New Mexico Health Connections | my connection | Fall 2018

•   Disclosure to Plan vendors and accreditation organizations. We may disclose your PHI to companies with whom we contract if they need the information to perform the services they provide to us. We may also disclose your PHI to accreditation organizations such as the National Committee for Quality Assurance (NCQA) when the NCQA auditors collect Health Employer Data and Information Set (HEDIS ® ) data for quality measurement purposes. When we enter into these types of arrangements, we obtain a written agreement to protect your PHI. •   Public health activities. We may use and disclose your PHI for public health activities authorized by law, such as preventing or controlling disease, reporting child or adult abuse or neglect to government authorities, or to close friends or family members who are involved in or help pay for your care. We may also advise your family members or close friends about your condition or location (such as that you are in the hospital). •   Health oversight activities. We may disclose your PHI to a government agency that is legally responsible for oversight of the healthcare system or for ensuring compliance with the rules of government benefit programs, such as Medicare or Medicaid, or other regulatory programs that need health information to determine compliance. •   For research. We may disclose your PHI for research purposes, subject to strict legal restrictions. •   To comply with the law. We may use and disclose your PHI as required by law. •   Judicial and administrative proceedings. We may disclose your PHI in response to a court or administrative order and, under certain circumstances, a subpoena, warrant, discovery request or other lawful process. •   Law enforcement officials. We may disclose your PHI to the police or other law enforcement officials, as required by law in compliance with a court order, warrant, or other process or request authorized by law to report a crime or as otherwise permitted by law. •   Health or safety. We may disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or the health and safety of the general public or other person. •   Government functions. Under certain circumstances, we may disclose your PHI to various departments of the government such as the U.S. military or the U.S. Department of State. •   Workers’ Compensation. We may disclose your PHI when necessary to comply with Workers’ Compensation laws. State law may further limit the permissible ways we use or disclose your PHI. If an applicable state law imposes stricter restrictions, we will comply with that state law. Uses and disclosures with your written authorization We will not use or disclose your PHI for any purpose other than the purposes described in this Notice without your written authorization. The written authorization to use or disclose health information shall remain valid, which in no event shall be for more than twenty-four (24) months. You can revoke the authorization at any time. Your individual privacy rights When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities. •   Right to request additional restrictions. You may request restrictions on our use and disclosure of your PHI for the treatment, payment and healthcare operations purposes explained in this Notice. This may be done by means of an oral, written or electronic request from you. While we will consider all requests for restrictions carefully, we are not required to agree to a requested restriction. If we do agree to the restrictions, we will abide by them. •   Right to receive confidential communications. You may ask to receive communications of your PHI from us by alternative means of communication or at alternative locations, if you believe that communication through normal business practices could endanger you. While we will consider reasonable requests carefully, we are not required to agree to all requests. Your request must specify how or where you wish to be contacted. •   Right to inspect and copy your PHI. You may ask to inspect or to obtain a copy of your PHI that is included in certain records we maintain. Under limited circumstances, we may deny you access to a portion of your records. If you request copies, we may charge you copying and mailing costs consistent with applicable law. If your information is stored electronically and you request an electronic copy, we will provide it to you in a readable electronic form and format. •   Right to amend your records. You have the right to ask us to amend your PHI that is contained in our records. If we determine that the record is inaccurate, and the law permits us to amend it, we will correct it. If your doctor or another person created the information that you want to change, you should ask that person to amend the information. •   Right to receive an accounting of disclosures. Upon your oral, written or electronic request, you may obtain an accounting of disclosures we have made of your PHI, except for disclosures made for treatment, payment or healthcare operations; disclosures made earlier than six years before the date of your request; and certain other disclosures that are exempted by law. If you request an accounting more than once during any 12-month period, we may charge you a reasonable fee for each accounting statement after the first one. •   Right to receive a paper copy of this Notice. You may contact Customer Care at the number on your Plan ID card to obtain a paper copy of this Notice. If you wish to make any of the requests listed above under “ Your Individual Privacy Rights ,” you must notify the Plan in writing (unless otherwise noted). For more information or if you have complaints If you have any questions about your privacy rights, believe that NMHC has violated your privacy rights or disagree with a decision that we made about access to your PHI, or if you want more information about your privacy rights or do not understand your privacy rights, you may contact our Privacy Officer at the following address or telephone number. If we discover a breach involving your unsecured PHI, we will notify you of the breach by letter or other method permitted by law. Privacy Officer You may contact our Privacy Officer at: New Mexico Health Connections • P.O. Box 36719 • Albuquerque, NM 87176 • 505-633-8020 If you believe NMHC may have violated your privacy rights, you may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services (HHS). Your complaint can be sent by email, fax, or mail to the HHS’ Office for Civil Rights (OCR). You can file a written complaint to: U.S. Department of Health and Human Services • Office of Civil Rights • 200 Independence Ave., SW • Washington, DC 20201 • or by calling 800-368-1019 . For more information, go to the OCR website: www.hhs.gov/ocr/ privacy/hipaa/complaints . We will not take any action against you if you exercise your right to file a complaint with us or the Secretary. We may change the terms of this Notice at any time, and we may, at our discretion, make the new terms effective for all of your PHI in our possession, including any PHI we created or received before we issued the new Notice. The new Notice will be available upon request, on our website, and we will mail a copy to you. { P R I V A C Y C O M M I T M E N T C O N T I N U E D }