Introduction
US Family Health Plan¹ strongly believes in safeguarding the privacy of our members’ protected health information ("PHI"). PHI is information which:

• identifies you (or can reasonably be used to identify you); and
• relates to your physical or mental health or condition, the provision of health care to you or the payment for that care.

We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. This Notice of Privacy Practices describes how we may collect, use and disclose your PHI, and your rights concerning your PHI. This Notice applies to all members of US Family Health Plan.

How We Obtain PHI
As a managed care plan, we engage in routine activities that result in our being given PHI from sources other than you. For example, health care providers - such as physicians and hospitals - submit claim forms containing PHI to enable us to pay them for the covered health care services they have provided to you.

How We Use and Disclose Your PHI
We use and disclose PHI in a number of ways to carry out our responsibilities as a managed care plan. The following describes the types of uses and disclosures of PHI that federal law permits us to make without your specific authorization:

• Treatment: We may use and disclose your PHI to health care providers to help them treat you. For example, our care managers may disclose PHI to a home health care agency to make sure you get the services you need after discharge from a hospital.

• Payment Purposes: We use and disclose your PHI for payment purposes, such as paying doctors and hospitals for covered services. Payment purposes also include activities such as: determining eligibility for benefits; reviewing services for medical necessity; performing utilization review; obtaining premiums; coordinating benefits; subrogation; and collection activities.

• Health Care Operations: We use and disclose your PHI for health care operations. This includes: coordinating/managing care; assessing and improving the quality of health care services; reviewing the qualifications and performance of providers; reviewing health plan performance; conducting medical reviews; and resolving grievances. It also includes business activities such as: underwriting; rating; placing or replacing coverage; determining coverage policies; business planning; obtaining reinsurance; arranging for legal and auditing services (including fraud and abuse detection programs); and obtaining accreditations and licenses.

• Health and Wellness Information: We may use your PHI to contact you with information about: appointment reminders; treatment alternatives; therapies; health care providers; settings of care; or other health-related benefits, services and products that may be of interest to you. For example, we might send you information about smoking cessation programs.

• Organizations That Assist Us: In connection with treatment, payment, and health care operations, we may share your PHI with our affiliates and third party "business associates" that perform activities for us or on our behalf, for example our pharmacy benefit manager. We will obtain assurances from our business associates that they will appropriately safeguard your information.

• Plan Sponsors: As a TRICARE Designated Provider, US Family Health Plan is sponsored by the Department of Defense (DoD). We may disclose PHI to DoD for plan administration purposes. DoD certifies that it will protect the PHI in accordance with law.

• Public Health and Safety; Health Oversight: We may disclose your PHI: to a public health authority for public health activities, such as responding to public health investigations; when authorized by law, to appropriate authorities if we reasonably believe you are a victim of abuse, neglect or domestic violence; when we believe in good faith that it is necessary to prevent or lessen a serious and imminent threat to your or others’ health or safety; or to health oversight agencies for certain activities such as: audits; disciplinary actions; and licensure activity.
• Legal Process; Law Enforcement; Specialized Government Activities: We may disclose your PHI: in the course of legal proceedings; in certain cases, in response to a subpoena, discovery request or other lawful process; to law enforcement officials for such purposes as responding to a warrant or subpoena; or for specialized governmental activities such as national security.

• Research; Death; Organ Donation: We may disclose your PHI to researchers, provided that certain established measures are taken to protect your privacy. We may disclose PHI, in certain instances, to coroners, medical examiners and in connection with organ donation.

• Workers’ Compensation: We may disclose your PHI when authorized by workers’ compensation laws.

• Family and Friends: We may disclose PHI to a family member, relative or friend -- or anyone else you identify -- as follows: (i) when you are present prior to the use or disclosure and you agree; or (ii) when you are not present (or you are incapacitated or in an emergency situation) if, in the exercise of our professional judgment and in our experience with common practice, we determine that the disclosure is in your best interests. In these cases we will only disclose the PHI that is directly relevant to the person’s involvement in your health care or payment related to your health care.

• Personal Representatives: Unless prohibited by law, we may disclose your PHI to your personal representative, if any. A personal representative has legal authority to act on your behalf in making decisions related to your health care. For example, a health care proxy, or a parent or guardian of an unemancipated minor are personal representatives.

• Mailings: We will mail information containing PHI to the address we have on record for the subscriber of your health benefits plan. We will not make separate mailings for enrolled dependents at different addresses, unless we are requested to do so and agree to the request. See below "Right to Receive Confidential Communication" for more information on how to make such a request.

• Required by Law: We may use or disclose your PHI when we are required to do so by law. For example, we must disclose your PHI to the U.S. Department of Health and Human Services upon request if they wish to determine whether we are in compliance with federal privacy laws.

If one of the above reasons does not apply, we will not use or disclose your PHI without your written permission ("authorization"). You may give us written authorization to use or disclose your PHI to anyone for any purpose. You may later change your mind and revoke your authorization in writing. However, your written revocation will not affect actions we’ve already taken in reliance on your authorization.

Where state or other federal laws offer you greater privacy protections, we will follow those more stringent requirements. For example, under certain circumstances, records that contain information about: alcohol abuse treatment; drug abuse prevention or treatment; AIDS-related testing or treatment; or certain privileged communications, may not be disclosed without your written authorization. In addition, when applicable we must have your written authorization before using or disclosing medical or treatment information for a member appeal. See below "Who to Contact for Questions or Complaints" if you would like more information.

How We Protect PHI Within Our Organization. US Family Health Plan protects oral, written and electronic PHI throughout our organization. We do not sell PHI to anyone. We have many internal policies and procedures designed to control and protect the internal security of your PHI. These policies and procedures address, for example, use of PHI by our employees. In addition, we train all employees about these policies and procedures. Our policies and procedures are evaluated and updated for compliance with applicable laws.

Your Individual Rights. The following is a summary of your rights with respect to your PHI:

• Right of Access to PHI:You have the right to inspect and get a copy of most PHI US Family Health Plan has about you. Under certain circumstances, we may deny your request. If we do so, we will send you a written notice of denial describing the basis of our denial. We may charge a reasonable fee for the cost of producing and mailing the copies. Requests must be made in writing and reasonably describe the information you would like to inspect or copy.

• Right to Request Restrictions: You have the right to ask that we restrict uses or disclosures of your PHI to carry out treatment, payment and health care operations; and disclosures to family members or friends. We will consider the request. However, we are not required to agree to it and, in certain cases, federal law does not permit a restriction. Requests may be made verbally or in writing to US Family Health Plan.

• Right to Receive Confidential Communications: You have the right to ask us to send communications of your PHI to you at an address of your choice or that we communicate with you in a certain way. For example, you may ask us to mail your information to an address other than the subscriber’s address. We will accommodate your request if: you state that disclosure of your PHI through our usual means could endanger you; your request is reasonable; it specifies the alternative means or location; and it contains information as to how payment, if any, will be handled. Requests may be made verbally or in writing to US Family Health Plan.

• Right to Amend PHI: You have the right to have us amend most PHI we have about you. We may deny your request under certain circumstances. If we deny your request, we will send you a written notice of denial. This notice will describe the reason for our denial and your right to submit a written statement disagreeing with the denial. Requests must be in writing to US Family Health Plan and must include a reason to support the requested amendment.

• Right to Receive an Accounting of Disclosures: You have the right to a written accounting of the disclosures of your PHI that we made in the last six years prior to the date you request the accounting. However, except as otherwise provided by law, this right does not apply to: (i) disclosures we made for treatment, payment or health care operations; (ii) disclosures made to you or people you have designated; (iii) disclosures you or your personal representative have authorized; (iv) disclosures made before April 14, 2003; and (v) certain other disclosures, such as disclosures for national security purposes. If you request an accounting more than once in a 12-month period, we may charge you a reasonable fee. All requests for an accounting of disclosures must be made in writing to US Family Health Plan.

• Right to this Notice: You have a right to receive a paper copy of this Notice from us upon request.

• How to Exercise Your Rights: To exercise any of the individual rights described above or for more information, please call a member services coordinator at 1-800-818-8589 (TDD: 1-800-815-8580) or write to:

US Family Health Plan
77 Warren Street
Boston, MA 02135
Attn: Privacy Rights

Effective Date of Notice: This Notice takes effect April 14, 2003. We must follow the privacy practices described in this Notice while it is in effect. This Notice will remain in effect until we change it. This Notice replaces any other information you have previously received from us with respect to privacy of your medical information.

Changes to this Notice of Privacy Practices. We may change the terms of this Notice at any time in the future and make the new Notice effective for all PHI that we maintain — whether created or received before or after the effective date of the new Notice. Whenever we make an important change, we will send subscribers an updated Notice of Privacy Practices. In addition, we will publish the updated Notice on our website at www.usfamilyhealthplan.org.

Whom To Contact For Questions or Complaints. If you would like more information or an additional paper copy of this Notice, please contact a member services representative at the number listed above. You can also download a copy from our website at www.usfamilyhealthplan.org. If you believe your privacy rights may have been violated, you have a right to complain to US Family Health Plan by calling the Privacy Officer at 1-800-818-8589 or writing to:

US Family Health Plan
77 Warren Street
Boston, MA 02135
Attn: Privacy Officer

You also have a right to complain to the Secretary of Health and Human Services. We will not retaliate against you for filing a complaint.