Concepts NREC - Employments

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

Concepts ETI, Inc. ("CETI") sponsors benefit plans that are or may be "group health plans", as that term is defined by regulations issued under the Health Insurance Portability and Accountability Act of 1996, or HIPAA. The HIPAA privacy regulations, or Privacy Rule, impose obligations on the group health plans with respect to their use and disclosure of your protected health information, or PHI. The Privacy Rule also requires that the group health plans send you this Notice of Privacy Practices, or Notice, explaining how they use, disclose and protect your PHI.

Generally, PHI is information that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the past, present, or future payment for health care furnished to you, and that identifies you or with respect to which there is a reasonable basis to believe that the information can be used to identify you.

Group Health Plans Covered by this Notice
This Notice covers all group health plans sponsored by CETI that have an obligation to deliver a Notice of Privacy Practices. For example, this Notice covers those group health plans sponsored by CETI that provide medical, dental, health care reimbursement, employee assistance, and wellness benefits, if any. The terms "we", "us" and "our" in this Notice refer to these group health plans. The group health plans do not have any employees. Instead, each group health plan is administered by a third-party administrator (a company that helps us to operate the plan), employees of CETI, or both.

Our Duties with Respect to Your PHI
We are required by law to maintain the privacy of your PHI as set forth in this Notice and to provide you this Notice of our legal duties and privacy practices with respect to your PHI. We are required to abide by the terms of this Notice, which we may amend from time to time (and we will be required to abide by the terms of any amended Notice: in other words, we are required to abide by the terms of the Notice that is in effect at any given time).

We reserve the right to change the terms of this Notice at any time and to make the new Notice provisions effective for all PHI that we maintain, including PHI that we created or received before the effective date of any such change. We will make a revised or changed Notice available to you, in accordance with the requirements of the Privacy Rule. For example, if we make material revisions to the Notice, we will distribute the revised Notice within sixty (60) days after the material revisions. You may always request a copy of our most current Notice at any time by contacting our Privacy Official (contact information is set forth below). A current version of the Notice is available under the Human Resources section of your Microsoft Outlook account (if you have such an account through CETI). The effective date of the Notice will always be noted at the end of the Notice.

Organized Health Care Arrangement
As all of the group health plans identified above are sponsored by CETI, they are each a participant in a HIPAA "organized health care arrangement." As a result, these group health plans may share your PHI with each other, as necessary to carry out treatment, payment, or health care operations relating to the arrangement. We provide a general description of "treatment", "payment" and "health care operations" below.

How We May Use and Disclose PHI about You Without Your Authorization
The following categories describe the different ways in which we may use and disclose your PHI under the Privacy Rule, all without your written authorization. Please note that all of the ways we are permitted to use and disclose PHI will fall within one of the categories. However, not every specific use or disclosure in a category will be listed.

Treatment We do not provide treatment, but might share PHI with your health care providers if those providers need the PHI to provide treatment to you.

For example, we may disclose to a specialist health care provider PHI we possess about you, to help that specialist deliver quality health care and treatment services to you.

Payment We may use and disclose your PHI for payment activities. Generally, payment activities are undertaken to obtain premiums or to determine or fulfill responsibility for coverage and provision of benefits, or to obtain or provide reimbursement for the provision of health care. Payment activities include:

determining eligibility or coverage (including coordination of benefits, or the determination of cost sharing amounts), and adjudicating or subrogating health benefit claims;
risk adjusting amounts due based on enrollee health status and demographic characteristics;
claims management and obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance);
review of services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; and
utilization review activities, including pre-certification and pre-authorization of services, and concurrent and retrospective review of services.

For example, a third party administrator may use and disclose your PHI to pay claims from health care providers for any treatment and services provided to you that are covered by a group health plan. The information on or accompanying a claim may include information that identifies you, as well as your diagnosis, procedures, and supplies used.

We may also disclose your PHI to health care providers and other entities covered by the Privacy Rule, for their payment activities.

Health Care Operations We may use and disclose PHI for health care operations, including the health care operations of the organized health care arrangement. Generally, health care operations are business and administrative functions and activities, and include:

conducting quality assessment and improvement activities;
conducting population-based activities relating to improving health or reducing health care costs;
engaging in case management and care coordination;
underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance);
conducting or arranging for medical review, legal services and auditing functions, including fraud and abuse detection and compliance programs; and
engaging in business management and general administrative activities (for example, creating de-identified health information and limited data sets).

For example, we may review the ways in which we deliver our services to you, as part of quality assessment and improvement activities with respect to the group health plans, and in that regard, may use your PHI, as well as disclose it to others who assist us with the assessment and improvement activities.

We may also disclose your PHI to other entities who are covered by the Privacy Rule for certain of their health care operations, if the PHI is related to a relationship they have or previously had with you.

Plan Sponsor Generally, we (or a health insurance issuer or HMO with respect to a group health plan, if any) may disclose to the plan sponsor (CETI):

"summary health information", if the plan sponsor requests such information for the purpose of obtaining premium bids from health plans for providing health insurance coverage under a group health plan or to modify, amend or terminate a group health plan. "Summary health information" is information that summarizes claims history, claims expenses or types of claims experienced by the individuals who participate in the group health plan, and from which certain identifiers have been removed.
information on whether an individual is participating in a group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.
PHI, to assist sponsor employees in conducting plan administration functions, but only if certain other requirements are first satisfied, such as that applicable plan documents have been amended and that the plan sponsor has agreed that it will not use or disclose your PHI for employment-related actions or decisions.

Treatment Alternatives/Health Related Benefits and Services. We may use and disclose your PHI to tell you about or recommend possible treatment options or alternatives that may interest you, and to provide you with information on health-related benefits and services that may interest you.

Required by Law. We will use and disclose your PHI when we are required to do so by any federal, state or local law. For example, we may be required to disclose your PHI if the federal Department of Health and Human Services investigates our Privacy Rule compliance efforts.

Health Oversight Activities. We may use and disclose your PHI to health oversight agencies for their authorized activities including audits, civil, administrative or criminal investigations, inspections and licensure or disciplinary actions.

Public Health Activities. We may use and disclose your PHI for public health activities, including to report disease, injury, vital events such as birth or death and the conduct of public health surveillance, investigations and interventions; to report child abuse or neglect; and to notify a person who may have been exposed to a communicable disease or who may otherwise be at risk of contracting or spreading a disease or condition.

Abuse, Neglect or Domestic Violence. We may use and disclose your PHI to notify government authorities if we reasonably believe you are the victim of abuse, neglect or domestic violence. If we intend to make such a disclosure, we will notify you that we have done so (or will do so), unless we believe that informing you would place you at risk of serious harm, or we would be informing a person who we reasonably believe is responsible for the abuse, neglect or domestic violence, and that informing that person would not be in your best interests.

Judicial and Administrative Proceedings. We may use and disclose your PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal as expressly authorized by such order, or in response to a subpoena, discovery request or other lawful process.

Law Enforcement Purposes. We may use and disclose your PHI to law enforcement officials for certain law enforcement purposes. For example, we may disclose your PHI to law enforcement officials to comply with court orders, court ordered warrants, subpoenas or summons issued by a judicial officer, grand jury subpoenas, administrative requests, and laws that we are required to follow.

Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of the public or another person, or as necessary for law enforcement authorities to identify or apprehend an individual.

Specialized Government Functions. In certain circumstances, federal regulations require or authorize us to use and disclose your PHI to facilitate specialized government functions related to the military, veterans affairs, national security and intelligence activities, protective services for the president and other important officials, medical suitability determinations, correctional institutions, inmates and law enforcement custody.

Workers' Compensation. We may use and disclose your PHI to the extent authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs that provide benefits for work-related injuries or illnesses.

Coroners and Medical Examiners. We may use and disclose your PHI to coroners and medical examiners, to identify a deceased person, determine a cause of death, or other duties authorized by law.

Funeral Directors. We may use and disclose your PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to your funeral arrangements. If necessary to carry out their duties, we may disclose your PHI before, and in reasonable anticipation of, your death.

Organ, Eye or Tissue Donation. We may use and disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue for the purpose of facilitating donation and transplantation.

Research. We may use and disclose your PHI for research purposes, subject to strict legal restrictions. In many cases, we will ask for your written authorization before using or disclosing your PHI to conduct research.

To You. Upon your request and in accordance with applicable provisions of the Privacy Rule, we may disclose to you your PHI that is in a "designated record set." Generally, a designated record set contains enrollment, payment, claims adjudication and case or medical management records we may have about you, as well as other records that we use to make decisions about your health care benefits. You can request the PHI from your designated record set as described below in the section titled "Your Rights with Respect to Your PHI."

Business Associates. We may disclose your PHI to third-party administrators, auditors, attorneys, consultants, contractors, agents and other business associates of ours who need the information to provide services to us, for us or on our behalf. When we disclose your PHI in this manner we obtain a written agreement that our business associate will protect the confidentiality of your PHI.

De-Identified PHI. We may use and disclose your PHI if we have removed information that has the potential to identify you so that the health information is "de-identified." We may also use and disclose "partially de-identified" health information about you if the person who will receive the information signs an agreement to protect the privacy of the information.

Incidental Uses and Disclosures. While we take reasonable steps to safeguard the privacy of your PHI, certain uses and disclosures of your PHI may occur during or as an unavoidable result of otherwise permissible or required uses or disclosures of your PHI.

Communication with Your Family. We may use and disclose to a family member, other relative, or your close personal friend, or any other person identified by you, the PHI directly relevant to that person's involvement with your care or the payment related to your health care. We may also use and disclose your PHI to notify, or assist in the notification of, your family, your personal representative, or another person responsible for your care, of your location, general condition or about the unfortunate event of your death. In addition, we may use and disclose PHI about you to an entity assisting in a disaster relief effort so that appropriate persons can be notified about your condition, status, and location. If you would like to restrict or prohibit these uses or disclosures, please contact our Privacy Official (contact information is set forth below).

Authorization to Use or Disclose Your PHI
Other than as stated above, and as otherwise permitted by applicable law, we will not use or disclose your PHI other than with your written authorization. You may give us a written authorization permitting us to use or disclose your PHI for any purpose.

You may revoke an authorization that you provide to us at any time. Your revocation must be in writing, and sent to our Privacy Official (contact information is set forth below). After you revoke an authorization, we will no longer use or disclose your PHI for the reasons described in that authorization, except to the extent that we have already relied on the authorization to make a use or disclosure.

Your Rights with Respect to Your PHI
You have the following rights regarding your PHI that we maintain. If you are interested in pursuing any of these rights, please make a request in writing to our Privacy Official (contact information is set forth below). Please note that requests to receive confidential communications, to inspect and copy PHI, and to amend PHI must be made in writing.

Right to Request Restrictions. You have the right to request that we restrict certain uses and disclosures of your PHI. For example, you have the right to request a limit on our use or disclosure of your PHI in connection with your treatment, payment for your care and our health care operations. You may also request that we limit how we disclose information about you to family, friends, and other individuals involved in your care or payment related to your health care. We are not required to agree to your request. If we do agree to your request, we will be bound by our agreement except in emergency situations and as otherwise required by law.

Right to Receive Confidential Communications. You have the right to request that we communicate with you in a certain way if you feel the disclosure of your PHI could endanger you. For example, you may ask that we only communicate with you by mail, rather than by telephone, or at work, rather than at home. Your written request must clearly state that the disclosure of all or part of your PHI could endanger you. We will accommodate every reasonable request for confidential communications.

Right to Inspect and Copy Your PHI. Subject to certain exceptions, you have the right to inspect and copy your PHI contained in a designated record set. Generally, a designated record set contains enrollment, payment, claims adjudication and case or medical management records we may have about you, as well as other records that we use to make decisions about your health care benefits. The request to inspect and copy PHI may be made as long as we maintain the information. If you request a copy of your PHI, we may charge a reasonable, cost-based fee for copying and postage.

Right to Amend Your PHI. If you believe that any of your PHI contained in a designated record set is inaccurate or incomplete, you have the right to request that we amend the PHI. The request to amend may be made as long as we maintain the information. We may deny the request if the request does not include a reason to support the amendment. We may also deny the request for other reasons. For example, we may deny a request if we determine the records containing your PHI are accurate and complete. If we deny your request, you have the right to submit a written statement of disagreement.

Right to an Accounting. You have the right to request an accounting of certain disclosures of your PHI we have made or that were made on our behalf. Any accounting will not include certain disclosures, including: disclosures to carry out treatment, payment and health care operations; disclosures we made to you; and disclosures that you authorized. The request should specify the time period for which you are requesting the information, but may not start earlier than April 14, 2004. Accounting requests may not be made for periods of time going back more than 6 years. We will provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests in a 12-month period may be subject to a reasonable cost-based fee. We will inform you in advance of the fee, if applicable.

Right to a Paper Copy of this Notice. You have the right to request and receive a paper copy of this Notice at any time, even if you have received this Notice previously or agreed to receive this Notice electronically. To obtain a paper copy, please contact our Privacy Official (contact information is set forth below).

Right to File Complaints. You have the right to file complaints with us and/or the federal Office for Civil Rights if you believe that your privacy rights have been violated. Any complaints to us should be made in writing to our Privacy Official (contact information is set forth below). Any complaints to the Office for Civil Rights should be directed to: Office for Civil Rights, U.S. Department of Health & Human Services, JFK Federal Building, Room 1875, Boston, MA 02203, (617) 565-1340, (617) 565-1343 (TDD), (617) 565-3809 (facsimile). We encourage you to express any concerns to us that you may have regarding the privacy of your PHI. We will not retaliate against you in any way for filing a complaint with us or with the Office for Civil Rights.

Potential Impact of State or Other Law
In some situations, we may be required to follow state privacy or other applicable laws that are more stringent in terms of the privacy protection they afford to you and your PHI than the HIPAA Privacy Rule. We will abide by those laws in our handling of your PHI.

Contact Person
We have designated our Privacy Official as the contact person for all issues regarding your privacy rights, including any further information about this Notice. You may contact our Privacy Official as follows: Concepts ETI, Inc., 217 Billings Farm Road, White River Junction, Vermont, 05001 (802) 296-2321, (802) 296-2325 (facsimile).

Effective Date
This Notice is effective April 14, 2004.

IF YOU HAVE ANY QUESTIONS REGARDING THIS NOTICE, PLEASE CONTACT OUR PRIVACY OFFICIAL AT CONCEPTS ETI, INC., 217 BILLINGS FARM ROAD, WHITE RIVER JUNCTION, VERMONT, 05001 (802) 296-2321, (802) 296-2325 (FACSIMILE).

Contact:
Jon Stearns
Director,
Human Resources
Concepts NREC
217 Billings Farm Rd.
White River Junction, VT 05001-9486
or fax to
802-296-2325