Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective April 6, 2023
California Schools Voluntary Employees Benefits Association

NOTICE OF PRIVACY PRACTICES

General Information About This Notice

The California Schools Voluntary Employees Benefits Association (the “Plan”) is committed to maintaining the confidentiality of your private medical information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or  disclosure and your privacy rights. This Notice only applies to health-related information created or received by or on behalf of the
Plan. We are providing this Notice to you because privacy regulations issued under federal law, the Health Insurance Portability and Accountability Act of 1996, 45 CFR Parts 160 and 164 (“HIPAA”),
require us to provide you with a summary of the Plan’s privacy practices and related legal duties, and your rights in connection with the use and disclosure of your Plan information. We must follow the
privacy practices that are described in this Notice while it is in effect.

In this Notice, the terms “Plan,” “we,” “us,” and “our” refer to the Plan and third parties to the extent they perform administrative services for the Plan. When third party service providers perform administrative functions for the Plan, we require them to appropriately safeguard the privacy of your information.

Please note:
If you are enrolled in a HMO you will also receive a separate notice from that HMO provider that describes that HMO provider’s specific use and disclosure of your health information. Your rights with respect to their use and disclosure of your health information are set forth in that separate notice.

Our Legal Duties

Federal law requires the Plan to have a special policy for safeguarding a category of medical information called “protected health information,” or “PHI,” received or created in the course of administering the Plan. PHI is health information that can be used to identify you and that relates to:

• your physical or mental health condition,
• the provision of health care to you, or
• payment for your health care.

Your medical and dental records, your claims for medical and dental benefits, and the explanation of benefits (“EOB’s”) sent in connection with payment of your claims are all examples of PHI.
The remainder of this Notice generally describes our rules with respect to your PHI received or created by the Plan.

Uses and Disclosures of Your PHI

To protect the privacy of your PHI, the Plan not only guards the physical security of your PHI, but we also limit the way your PHI is used or disclosed to others. We may use or disclose your PHI in certain
permissible ways described below. To the extent required under federal health information privacy law, we use the minimum amount of your PHI necessary to perform these tasks.

• To determine proper payment of your Health Plan benefit claims. The Plan uses and discloses your PHI to reimburse you or your doctors or health care providers for covered treatments and services. For example, your diagnosis information may be used to determine whether a specific procedure is medically necessary or to reimburse your doctor for your medical care.
• For the administration and operation of the Plan. We may use and disclose your PHI for numerous administrative and quality control functions necessary for the Plan’s proper operation. For example, we may use your claims information for fraud and abuse detection activities or to conduct data analyses for cost-control or planning-related purposes.
• To inform you or your health care provider about treatment alternatives or other health related benefits that may be offered under the Plan. For example, we may use your claims data to alert you to an available case management program if you are diagnosed with certain diseases or illnesses, such as diabetes.
• To a health care provider if needed for your treatment.
• To a health care provider or to another health plan to determine proper payment of your claim under the other plan. For example, we may exchange your PHI with your spouse’s health plan for coordination of benefits purposes.
• To another health plan for certain administration and operations purposes. We may share your PHI with another health plan or health care provider who has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide care to you, or for fraud and abuse detection and prevention purposes.
• To a family member, friend, or other person involved in your health care if you are present and you do not object to the sharing of your PHI, or it can reasonably be inferred that you do not object, or in the event of an emergency.
• For Plan design activities or to collect Plan contributions. The Plan may use summary or de-identified health information for Plan design activities such as underwriting. If we do use de-identified information for obtaining healthcare services bids or Plan design, we will not use any of your genetic information. In addition, the Plan may use information about your enrollment or disenrollment in a Plan in order to collect contributions that pay for your Plan participation.
• To the Plan Sponsor. The Plan may disclose PHI to the Plan sponsor, the Board of Directors, to the extent provided by a rule of the Plan, provided that the sponsor protects the privacy of the PHI and it is only used for the permitted purposes described in this Notice.
• To Business Associates. The Plan may disclose PHI to other people or businesses that provide services to the Plan and which need the PHI to perform those services. These people or businesses are called business associates, and the Plan will have a written agreement with each of them requiring each of them to protect the privacy of your PHI. For example, the Plan may have hired a consultant to evaluate claims or suggest changes to the Plan, for which he needs to see PHI.
• To comply with an applicable federal, state, or local law, including workers’ compensation or similar programs.
• For public health reasons, including (1) to a public health authority for the prevention or control of disease, injury or disability; (2) to a proper government or health authority to report child abuse or neglect; (3) to report reactions to medications or problems with products regulated by the Food and Drug Administration; (4) to notify individuals of recalls of medication or products they may be using; or (5) to notify a person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition. report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.
• To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services.
• To the U.S. Department of Health and Human Services to demonstrate our compliance with federal health information privacy law.
• To respond to an order of a court or administrative tribunal.
• To respond to a subpoena, warrant, summons or other legal request if sufficient safeguards, such as a protective order, are in place to maintain your PHI privacy.
• To a law enforcement official for a law enforcement purpose.
• For purposes of public safety or national security.
• To allow a coroner or medical examiner to make an identification or determine cause of death or to allow a funeral director to carry out his or her duties.
• To respond to a request by military command authorities if you are or were a member of the armed forces.
• For cadaveric organ, eye or tissue donation. The Plan may use and disclose protectedhealth information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.
• For research. The Plan may use and disclose protected health information to assist in research activities, regardless of the source of the funding for the research, where a privacy board or an Institutional Review Board has approved an alteration to or waived entirely the authorization requirements of the law and the Plan receives certain specific representations and documentation.
• To avert serious threat to health or safety. The Plan may use and disclose protected health information to prevent or lessen a serious threat to health or safety of any one person or the general public and the use or disclosure is (1) to a person or persons reasonably able to prevent or lessen the threat to health or safety or (2) necessary for law enforcement authorities to identify or apprehend an individual.
• Incident to a permitted use or disclosure. The Plan may use and disclose protected healthinformation incident to any use or disclosure permitted or authorized by law.
• As part of a limited data set. The Plan may use and disclose a limited data set that meets the technical requirements of 45 Code of Federal Regulations, Section 164.514(e), if the Plan has entered into a data use agreement with the recipient of the limited data set.
• For fundraising. The Plan may use and disclose certain types of protected health informationto a business or to an institutionally related foundation for the purpose of raising funds. The types of information that may be disclosed under this exception to the authorization requirement are: (1) demographic information relating to an individual and (2) dates of health care provided to an individual. The fundraising materials must inform you of how you may elect to opt out of receiving further fundraising communications that are healthcare operations. The entity that sends you such communications must treat your request to opt out as a revocation of your authorization to receive any such communications. Sharing excludes text messaging originator opt-in data and consent; this information will not be shared with any third party. 

Absent your written permission, the Plan will only use or disclose your PHI as described in this Notice. The Plan will not access your PHI for reasons unrelated to Plan administration without your express written authorization.

If an applicable state law provides greater health information privacy protections than the federal law, we will comply with the stricter state law.

Other Uses and Disclosures of Your PHI

Before we use or disclose your PHI for any purpose other than those listed above, we must obtain yourwritten authorization. You may revoke your authorization, in writing, at any time. If you revoke your
authorization, the Plan will no longer use or disclose your PHI except as described above (or as permitted by any other authorizations that have not been revoked). However, please understand that we cannot retrieve any PHI disclosed to a third party in reliance on your prior authorization.

Your Rights

Federal law provides you with certain rights regarding your PHI. Parents of minor children and other individuals with legal authority to make health decisions for a Plan participant may exercise these rights on behalf of the participant, consistent with state law.

Right to request restrictions: You have the right to request a restriction or limitation on the Plan’s use or disclosure of your PHI. For example, you may ask us to limit the scope of your PHI disclosures to a case manager who is assigned to you for monitoring a chronic condition. Because we use your PHI to the extent necessary to pay Plan benefits, to administer the Plan, and to comply with the law, it may not be possible to agree to your request. Except in the limited circumstances described below, the law does not require the Plan to agree to your request for restriction. Except as otherwise required by law (and excluding disclosures for treatment purposes), the Plan is obligated, upon your request, to refrain from sharing your PHI with another health plan for purposes of payment or carrying out healthcare operations if the PHI pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. The Plan will not agree to any restriction, which will cause it to violate or be noncompliant with any legal requirement. If we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction with respect to PHI created or received by the Plan in the future.

You may make a request for restriction on the use and disclosure of your PHI by completing the appropriate request form available from the Plan.

Right to receive confidential communications: You have the right to request that the Plan communicate with you about your PHI at an alternative address or by alternative means if you believe that communication through normal business practices could endanger you. For example, you may request that the Plan contact you only at work and not at home.

You may request confidential communication of your PHI by completing an appropriate form available from the Plan. We will accommodate all reasonable requests if you clearly state that you are requesting the confidential communication because you feel that disclosure in another way could endanger your safety.

Right to inspect and obtain a copy of your PHI: You have the right to inspect and obtain a copy of your PHI that is contained in records that the Plan maintains for enrollment, payment, claims determination, or case or medical management activities. If the Plan uses or maintains an electronic health record with respect to your PHI, you may request such PHI in an electronic format of your choosing – provided we can practicably provide it in that format –, and direct that such PHI be sent to another person or entity.

However, this right does not extend to (1) psychotherapy notes, (2) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, and (3) any information, including PHI, as to which the law does not permit access. We will also deny your request to inspect and obtain a copy of your PHI if a licensed health care professional hired by the Plan has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.

If you request copies of your health information, we will process the request within 30 days or provide an explanation for why that timeframe is too narrow and a date when the request can be processed.
In the event that your request to inspect or obtain a copy of your PHI is denied, you may have that decision reviewed. A different licensed health care professional chosen by the Plan will review the
request and denial, and we will comply with the health care professional’s decision.

You may make a request to inspect or obtain a copy of your PHI by completing the appropriate form available from the Plan. We may charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.

Right to amend your PHI: You have the right to request an amendment of your PHI if you believe the information the Plan has about you is incorrect or incomplete. You have this right as long as your PHI is maintained by the Plan in a designated record set. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment. However, we cannot amend PHI that we believe to be accurate and complete. You may request amendments of your PHI by completing the appropriate form available from the Plan.

Right to receive an accounting of disclosures of PHI: You have the right to request a list of certain disclosures of your PHI by the Plan. The accounting will not include disclosures (1) to carry out treatment, payment and health care operations, (2) to you, (3) incident to a use or disclosure permitted or required by law, (4) pursuant to an authorization provided by you, (5) for directories or to people involved in your care or other notification purposes as permitted by law, (6) for national security or intelligence purposes, (7) to correctional institutions or law enforcement officials, (8) that are part of a limited data set, (9) that occurred more than six years before your request. Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you in advance of any costs, and you may choose to withdraw or modify your request before you incur any expenses.

You may make a request for an accounting by completing the appropriate request form available from the Plan.

Right to Receive Notice of Breach of Unsecured PHI: If the security of your unprotected PHI is breached, we will notify you about it.

Right to file a complaint: If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Plan’s privacy policy or of this Notice.

You may file a formal complaint with our Privacy Officer and/or with the United States Department of Health and Human Services at the addresses below. You should attach any evidence or documents that support your belief that your privacy rights have been violated. We take your complaints very seriously. The Plan prohibits retaliation against any person for filing such a complaint.

Complaints should be sent to:

California Schools Voluntary Employees Benefits Association 1843 Hotel Circle South San Diego, CA 92108 Phone: (619) 278-0021 Fax: (619) 278-0024

Region IX, Office for Civil Rights U.S. Department of Health and Human Services 90 7th Street, Suite 4-100 San Francisco, CA 94103 Phone: (415) 437-8310 FAX: (415) 437-8329 TDD: (415) 437-8311 http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html

Additional Information About This Notice

Changes to this Notice: We reserve the right to change the Plan’s privacy practices as described in this Notice. Any change may affect the use and disclosure of your PHI already maintained by the Plan,
as well as any of your PHI that the Plan may receive or create in the future. If there is a material change to the terms of this Notice, you will receive a revised Notice.

How to obtain a copy of this Notice: You can obtain a paper or electronic copy of the current Notice by contacting the Privacy Officer at the address listed on the front of this Notice.

No change to Plan benefits: This Notice explains your privacy rights as a current or former participant in the Plan. The Plan is bound by the terms of this Notice as they relate to the privacy of your protected health information. However, this Notice does not change any other rights or obligations you may have under the Plan. You should refer to the Plan documents for additional information regarding your Plan benefits.