Purpose of This Privacy Notice

This Privacy Notice describes how medical information about you may be used and disclosed and how you may obtain access to this information. Please review this information carefully.

Background

The City of Scottsdale Group Health Plan (“Plan”) is a self-insured group health plan, which includes the Cigna OAP In-Network, Cigna OAP and Cigna OAP + HSA medical plans, the Cigna DPPO and Cigna DHMO dental plans and the Flexible Spending Account administration, as sponsored by the City of Scottsdale. The Plan is required by law to take reasonable steps to maintain the privacy of your personally identifiable health information (called Protected Health Information or PHI) and to inform you about:

1. Privacy Official And Contact Office
2. Protected Health Information
3. The Plan's Uses And Disclosures Of Protected Health Information
4. Your Individual Privacy Rights
5. The Plan's Duties With Respect To Your Protected Health Information
6. Your Right To File A Complaint

PHI use and disclosure by the Plan is regulated by the federal law, Health Insurance Portability and Accountability Act, commonly called HIPAA. You may find these rules in 45 Code of Federal Regulations Parts 160 and 164. The regulations will supersede this Privacy Notice (“Notice”) if there is any discrepancy between the information in this Notice and the regulations. The Plan will abide by the terms of the Notice currently in effect. The Plan reserves the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI it maintains.

You may receive a Notice from other fully insured group health benefit plans offered by the City of Scottsdale. Each of those notices will describe your rights as it pertains to that plan. This Privacy Notice pertains to the City of Scottsdale's Plan.

Effective Date

The effective date of this Notice is September 23, 2013.

1. Privacy Official And Contact Office

The City Manager has designated a Privacy Official to oversee the administration of privacy by the Plan and to receive complaints. If you have any questions regarding this Notice or the subjects addressed in it, you may contact the Plan's Privacy Official at:

Privacy Official

Human Resources (Contact Office)
9191 E. San Salvador Drive
Scottsdale, AZ 85258
480-312-7600
480-312-7960 (Fax)

2. Protected Health Information

The term “Protected Health Information” (PHI) includes all information related to your past, present or future health condition(s) that individually identifies you or could reasonably be used to identify you and is transferred to another entity or maintained by the Plan in oral, written, electronic or any other form. PHI does not include health information contained in employment records, such as FMLA, Workers' Compensation, or Department of Transportation exams, held by the City of Scottsdale in its role as an employer.

The City of Scottsdale contracts with Business Associates to process claims (e.g., review claims submitted by health care providers for services provided to employees, pay health care providers directly, discuss health care procedures and associated fees, etc.) and perform various other administrative functions to support the Plan. As a result of these contracts with Business Associates, designated employees acting on behalf of the Plan see little, if any, of your PHI.

3. The Plan's Uses and Disclosures of Protected Health Information

1. When the Plan May Disclose Your PHI

   The City of Scottsdale has amended its Plan Documents to protect your PHI as required by federal law. Under the law, the Plan may disclose your PHI without your written authorization in the following cases:

1. At your request. If you request it, the Plan is required to give you access to your PHI in order to inspect it and copy it.
2. As required by the Secretary of the Department of Health and Human Services. The Secretary of the Department of Health and Human Services may require the disclosure of your PHI to investigate or determine the Plan's compliance with the privacy regulations.
3. For treatment, payment or health care operations. The Plan and its Business Associates will use your PHI without your consent, authorization or opportunity to agree or object in order to carry out treatment, payment, or health care operations. For example, the Plan may disclose your eligibility, coverage and cost sharing amounts. The Plan may disclose your PHI to the plan sponsor for purposes of plan administrative functions in accordance with the plan amendment.

2. When the Disclosure of Your PHI Requires Your Written Authorization

   1. In general - The Plan will require that you sign a valid authorization form in order to use or disclose your PHI other than as noted in 3. A. above or as required by law or any other required disclosure under the Privacy Rule or under C, D, E, or F noted below.
   2. Revocation - You may revoke written authorization at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

3. Use or Disclosure of Your PHI Where You Will Be Given an Opportunity to Agree or Disagree Before the Use or Release

   1. Disclosure of your limited PHI to family members and your personal representative is allowed if the information is directly relevant to the family or personal representative's involvement with your care or payment for that care.
   2. Unless you notify us otherwise in writing, we may discuss a family member's eligibility status and claim payment and status with the participant, who is also the employee, or any other family member, unless the family member about whom the PHI relates has specifically requested confidential communication or requested that we restrict the use and/or disclosure of their PHI. If you know that a family member other than yourself will be the primary person addressing your benefits, beyond eligibility and claim status as previously noted, you will need to fill out an Authorization form (attached) and send it to the Privacy Official at the address listed on the first page of this Notice.

4. Use or Disclosure of Your PHI Where Authorization or Opportunity to Object Is Not Required

   1. In general. The Plan does not need your written authorization to release your PHI if required for public health and safety purposes, as required by law, for health oversight activities, for law enforcement purposes, or for specialized government functions, including the extent necessary to comply with workers' compensation or other similar programs established by law.
   2. To Plan Sponsor. For the purpose of administering the Plan, we may disclose your PHI to certain employees of the Plan Sponsor. However, those employees will only use or disclose that information as necessary to perform plan administration functions or as otherwise required by HIPAA, unless you have authorized further disclosures. Your PHI cannot be used for employment purposes without your specific authorization.

5. Use or Disclosure To Your Personal Representative

   The Plan will disclose your PHI to individuals authorized by you, or to an individual designated as your personal representative, attorney-in-fact, etc., so long as you provide us with a written notice/authorization and any supporting documents (e.g. power of attorney, health are power of attorney or court order).

   1. Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief that:
   1. You have been, or may be, subjected to domestic violence, abuse or neglect by such person;
   2. Treating such person as your personal representative could endanger you; or
   3. In the exercise of professional judgment, it is not in your best interest to treat the person as your personal representative.
   2. The Plan will consider a parent, guardian, or other person acting in loco parentis as the personal representative of an unemancipated minor (a child generally under age 18) unless the applicable law requires otherwise.
   1. In loco parentis may be further defined by state law, but in general it refers to a person who has been treated as a parent by the child and who has formed a meaningful parental relationship with the child for a substantial period of time.
   2. Spouses and unemancipated minors may, however, request that the Plan restrict PHI that goes to family members as described below under the section titled “Your Individual Privacy Rights”.

6. De-identified information

   1. This Notice does not apply to information that has been de-identified.
   2. De-identified information is information that does not identify you and there is no reasonable basis to believe that the information can be used to identify you.

4. Your Individual Privacy Rights

1. You Have the Right to Request Restrictions on PHI Uses and Disclosures

   1. You may request the Plan to restrict the uses and disclosures of your PHI:
   1. To carry out treatment, payment or health care operations, or
   2. To family members, relatives, friends or other persons identified by you who are involved in your care.
   2. The Plan, however, is not required to agree to your request if the Privacy Official determines it to be unreasonable, for example, if it would interfere with the Plan's ability to pay a claim.
   3. Your request must be in writing. You or your personal representative will be required to complete a form to request restrictions on the uses and disclosures of your PHI. To make such a request, contact the Privacy Official at the address listed on the first page of this Notice.

2. You Have the Right to Request that PHI be Transmitted to You Confidentially

   1. The Plan will permit and accommodate your reasonable request to have PHI sent to you by alternative means or to an alternative location (e.g. mailing PHI to a different address or allowing you to personally pick up the PHI that would otherwise be mailed), if you provide a written request to the Plan that the disclosure of PHI to your usual location could endanger you.
   2. Your request must be in writing. You or your personal representative will be required to complete a form to request that PHI be transmitted to you confidentially. To make such a request contact the Plan's Privacy Official at the address listed on the first page of this Notice.

3. You Have the Right to Inspect and Copy Your PHI

   1. You have the right to inspect and obtain a copy of your PHI (except psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding) contained in a “designated record set,” for as long as the Plan maintains the PHI.
   1. A “designated record set” includes your medical records and billing records that are maintained by or for the Plan. Records include enrollment, payment, billing, claims adjudication and case or medical management record systems maintained by or for the Plan or other information used in whole or in part by or for the Plan to make decisions about you.
   2. The Plan must provide the requested information within 30 days of its receipt of the request, if the information is maintained onsite or within 60 days if the information is maintained offsite. A single 30-day extension is allowed if the Plan is unable to comply with the deadline and notifies you in writing in advance of the reasons for the delay and the date by which the Plan will provide the requested information.
   3. Your request must be in writing. You or your personal representative will be required to complete a form to request to inspect and copy the PHI in your “designated record set”. Requests to inspect and copy your PHI should be made to the Plan's Privacy Official at the address listed on the first page of this Notice. The Plan may charge a reasonable, cost-based fee for copying.
   4. If your request to inspect and copy your PHI is denied, you or your personal representative will be provided with a written denial describing the basis for the denial, a description of how you may exercise review rights and a description of how you may complain to the Plan's Privacy Official or the Secretary of the U.S. Department of Health and Human Services.

4. You Have the Right to Amend Your PHI

   1. You have the right to request that the Plan amend your PHI or a record about you in a designated record set if you believe the information is inaccurate or incomplete. The Plan has 60 days after receiving your request to act on it. The Plan is allowed a single 30-day extension if the Plan is unable to comply with the 60-day deadline (provided that the Plan notifies you in writing in advance of the reasons for the delay and the date by which the Plan will provide the requested information).
   2. If the Plan denies your request in whole or in-part, the Plan must provide you with a written denial that explains the basis for the decision. You or your personal representative may then submit a written statement disagreeing with the denial and have that statement included with any future disclosures of your PHI.
   3. Your request must be in writing. You or your personal representative will be required to complete a form to request amendment of your PHI. You should make your request to amend PHI to the Privacy Official at the address listed on the first page of this notice.

5. You Have the Right to Receive an Accounting of the Plan's PHI Disclosures

   1. At your request, the Plan will also provide you with an accounting of disclosures of your PHI by the Plan during the six years (or shorter period if requested) before the date of your request. Accounting of disclosures will not include any disclosure of PHI made prior to July 1, 2007, the effective date of this Notice.
   2. The Plan has 60 days after its receipt of your request to provide the accounting. The Plan is allowed an additional 30 days if the Plan gives you a written statement of the reasons for the delay and the date by which the accounting will be provided. If you request more than one accounting within a 12-month period, the Plan may charge a reasonable, cost-based fee for each subsequent accounting.

6. You Have the Right to Receive a Paper or Electronic Copy of the Notice Upon Request

   1. To obtain a paper or electronic copy of this Notice, contact the Plan's Privacy Official at the address listed on the first page of this Notice, or go online to www.scottsdaleAZ.gov – search for “HIPAA Privacy Notice”.

5. The Plan's Duties With Respect to Your Protected Health Information

1. In General

   1. The Plan is required by law to maintain the privacy of your PHI and to provide you with notice of its legal duties and privacy practices.
   2. This Notice is effective on July 1, 2007 and the Plan is required to comply with the terms of this Notice.
   3. he Plan reserves the right to change its privacy practices and the terms of this Notice and to apply the changes to any PHI maintained by the Plan.

2. Distribution of Notice

   1. This Plan will satisfy the requirements of the HIPAA Regulation by providing this Notice to the named insured (covered employee or retiree) of the Plan; however, you are encouraged to share this Notice with other family members covered under the Plan.
   2. The Notice will be provided to each named insured when they initially enroll for benefits in the Plan (the Notice is provided in the Plan's Initial Enrollment packets).
   3. The Notice is available on the Plan's Website: www.scottsdaleAZ.gov – search for “HIPAA Privacy Notice”. The Notice will also be provided upon request.
   4. Once every three years the Plan will notify the individuals then covered by the Plan of the availability of the Notice and how to obtain the Notice.

3. Notice Revisions

   1. If a privacy practice of this Plan is materially changed affecting this Notice, a revised version of this Notice will be provided to all named insureds currently covered by the Plan.
   2. Any revised version of this Notice will be distributed prior to the effective date of a material change to the uses and disclosures of PHI, your individual rights, the duties of the Plan or other privacy practices stated in this Notice.
   3. The Plan reserves the right to change its Notice and make the change applicable to PHI created or received before and after the date of the change.

4. Disclosing Only the Minimum Necessary Protected Health Information

   1. When using or disclosing PHI or when requesting PHI from another covered entity, the Plan will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations.
   2. The minimum necessary standard will not apply in the following situations:
   1. Disclosures to or requests by a health care provider for treatment
   2. Uses or disclosures made to you
   3. Disclosures made to the Secretary of the U.S. Department of Health and Human Services
   4. Uses or disclosures required by law
   5. Uses or disclosures required for the Plan's compliance with legal regulations.

6. Your Right to File a Complaint

1. If you believe that your privacy rights have been violated, you may file a complaint. The Plan will not retaliate against you for filing a complaint. The complaint must be in writing using the Plan's form. Send the complaint to the Plan's Privacy Official, at the address listed on the first page of this Notice.

2. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services Office for a covered entity in Arizona by sending your complaint to:

   Region IX, Office of Civil Rights
   U.S. Department of Health and Human Services
   50 United Nations Plaza – Room 322
   San Francisco, CA 94102