This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
What is this Notice?
This Notice tells you:
This Notice follows what is known as the HIPAA Privacy Regulations. These regulations were given out by the federal government. The federal government requires companies such as CareFirst Medicare Advantage to follow the terms of the regulations and of this Notice.
NOTE: You may also get a Notice of Privacy Practices from the State and other organizations.
What is Protected Health Information?
In this Notice, protected health information will be written as PHI. The HIPAA Privacy Regulations define protected health information as:
What are CareFirst Medicare Advantage’s Responsibilities to You about Your Protected Health Information?
Your/your family’s PHI is personal. We have rules about keeping this information private. These rules are designed to follow state and federal requirements. CareFirst Medicare Advantage must:
We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
How does CareFirst Medicare Advantage Use Your Protected Health Information?
The sections that follow tell some of the ways we can use and share PHI without your written authorization.
For Payment — CareFirst Medicare Advantage may use PHI about you so that the treatment services you get may be looked at for payment. For Example, a bill that your provider sends us may be paid using information that identifies you, your diagnosis, the procedures or tests, and supplies that were used.
For Health Care Operations — CareFirst Medicare Advantage may use PHI about you for health care operations. For Example, we may use the information in your record to review the care and results in your case and other cases like it. This information will then be used to improve the quality and success of the health care you get. Another Example of this is using information to help enroll you for health care coverage.
CareFirst Medicare Advantage may use PHI about you to help provide coverage for medical treatment or services. For Example, information we get from a provider (nurse, PCP, or other member of a health care program) will be logged and used to help decide the coverage for the treatment you need. CareFirst Medicare Advantage may also use or share your PHI to:
Other Uses of Protected Health Information
Business Associates — CareFirst Medicare Advantage may contract with business associates that will provide services to CareFirst Medicare Advantage using your PHI. Services our business associates may provide include dental services for members, a copy service that makes copies of your record, and computer software vendors. They will use your PHI to do the job we have asked them to do. The business associate must sign a contract to agree to protect the privacy of your PHI.
People Involved with Your Care or with Payment for Your Care — CareFirst Medicare Advantage may make your PHI known to a family member, other relative, close friend or other personal representative that you choose. This will be based on how involved the person is in your care, or payment that relates to your care. We may share information with parents or guardians, if allowed by law.
Law Enforcement — CareFirst Medicare Advantage may share PHI if law enforcement officials ask us to. We will share PHI about you as required by law or in response to subpoenas, discovery requests, and other court or legal orders. We will notify you in a timely manner of any information disclosed in response to a court order.
Other Covered Entities — CareFirst Medicare Advantage may use or share your PHI to help health care providers that relate to health care treatment, payment or operations. For Example, we may share your PHI with a health care provider so that the provider can treat you.
Public Health Activities — CareFirst Medicare Advantage may use or share your PHI for public health activities allowed or required by law. For Example, we may use or share information to help prevent or control disease, injury or disability. We also may share information to assist with product recalls, and reporting of adverse reactions to medication. We also may share information with a public health authority allowed to get reports of child abuse, neglect or domestic violence.
Health Oversight Activities — CareFirst Medicare Advantage may share your PHI with a health oversight agency for activities approved by law, such as audits; investigations; inspections; licensure or disciplinary actions; or civil, administrative, or criminal proceedings or actions. Oversight agencies include government agencies that look after the health care system; benefit programs, including Medicaid and other government regulation programs.
Research — CareFirst Medicare Advantage may share your PHI with researchers when an institutional review board or privacy board has followed the HIPAA information requirements.
Coroners, Medical Examiners, Funeral Directors and Organ Donation — CareFirst Medicare Advantage may share your PHI to identify a deceased person, determine a cause of death, or to do other coroner or medical Examiner duties allowed by law. We also may share information with funeral directors, as allowed by law. We may also share PHI with organizations that handle organ, eye or tissue donation and transplants.
To Prevent a Serious Threat to Health or Safety — CareFirst Medicare Advantage may share your PHI if we feel it is needed to prevent or reduce a serious and likely threat to the health or safety of a person or the public.
Military Activity and National Security — Under certain conditions, CareFirst Medicare Advantage may share your PHI if you are or were in the Armed Forces. This may happen for activities believed necessary by appropriate military command authorities.
Disclosures to the Secretary of the U.S. Department of Health and Human Services — CareFirst Medicare Advantage is required to share your PHI with the Secretary of the U.S. Department of Health and Human Services. This happens when the Secretary looks into or decides if we are in compliance with the HIPAA Privacy Regulations.
What are Your Rights Regarding Your Protected Health Information?
Right to Get the CareFirst Medicare Advantage Notice of Privacy Practices
We are required to send each CareFirst Medicare Advantage head of case or head of household a printed copy of this Notice on or before (date needed). After that, each head of case or head of household will get a printed copy of the Notice in the New Member Welcome package.
We have the right to change this Notice. Once the change happens, it will apply to PHI that we have at the time we make the change and to the PHI we had before we made the change. A new Notice that includes the changes and the dates they are in effect will be mailed to you at the address we have for you.
The changes to our Notice will also be included on our web site. You may ask for a paper copy ofthe Notice of Privacy Practices at any time. Call Member Services toll free at 1-844-386-6762. TTY users should call 711. Our Member Services staff can talk with you 8 AM to 8 PM, 7 days a week from October 1 through March 31 and Monday through Friday from April 1 through September 30.
Right to Access
You have the right to look at and get a copy of your enrollment, claims, payment and case management information on file with CareFirst Medicare Advantage. This file of information is called a designated record set. We will provide the first copy to you in any 12-month period without charge.
If you would like a copy of your PHI, you must send a written request to CareFirst Medicare Advantage’s Director of Compliance. The address is at the end of this Notice. We will answer your written request in 30 calendar days. We may ask for an extra 30 calendar days to process your request if needed. We will let you know if we need the extra time.
We do not keep complete copies of your medical records. If you would like a copy of your medical record, contact your PCP or other provider. Follow the PCP’s or provider’s instructions to get a copy. Your PCP or other provider may charge a fee for the cost of copying and/or mailing the record.
We have the right to keep you from having or seeing all or part of your PHI for certain reasons. For Example, if the release of the information could cause harm to you or other persons. Or, if the information was gathered or created for research or as part of a civil or criminal proceeding. We will tell you the reason in writing. We will also give you information about how you can file an Administrative Review if you do not agree with us.
Right to Amend
You have the right to ask that the information in your health record be changed if you think it is not correct. To ask for a change, send your request in writing to CareFirst Medicare Advantage’s Director of Compliance. We can send you a form to complete. You can also call Member Services to request a form. The address and phone number are at the end of this Notice.
We will answer your request within 30 days of when we receive it. We may ask for an extra 30 days to process your request if needed. We will let you know if we need the extra time.
We may deny the request for change. We will send you a written reason for the denial if:
Right to an Accounting of Certain Disclosures of Your Protected Health Information
You have the right to get an accounting of certain disclosures of your PHI. This is a list of times we shared your information when it was not part of treatment, payment and health care operations.
Most disclosures of your PHI by our business associates or us will be for treatment, payment or health care operations.
To ask for a list of disclosures, please send a request in writing to CareFirst Medicare Advantage’s Member Privacy Unit. We can send you a form to complete. For a copy of the form, contact Member Services. The address and phone number are at the end of this Notice. Your request must give a time-period that you want to know about.
Right to Request Restrictions
You have the right to ask that your PHI not be used or shared. You do not have the right to ask for limits when we share your PHI if we are asked to do so by law enforcement officials, court officials, or State and Federal agencies in keeping with the law. We have the right to deny a request for restriction of your PHI.
To ask for a limit on the use of your PHI, send a written request to CareFirst Medicare Advantage’s Member Privacy Unit. We can send you a form to fill out. You can contact Member Services for a copy of the form. The address and phone number are at the end of this Notice. The request should include:
We will look at your request and decide if we will allow or deny the request within 30 days. If we deny the request, we will send you a letter and tell you why.
Right to Choose Someone to Act for You
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
Right to Cancel a Privacy Authorization for the Use or Disclosure of Protected Health Information
We must have your written permission (authorization) to use or give out your PHI for any reason other than treatment, payment and health care operations or other uses and disclosures listed under Other Uses of Protected Health Information. If we need your authorization, we will send you an authorization form explaining the use for that information.
You can cancel your authorization at any time by following the instructions below.
Send your request in writing to CareFirst Medicare Advantage’s Member Privacy Unit. We can send you a form to complete. You can contact Member Services for a copy of the form. The address and phone number are at the end of this Notice. This cancellation will only apply to requests to use and share information asked for after we get your Notice.
Right to Request Confidential Communications
You have the right to ask that we communicate with you about your PHI in a certain way or in a certain location. For Example, you may ask that we send mail to an address that is different from your home address.
Requests to change how we communicate with you should be submitted in writing to CareFirst Medicare Advantage’s Member Privacy Unit. We can send you a form to complete. For a copy of the form, contact Member Services. The address and phone number are at the end of this Notice. Your request should state how and where you want us to contact you.
What should you do if you have a complaint about the way that your protected health information is handled by CareFirst Medicare Advantage or our business associates?
If you believe that your privacy rights have been violated, you may file a complaint with CareFirst Medicare Advantage or with the Secretary of Health and Human Services.
To file a complaint with v or to ask for an Administrative Review of a decision about your PHI, send a written request to CareFirst Medicare Advantage’s Member Privacy Unit or call Member Services. The address and phone number are at the end of this Notice.
To file a complaint with the Secretary of Health and Human Services, send your written request to:
Office for Civil Rights U.S. Department of Health and Human Services 150 S. Independence Mall West, Suite 372 Philadelphia, PA 19106-3499
Or visit www.hhs.gov/ocr/privacy/hipaa/complaints/
You will not lose your CareFirst Medicare Advantage membership or health care benefits if you file a complaint. Even if you file a complaint, you will still get health care coverage from CareFirst Medicare Advantage as long as you are a member. We will not retaliate against you for filing a complaint.
Where should you call or send requests or questions about your protected health information?
You may call us toll free at 1-844-386-6762, 8 AM to 8 PM, 7 days a week from October 1 through February 14 and Monday through Friday from February 15 through September 30. TTY users call 711. Or, you may send questions or requests, such as the Examples listed in this Notice, to the address below:
Director of Compliance CareFirst Bluecross BlueShield Medicare Advantage PO Box 915 Owings Mills, MD 21117
Send your request to this address so that we can process it timely. Requests sent to persons, offices or addresses other than the address listed above might be delayed.