Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Why am I getting this notice?

The Uniform Medical Plan (UMP) is required by law to send this notice to all subscribers, both when the laws went into effect, and whenever there is a change to UMP's policy.

What does "disclose" mean?

In this case, "disclose" means to share or give information to a person or entity (for example, a company that UMP does business with).

Where does UMP get this information about me?

UMP collects personal information about you in a number of ways. For example, we might get information from your provider, such as when he or she applies for payment. Or we might get it from you, such as when you join the UMP, send in a claim, call Customer Service, or send a complaint or appeal. This information may be related to your medical care or health, or other information about you. You should understand that UMP usually has very little personal information about you—mostly, we just have the information you or your providers send us so we can pay claims. Most health information is held by your providers.

What does UMP do with my information?

We are required by law to keep your information confidential. Other than as explained in this notice, we do not disclose it to anyone outside UMP, our administrators, and your providers. When we do disclose information, we usually provide only the minimum information necessary. UMP employees and contractors who violate the confidentiality standards can be punished and even dismissed.

In what situations can UMP disclose my information?

We may use and disclose your personal information in the following situations:

Treatment

This includes care provided to you and the coordination or management of your care. For example, we might disclose information to alert your health care provider to possible problems in your care.

Payment

This includes our meeting our obligations to cover or provide benefits for your care, and our collecting premiums and other amounts due. For example, when we pay a provider, we usually specify the treatment for which we are paying, or, if a provider wants to discuss the amount we paid, we may need to use and disclose your information. Another example would be our exchanging information with another plan that covers you, or might cover you, to determine the obligations of the two plans, or with some person or company that may be responsible for paying your medical expenses. We might also give information to someone who might be responsible to pay for services relating to your condition.

Health care operations

This refers to what UMP does to keep the plan operating, including quality control, medical and legal reviews, working with auditors and examiners, compliance reviews, and creating de-identified information that removes information that makes clear the identity of an individual UMP member. For example, we disclose information to contracted business associates that handle claims processing and customer service, such as our plan administrator, our pharmacy benefit manager, and contractors working on subrogation. These business associates also must protect your privacy. Auditors, examiners, and consultants of UMP and of some of our contractors may see some personal information.

Health benefits and services

For example, we may use or disclose your personal information to:

• Contact you about treatment alternatives or health-related benefits or services.
• Vendors hired to assist in contacting you.
• Contractors we hire to provide services. Those might be services like disease management, case management, health risk assessment, evaluating our programs, and evaluating your use of prescription drugs and conferring with you or your providers about these programs or other services.
• An IRO (Independent Review Organization) that reviews your appeal at your request.

Other situations where UMP might disclose your information

We might disclose your information:

• When we believe we are required by law to do so. That includes, for example, cases where we receive a subpoena or summons.
• To public health agencies as provided by state and federal laws to:
  1. Prevent or control disease;
  2. Report births or deaths;
  3. Report child abuse or neglect to authorized agencies;
  4. Report problems with medicines or products to the Food and Drug Administration (FDA);
  5. Notify you if a product you are using is recalled; or
  6. Give notice of exposure to a disease or condition that is a health risk.

  Examples of these public health agencies include the Department of Health and the Department of Social and Health Services.

• Within the Health Care Authority and with other agencies, and to our auditors for oversight activities authorized by law. Examples of these oversight activities include audits, examinations, inspections, investigations, and health professions licensing.
• When required to do so in the course of lawsuits or administrative hearings.
• To law enforcement officials.
• After your death to a coroner, funeral director, or organ transplant organization.
• In connection with certain research projects where your privacy is protected.
• If we think disclosure is necessary to avert a serious and imminent threat to your health or safety or someone else's, or to permit law enforcement authorities to identify or apprehend an individual.
• If we think you might be a victim of abuse, neglect, or domestic violence.
• In some situations, we may disclose personal information of Armed Forces personnel to military authorities.
• To an authorized federal official or other authorized persons for purposes of national security, for providing protection to the President or others, or to conduct special investigations, as authorized by law.
• To other government agencies that are providing you with benefits or services when the information is necessary for you to receive those benefits or services.
• To entities for accreditation, certification, or review of UMP.
• To the UMP subscriber, information relating to family members enrolled on his or her account, to explain payments, benefits, deductibles, and other matters relating to payment.
• If you are under 18 years old, we might disclose your personal information to your parent or guardian or someone else with a similar role. (Sometimes, different age limits apply to different sorts of information.)
• If you cannot authorize disclosure, such as in some medical emergencies, we may disclose to a family member or friend. We will do that only if we think it is in your best interest.

If disclosure to you or another person might be harmful to you or someone else, we may limit the information provided.

Are there specially protected types of information?

Yes, some types of information have greater protection under Washington State or federal laws. The above disclosure practices don't necessarily apply to these types of information, which include confidential HIV-related information that is protected by Washington State laws; alcohol and substance abuse treatment information that is protected under both Washington State and federal laws; and mental health treatment information that is protected under both Washington State and federal laws.

When might I need to approve a disclosure?

Any use or disclosure of your information other than the uses listed above would be made only with your authorization (approval). For example, disclosure of information regarding behavioral health services, such as psychotherapy notes, requires your approval. If you do authorize a use or disclosure, you can revoke (take back) that authorization later. Your revocation does not affect any use or disclosure already made before your revocation was received by UMP.

What are my rights?

Request restrictions (limit disclosures). You may ask us to restrict our use and disclosure of your personal information for treatment, payment, and health care operations, and to restrict disclosures to persons you identified. We will consider your request but in most cases we are not required to agree to it. If we do agree, we will abide by our agreement except in an emergency.

Inspect and copy. You may review the personal information we have about you by asking for a copy of it. We may charge a fee for copies. The information you may review and copy does not include psychotherapy notes; information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administration action or proceeding; information that we cannot legally disclose to you; information received from someone other than a health care provider under a promise of confidentiality if the access requested would be reasonably likely to reveal the source of the information; or information that a licensed health care professional we determine should not be disclosed to you because it might harm you or someone else.

Amend (add to or correct). You may ask us to amend your personal information, if you believe it is incorrect or incomplete. You must make the request in writing, telling us what information you want changed and why it should be changed. We are not necessarily required to make the changes you request. For example, we are not required to change information we did not create or information that is correct. If we do not make the change you request, we will tell you why. If we do make the changes, we will make a reasonable effort to inform others to whom we gave the information or who you tell us received the information.

Accounting of disclosures (who did we tell, what did we tell them). You may ask for an accounting of disclosures we make of your personal information. This does not include disclosures for treatment, payment, and health care operations, disclosures to you or with your authorization, disclosures made more than six years before your request, and certain other disclosures. We will respond to you within 60 days of your request for such an accounting. If you ask for more than one accounting in any 12-month period, we may charge you a reasonable fee.

Notice of breach. If there is a breach of the confidentiality of your information, we will inform you. This does not apply in cases where there is no significant risk of harm to you.

Sending by alternative means or to an alternative location. You may ask UMP to send personal information to you by alternative means or to an alternative location. We will accommodate any reasonable request if you clearly state that disclosure of all or part of the information to your location on file could endanger you. If the request does not state that, we will consider the request but may or may not accommodate it.

Get a paper copy of this notice.You may request a paper copy of this notice by calling Customer Service at 1-888-849-3681.

What is UMP required to do?

UMP is required to maintain the privacy of your information and give you this notice. We may change our practices at any time, but must send you a revised notice. Such changes could apply to information gathered before, as well as after, the changes became effective. At any given time, we will comply with the notice that is in effect then. We will mail you a new Notice whenever it is revised. This Notice is always available on the UMP Web site at www.ump.hca.wa.gov.

Where should I send questions?

For more information, call our privacy officer at 206-521-2000, or send a secure e-mail through www.myRegence.com.

Where should I send complaints?

If you believe your privacy rights have been violated, you may submit a complaint to the UMP privacy officer by calling 206 521 2000, writing to P.O. Box 21847, Seattle, WA 98111 3847, or sending a secure e-mail as described above. If you prefer, you may complain to the Secretary of the United States Department of Health and Human Services. You will not be retaliated against for filing a complaint.

When is this notice effective?

This notice takes effect on January 1, 2012, and remains in effect until we change it.