Notice of privacy practices

This notice describes how claims or medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Arkansas Blue Cross and Blue Shield/BlueAdvantage Administrators of Arkansas and Health Advantage

By law, Arkansas Blue Cross and Blue Shield and its affiliated company, HMO Partners, Inc., d/b/a Health Advantage, are required to protect the privacy of your protected health information. We also must give you this notice to tell you how we may use and release ("disclose") your protected health information held by us. Arkansas Blue Cross and Blue Shield is a business name of USAble Mutual Insurance Company, which also does business as BlueAdvantage Administrators of Arkansas, a third-party administrative services division of the company.

Throughout this notice, we will use the name "Arkansas Blue Cross" as a shorthand reference, not only for Arkansas Blue Cross and Blue Shield, but also for our BlueAdvantage division and our affiliated company, Health Advantage. Please note that although we are combining this privacy notice for convenient, shorthand reference, and to make it more efficient to inform you about your privacy rights, Arkansas Blue Cross/BlueAdvantage is a separate company from Health Advantage and both companies have their own operations, management and compliance responsibilities.

Arkansas Blue Cross must use and release your protected health information to provide information:

• To you or someone who has the legal right to act for you (your personal representative)
• To the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected, and
• Where required by law.

Arkansas Blue Cross has the right to use and release your protected health information to evaluate and process your health plan or health insurance claims, enroll and disenroll you and your dependents, and perform related business operations.

For example:

• We can use and disclose your protected health information to pay or deny your claims, to collect your premiums, or to share your benefit payment or status with other insurer(s).
• We can use and disclose your protected health information for regular healthcare operations. Members of our staff may use information in your personal health record to assess our efficiency and outcomes in your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of benefits and services we provide.
• We may disclose protected health information to your employer for health plan administration purposes, including healthcare operations of the health plan, if your employer arranges for your insurance or funds the health plan coverage and serves as plan administrator. If your employer meets the requirements outlined by the privacy law to ensure adequate separation between the employer and the health plan itself, we can disclose protected health information to the appropriate health plan administrative department of your employer to assist in obtaining coverage or processing a claim or to modify benefits, work to control overall plan costs, and improve service levels. This information may be provided to the appropriate health plan administrative department of your employer in the form of routine reporting or special requests.
• We may disclose to others who are contracted to provide services as business associates on our behalf. Some services are provided in our organization through contracts with others. Examples include pharmacy management programs, dental benefits, and a copy service we use when making copies of your health record. Our contracts require these business associates to appropriately protect your information in compliance with applicable privacy and security laws.
• Our health professionals and customer service staff, using their best judgment, may disclose to a family member, other relative, close personal friend or any other person you identify, health information relevant to that person's involvement in your care or payment related to your care. Examples of such releases of your protected health information could include your spouse calling to verify a claim was paid, or the amount paid on a claim, or an adult child inquiring about explanation of benefit forms received by an elderly parent who is ill or impaired and unable to address their own health insurance or health plan business.

Arkansas Blue Cross may use or give out your protected health information for the following purposes, under limited circumstances:

• To state and federal agencies that have the legal right to receive Arkansas Blue Cross data (such as to make sure we are making proper claims payments)
• For public health activities (such as reporting disease outbreaks)
• For government healthcare oversight activities (such as fraud and abuse investigations)
• For judicial and administrative proceedings (such as in response to a subpoena, law enforcement agency administrative request or other court order)
• For law enforcement purposes (such as providing limited information to locate a missing person or in response to any federal or state agency administrative request that is authorized by law)
• For research studies that meet all privacy law requirements (such as research related to the prevention of disease or disability)
• To avoid a serious and imminent threat to health or safety
• To contact you, either directly or through a business associate, using your postal or email addresses, telephone numbers or other personal information, regarding new or changed health plan benefits or new health benefits product offerings of Arkansas Blue Cross or Health Advantage.
• To contact you, either directly or through a business associate, using your postal or email addresses, telephone numbers or other personal information, regarding healthcare providers participating in our networks, disease management, health education and health promotion, preventive care options, wellness programs, treatment or care coordination or case management activities of Arkansas Blue Cross or Health Advantage.

By law, Arkansas Blue Cross must have your written permission (an "authorization") to use or release your protected health information for any purpose other than treatment, payment or health¬care operations or other limited exceptions outlined here or in the Privacy regulation or other applicable law. Once you have given your permission for us to release your protected health information you may take it back ("revoke") at any time by giving written notice to us, except if we have already acted based on your original permission. To the extent (if any) that we maintain or receive psychotherapy notes about you, most disclosures of these notes require your authorization. Also, to the extent (if any) that we use or disclose your information for our fundraising practices, we will provide you with the ability to opt out of future fundraising communications. In addition, most (but not all) uses and disclosures of medical information for marketing purposes, and disclosures that constitute a sale of protected health information, require your authorization.

Personal Health Record (PHR)

If you have a health benefit plan issued by Arkansas Blue Cross or Health Advantage on or after October 1, 2007, you have a Personal Health Record (PHR). Your PHR contains a summary of claims submitted for services you received while you are or were covered by your health benefit plan, as well as non-claims data you choose to enter yourself. Your PHR will continue to exist, even if you discontinue coverage under your health benefit plan. You have access to your PHR through the Arkansas Blue Cross or Health Advantage websites. In addition, unless you limit access, your physician and other healthcare providers who provide you treatment have access to your PHR. Certain information that may exist in the claims records will not be made available to your physician and other healthcare providers automatically.

To protect your privacy, information about treatment for certain sensitive medical conditions, such as HIV/AIDS, sexually transmitted diseases, mental health, drug or alcohol abuse or family planning, will be viewable by you alone unless you choose to make this information available to the medical personnel who treat you. Similarly, non-claims data, such as your medical, family and social history, will only appear in your PHR if you choose to enter it yourself. It is important to note that you have the option to prohibit access to your PHR completely, either by electronically selecting to prohibit access or by sending a written request to prohibit access to the Privacy Office at the address below.

Special Note on Genetic Information

We are prohibited by law from collecting or using genetic information for purposes of underwriting, setting premium, determining eligibility for benefits or applying any pre-existing condition exclusion under an insurance policy or health plan. Genetic information means not only genetic tests that you have received, but also any genetic tests of your family members, or any manifestations of a disease or disorder among your family members. Except for pre-existing condition exclusions, we may obtain and use genetic information in making a payment or denial decision, or otherwise processing a claim for benefits under your health plan or insurance policy, to the extent that genetic information is relevant to the payment or denial decision or proper processing of your claim.

Your Rights Regarding Medical Information About You

You have the right to:

• See and obtain a copy of your protected health information that is contained in a designated record set that was used to make decisions about you. This may include an electronic copy in certain circumstances, if you make this request in writing.
• Have your protected health information amended if you believe that it is wrong, or if information is missing, and Arkansas Blue Cross agrees. If Arkansas Blue Cross disagrees, you may have a statement of your disagreement added to your protected health information.
• Receive a listing of those receiving your protected health information from Arkansas Blue Cross. The listing will not cover your protected health information that was released to you or your personal representative, or that was released for payment or healthcare operations, or that was released for law enforcement purposes.
• Ask Arkansas Blue Cross to communicate with you in a different manner or at a different place (for example, by sending your correspondence to a P.O. Box instead of your home address) if you are in danger of personal harm if the information is not kept confidential.
• Ask Arkansas Blue Cross to limit how your protected health information is used and released to pay your claims and perform healthcare operations. Please note that Arkansas Blue Cross may not be able to agree to your request.
• Get a separate paper copy of this notice.

Breach Notification

In the event of a breach of your health information, we will provide you notification of such a breach as required by law or where we otherwise deem such notification appropriate.

To Exercise Your Rights

If you would like to contact Arkansas Blue Cross, its BlueAdvantage division, or Health Advantage for further information regarding this notice, or exercise any of the rights described in this notice, you may do so by contacting Customer Service at the following toll-free telephone numbers:

Arkansas Blue Cross 1-800-238-8379
BlueAdvantage 1-888-872-2531
Health Advantage 1-800-843-1329

You also may access complete instructions and request forms from our companies' websites:

arkansasbluecross.com
blueadvantagearkansas.com
healthadvantage-hmo.com

Changes to this Notice

We are required by law to abide by the terms of this notice. We reserve the right to change this notice and make the revised or changed notice effective for claims or medical information we already have about you as well as any future information we receive. When we make changes, we will notify you by sending a revised notice to the last known address we have for you or by alternative means allowed by law or regulation. We also will post a copy of the current notice on Arkansas Blue Cross and Health Advantage websites.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Arkansas Blue Cross or BlueAdvantage by writing to the following address:

Privacy Office
ATTN: Privacy Officer
P.O. Box 3216
Little Rock, AR 72201
Telephone: 1-866-254-4001
Email: privacyofficeinquiries@arkbluecross.com

You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. Complaints filed directly with the Secretary must:

1. be in writing;
2. contain the name of the entity against which the complaint is lodged;
3. describe the relevant problems; and
4. be filed within 180 days of the time you became or should have become aware of the problem.

We will not penalize or in any other way retaliate against you for filing a complaint with the Secretary or with us.

Download a printable copy of the privacy notice [pdf]

Last material revision 05/2013
Last general revision 09/2019