keep in mind that we share your information only with those who have a "need to know" in order to perform these tasks:
We may share your PHI with your doctors, hospitals or other providers to help them provide medical care to you. For example, if you’re in the hospital, we may give them access to any medical records sent to us by your doctor.
We may use or share your PHI with others to help manage your health care. For example, we might talk to your doctor to suggest a disease management or wellness program that could help improve your health.
We may use or share your PHI to help us determine who is financially responsible for your medical bills. We may also use or share your PHI to conduct other payment activities, such as:
- Obtaining premium payments
- Determining eligibility for benefits
- Coordinating benefits with other insurance you may have
We share your PHI with affiliated companies as permitted by law, nonaffiliated third parties with whom we contract to help us operate HAP and with others who are involved in providing or paying for your health care services. We may also share your information with others who help us conduct our business operations. If we do so, we will require these persons or entities to protect the privacy and security of your information and to return or destroy such information when it’s no longer needed for our business operations.
Here are examples of business activities undertaken by HAP:
- Conducting quality assessment and improvement activities, including peer review, credentialing of providers and accreditation
- Performing outcome assessments and health claims analyses
- Preventing, detecting and investigating fraud and abuse
- Underwriting, rating and reinsurance activities, although we’re prohibited from using or disclosing any genetic information for underwriting purposes
- Coordinating case and disease management activities
- Communicating with you about treatment alternatives or other health-related benefits and services
- Performing business management and other general administrative activities, including systems management and customer service
We may also disclose your PHI to other providers and health plans that have a relationship with you for certain health care operations. For example, we may disclose your PHI for their quality assessment and improvement activities or for health care fraud and abuse detection.
Other uses and disclosures that are permitted or required
- For certain types of public health or disaster relief efforts.
- To give you information about alternative medical treatments and programs or about health-related products and services that you may be interested in. For example, we might send you information about smoking cessation or weight loss programs.
- To give you reminders relating to your health, such as a reminder to refill a prescription, or to schedule recommended health screenings.
- For research purposes. For example, a research organization that wishes to compare outcomes of all patients who receive a particular drug and must review a series of medical records. In all cases in which your specific authorization hasn’t been obtained, your privacy will be protected by strict confidentiality requirements applied by an institutional review board or a privacy board that oversees the research or by representations of the researchers that limit their use and disclosure.
- To report information to state and federal agencies that regulate HAP and its subsidiaries, such as the U.S. Department of Health and Human Services, the Michigan Department of Financial and Insurance Services, the Michigan Department of Health and Human Services and the federal Centers for Medicaid & Medicare Services.
- When needed by the employer or plan sponsor to administer your health benefit plan.
- For certain Food and Drug Administration investigations, such as investigations of harmful events, product defects or for product recalls.
- For public health activities if we believe there is a serious health or safety threat.
- For health oversight activities authorized by law.
- For court proceedings and law enforcement purposes.
- To a government authority regarding abuse, neglect or domestic violence.
- To a coroner or medical examiner to identify a deceased person, determine a cause of death or as authorized by law. We may also share member information with funeral directors to carry out their duties, as necessary.
- To comply with workers' compensation laws.
- For procurement, banking or transplantation of organs, eyes or tissue.
- When permitted, to be released to government agencies for protection of the U.S. president.
We must obtain your written permission to use or disclose your PHI if one of these reasons doesn’t apply. If you give us written permission, then change your mind, you may cancel your written permission at any time. Cancelation of your permission will not apply to any information we’ve already disclosed. We may ask you to complete a form when you make a request.
Other uses and disclosures of PHI
- We may release your PHI to a friend, family member or other individual who is authorized by law to act on your behalf. For example, parents may obtain information about their children covered by HAP, even if the parent isn’t covered by HAP.
- We may use or share your PHI with an employee benefit plan through which you receive health benefits. Except for enrollment information or summary health information and as otherwise required by law, we will not share your PHI with an employer or plan sponsor unless the employer or plan sponsor has provided us with written assurances that the information will be kept confidential and won’t be used for an improper purpose. Generally, information will only be shared when it’s needed by the employer or plan sponsor to administer your health benefit plan.
- We may give a limited amount of PHI to someone who helps pay for your care. For example, if your spouse contacts us about a claim, we may tell him or her whether or not the claim has been paid.
- We may use your PHI so that we can contact you, either by phone or by mail, in order to conduct surveys, such as the annual member satisfaction survey.
- In certain extraordinary circumstances, such as a medical emergency, we may release your PHI as necessary to a friend or family member who is involved in your care if we determine that the release of information is in your best interest. For example, if you have a medical emergency in a foreign country and are unable to contact us directly, we may speak with a friend or family member who is acting on your behalf.
Organized health care arrangement
HAP and its affiliates covered by this Notice of Privacy Practices participate together with Henry Ford Health System and its listed affiliates in an organized health care arrangement. The goal is to improve the quality and efficient delivery of your health care and to participate in applicable quality measure programs, such as HEDIS.
The entities that comprise the HFHS organized health arrangement are:
- Alliance Health and Life Insurance Company
- HAP Midwest Health Plan, Inc.
- HAP Preferred, Inc.
- Henry Ford Health System
The HFHS organized health care arrangement permits these separate legal entities, including HAP and its affiliates, to share PHI with each other as necessary to carry out permissible treatment, payment or health care operations relating to the OHCA unless otherwise limited by law, rule or regulation. This list of entities may be updated to apply to new entities in the future. You can access the most current list at hap.org/privacy or call us at (800) 422-4641 to ask for a list. When required we’ll provide you with appropriate notice of such purchase or affiliation in a revised Notice of Privacy Practices.
These are your rights with respect to your member information. If you would like to exercise any of these rights, contact us as described below under "Who to Contact."
- You have the right to ask us to restrict how we use or disclose your PHI for treatment, payment or health care operations. You also have the right to ask us to restrict PHI that we’ve been asked to give to family members or to others who are involved in your health care or in payment for your health care. We aren’t required to agree to these additional restrictions, but if we do, we’ll abide by them – except as needed for emergency treatment or as required by law – unless we notify you that we are terminating our agreement.
- You have the right to ask to receive confidential communications of PHI. If you believe that you would be harmed if we send your PHI to your current mailing address (for example, in situations involving domestic disputes or violence), you can ask us to send the information by alternate means, by fax or to an alternate address. We will try to accommodate reasonable requests.
- You have the right to inspect and obtain a copy of PHI that we maintain about you. With certain exceptions, you have the right to look at or receive a copy of your PHI contained in the group of records used by or for us to make decisions about you, including our enrollment, payment, claims adjudication and case or medical management notes. If we deny your request for access, we’ll tell you the basis for our decision and whether you have a right to further review. We may require you to complete a form to obtain this information and may charge you a fee for copies. We’ll inform you in advance of any fee and provide you with an opportunity to withdraw or modify your request.
- You have the right to ask us to amend PHI we maintain about you. You have the right to request that we amend your PHI in the set of records you’re granted access to upon your request. If we deny your request to amend them, we’ll provide you with a written explanation. If you disagree, you may have a statement of your disagreement placed in our records. If we accept your request to amend the information, we’ll make reasonable efforts to inform others of the amendment, including individuals you name. We’ll require that the information you provide be accurate. We are unable to delete any part of a legal record, such as a claim submitted by your doctor.
- You have the right to receive an accounting of certain disclosures of your PHI made by us during the six years prior to your request. HAP is not required to provide you with an accounting of all disclosures we make. For example, we aren’t required to provide you with an accounting of PHI disclosed or used for treatment, payment and health care operations purposes – or information disclosed to you or pursuant to your authorization. Your first accounting in any 12-month period is free. However, if you request an additional accounting within 12 months of receiving your free accounting, we may charge you a fee. We’ll inform you in advance of the fee and provide you with an opportunity to withdraw or modify your request.
- You have the right to be informed of any data breaches that compromise your PHI. In the event of a breach of your unsecured PHI, we’ll provide you with notification of such a breach as required by law or in cases in which we deem it appropriate.
- You have a right to receive a paper copy of this notice upon request at any time.
Your request to exercise any of these member rights must be in writing and it must be signed by you or your representative. We may ask you to complete a form when making a request.
Changes to this privacy statement
We reserve the right to make periodic changes to the contents of this notice. If we do make changes, the new notice will be effective for all PHI maintained by us. Once we make our revisions, we’ll provide the new notice to you by mail and post it on our website.
Who to contact
If you have any questions about this notice or about how we use or share member information, contact the HAP and HAP Midwest Health Plan Office of Compliance by mail at:
Attention: Office of Compliance
2850 W. Grand Blvd.
Detroit, MI 48202
You may also call us at (800) 422-4641 (TTY: 711).
If you believe your privacy rights have been violated, you may file a complaint with us by contacting the Office of Compliance or by filing a grievance with our Customer Service department. You may also notify the secretary of the U.S. Department of Health and Human Services of your complaint.
We will not take any action against you for filing a complaint.
Original effective date: April 13, 2003
Revisions: February 2005, November 2007, September 2013, September 2014, March 2015, October 2015
Reviewed: November 2008, November 2009, October 2011
Internet Privacy Statement
Using the internet: the choice is yours
Using the Internet to communicate with HAP is completely voluntary. You should read this statement to understand the benefits and risks of communicating over the internet.
Information we collect when you visit our website
We automatically collect IP addresses and aggregate information on what web pages people use and the frequency and length of their visits. We use this information to evaluate and improve our website. HAP also uses "cookie" technology to obtain information from its online visitors by placing a small text file on your hard drive. The file is time sensitive and expires after several minutes to increase the security of your session and data. Data is encrypted when stored on our servers or in cookies. We do not collect any information that can be used to personally identify you unless you voluntarily register to use one of our internet services requiring an ID and password, or send an email to us.
Information from other sources - third parties
HAP may purchase consumer information from third party sources to be aggregated and used for marketing purposes for people who are not current HAP members. If you prefer not to have your information from third parties used for marketing purposes, please notify the HAP Customer department in writing. Mail your request to:
2850 W. Grand Blvd.
Detroit, MI 48202
Attention: Customer Service
Information we collect when you communicate with us over the internet
HAP is committed to protecting the privacy of the personal information you provide to us over the internet. All information is protected by our privacy policies, which we periodically review and update.
If you choose to communicate with us over the internet, we may request personally identifiable information from you necessary for us to process your request for information, respond to your questions or deliver a product or service. Personally identifiable information is any information that can be used to identify you, such as your name, address, web address or HAP ID number. When you send information to us using email or through one of our internet services requiring an ID and password, the information may be shared with our employees and contractors who need to know the information to respond to your request and as permitted by law. We keep some of this information for a period of time as determined necessary by us.
Information collected when you respond to surveys and promotions on our website will be used for internal purposes, including developing website information and services. We may inform you of new products and services from HAP based on the information you provide us.
Using email and internet services requiring an ID and password
There are a number of risks you should consider before using email to communicate with us:
- Email can be circulated, forwarded and stored in numerous paper and electronic files.
- Email can be intercepted, altered, forwarded or used without authorization or detection. Email senders can easily misaddress an email.
- Backup copies of email may exist even after the sender deletes the email.
- Employers and online services have the right to inspect email transmitted through their systems.
- Email is easier to falsify than handwritten or signed documents.
- Email can be used to introduce viruses into computer systems.
- Confidentiality of internet communications cannot be guaranteed by HAP.
- Use of the internet is solely at your own risk.
Links to other websites
We have links from our website to a number of different health care related websites. When you click on one of these links, you leave HAP's online experience and link to another website not controlled by HAP. We do not control the privacy policies or security measures of any these health care related sites. You should read the privacy statements on the other sites you visit to understand their privacy practices.
HAP has taken steps to make all information received from our online visitors as secure as possible against unauthorized access and use. All information is protected by our security measures, which we periodically review and update.
We use security technology to protect you during your Internet communications with us. This security includes server authentication, privacy using encryption and data integrity. Your personal information is protected from unauthorized access by a secure firewall and security infrastructure. During transmission of information using one of our internet services requiring an ID and password, your privacy is protected by encryption software. We employ extensive physical, electronic and procedural safeguards to maintain the security of your information. HAP also conducts periodic reviews of its web security to ensure that our electronic security safeguards remain up-to-date and effective.
Safeguarding your ID number
You must take all reasonable precautions to safeguard your ID number. This ID allows the user to access confidential information. Such access is provided solely to facilitate the performance of legitimate business functions. Please ensure that you share your ID only with those individuals who require such access to perform legitimate business functions on your behalf. You remain responsible for any use, or misuse, of your ID by you or your employees or agents.
Here's what you can do to protect your internet communications
There are things you can do to improve the privacy and security of your internet communications. Here are a few of them:
- When you register to use an internet service requiring an ID and password, communications between us will be protected by encryption software.
- Do not submit sensitive or confidential information over email links on this website. Instead, use one of our internet services requiring an ID and password, or contact us by telephone or mail.
- Do not communicate sensitive or confidential information to us over the Internet from work. Your employer has the right to inspect your email, co-workers may see the information on a computer screen and you can inadvertently forward the email to co-workers or others.
- After you submit information online, end your browser session before leaving your computer. This helps preserve the confidentiality of your data by ensuring that you are not leaving personally identifiable information on the computer for those who use the computer after you. This is especially important if you are using a computer in a public area.
- If you communicate with us over the Internet, tell us when your email address changes.
Members can opt out
If you prefer not to have your information available in a HAP member online account, please notify the HAP Customer Service department in writing. Mail your request to:
2850 W. Grand Blvd.
Detroit, MI 48202
Attention: Customer Service
Once this request is processed, the system will not allow you or anyone to register online and use HAP’s online member services. If you decide you want to remove this restriction after opting out, notify the Customer Service department in writing at the above address. You should also contact Customer Service if you receive email from us that you do not wish to receive in the future.
Changes to this statement
We periodically review and update our privacy policies and security measures. When we do so we may need to change or update this statement and reserve the right to do so. All updates and changes automatically apply to you without notice.
If you do not believe that the policies in this Internet Privacy Statement give you the internet privacy and security protection you need, you have the ability and right to stop interacting with HAP over the internet by exiting this website now.