NOTICE OF PRIVACY PRACTICES
OF
FIRSTCAROLINACARE INSURANCE COMPANY

THIS NOTICE DESCRIBES HOW PERSONAL HEALTH INFORMATION MAY BE USED AND DISCLOSED AND MEMBER RIGHTS REGARDING THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

For additional information or to make requests, please contact:

Privacy Officer
FirstCarolinaCare Insurance Company
42 Memorial Drive
Pinehurst, NC 28374
910-715-8100

A. DUTY TO PROTECT HEALTH INFORMATION

FirstCarolinaCare Insurance Company (“FCC”) is required by the federal Health Insurance Portability and Accountability Act (“”) to protect the privacy of members’ health information, which is called “protected health information,” or “PHI” for short. FCC must give members notice of its legal duties and privacy practices concerning PHI, including:

1. FCC must protect PHI created or received about members’ past, present, or future health condition, treatment received, or payment for health care services.
2. FCC must notify members about how it protects their PHI.
3. FCC must explain how, when and why it uses and/or discloses PHI.
4. FCC may only use and/or disclose PHI as described in this Notice.

This Notice satisfies items 2 and 3 above, and describes the types of uses and disclosures of PHI that FCC may make under the law. In addition, FCC may make other uses and disclosures which occur as a byproduct of the permitted uses and disclosures described in this Notice.

FCC is required to follow the procedures in this Notice. It reserves the right to change the terms of this Notice and to make new notice provisions effective for all PHI that FCC maintains by first:

• Mailing copies of the revised notice to all subscribers; and
• Making copies of the revised notice available upon request through the contact person listed in this Notice.

B. FCC MAY USE AND DISCLOSE PHI WITHOUT AUTHORIZATION IN CERTAIN CIRCUMSTANCES.

Except as specifically permitted by law and described below, FCC may not disclose to any third party any PHI of a member -- not even to a close relative or spouse – without written authorization of the member.

1. FCC may use and disclose PHI so members may receive health care treatment.

FCC may use and disclose PHI to provide, coordinate or manage health care and related services. This may include communicating with health care providers when services must be pre-certified by FCC, or when verifying eligibility.

EXAMPLE: A doctor treating a member for a broken leg may needs to get enrollment information from FCC to determine if the member has health coverage. FCC may ask the doctor about the member’s medical condition in order to pre-certify different services that are needed, such as physical therapy, and lab work. FCC may also need to disclose PHI to people outside the hospital who may be involved in the member’s medical care after discharge, such as home health providers.

2. FCC may use and disclose PHI to make payment for services.

Generally, FCC may use and give PHI to others in order to make payment for treatment and services. Such disclosures may be made to:

• Claims processing vendors;
• Hospital or other healthcare facilities;
• Other health plans to determine coordination of benefits; and
• Physicians or other providers of healthcare.

EXAMPLE: If a member has other coverage besides FCC, FCC may have to send PHI in the form of a claim to the other health plan so that the member can receive all of the benefits to which he/she is entitled.

3. FCC may use and disclose PHI for health care operations.

FCC may use and disclose PHI in performing its normal business activities, or “health care operations”. Examples of the way FCC may use or disclose PHI for “health care operations” include the following:

• Reviewing requested services to determine medical necessity;
• Managing and coordinating care more effectively through case management or chronic care management;
• Reviewing and evaluating the skills, qualifications, and performance of network health care providers;
• Cooperating with outside organizations that assess the quality of the care;
• Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and contracting for reinsurance of risk relating to claims for health care;
• Conducting business management and general administrative activities related to FCC and the services it provides, including providing information;
• Resolving member grievances and appeals;
• Complying with this Notice and with applicable laws.

4. Special Protections for Genetic Information

Notwithstanding the above, special protections are given to your genetic information. FCC is not permitted to use or disclose your genetic information for underwriting purposes, which includes (1) determining whether you are eligible for benefits; (2) determining the premium for coverage; (3) determining whether you are subject to a pre-existing condition exclusion; and (4) other activities related to the creation, renewal or replacement of the coverage provided by FCC. Genetic information includes genetic tests of an individual or family member, family medical histories, and genetic services (e.g., counseling, education and evaluation of genetic information). Family members include immediate family members and extended family members, up to the fourth degree of kinship.

5. FCC may use and disclose PHI under other circumstances without authorization.

FCC may use and/or disclose PHI in a number of circumstances in which the member’s consent or authorization are not required, and does not otherwise have an opportunity to agree or object. Those circumstances include:

• When the use and/or disclosure is required by law. For example, when a disclosure is required by federal, state or local law or other judicial or administrative proceeding.
• When the use and/or disclosure is necessary for public health activities. For example, FCC may disclose PHI if a member has been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.
• When the disclosure relates to victims of abuse, neglect or domestic violence.
• When the use and/or disclosure is for health oversight activities. For example, FCC may disclose PHI to a state or federal health oversight agency authorized by law to oversee FCC operations.
• When the disclosure is for judicial and administrative proceedings. For example, FCC may disclose PHI in response to an order of a court or administrative tribunal.
• When the disclosure is for law enforcement purposes. For example, FCC may disclose PHI in order to comply with laws that require the reporting of certain types of wounds or other physical injuries.
• When the use and/or disclosure relates to decedents. For example, FCC may disclose PHI to a coroner or medical examiner for the purposes of identification.
• When the use and/or disclosure relates to cadaveric organ, eye or tissue donation purposes.
• When the use and/or disclosure relates to medical research.
• When the use and/or disclosure is to avert a serious threat to health or safety.
• When the use and/or disclosure relates to specialized government functions. For example, FCC may disclose PHI if it relates to military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability or determinations of the Department of State.
• When the use and/or disclosure relates to correctional institutions and in other law enforcement custodial situations. For example, in certain circumstances, FCC may disclose PHI to a correctional institution having lawful custody of a member.

6. Members can object to certain uses and disclosures.

Unless a member sends a written objection, FCC may use or disclose PHI in the following circumstances:

• FCC may share with a family member, relative, friend or other specified person PHI directly related to that person’s involvement in the member’s care or payment for care.
• FCC may share with a public or private agency (for example, American Red Cross) PHI for disaster relief purposes. Even if the member objects, FCC may still share the PHI, if necessary under the emergency circumstances.

If a member would like to object to use or disclosure of PHI in the above circumstances, please call the FCC Privacy Officer listed on the first page of this Notice.

7. FCC may contact members with information about treatment, services, products or health care providers.

FCC may use and/or disclose PHI to manage or coordinate health care. This may include telling members about relevant treatments, services, products and/or other healthcare providers, based on PHI in FCC’s records.

EXAMPLE: If a member is diagnosed with diabetes, FCC may use that information to tell him/her about chronic care management services that may be beneficial.

** ANY OTHER USE OR DISCLOSURE OF PHI
REQUIRES WRITTEN AUTHORIZATION **

Under any circumstances other than those listed above, FCC will ask for a written authorization before it uses or discloses PHI. If a member signs a written authorization allowing FCC to disclose PHI in a specific situation, that authorization can be cancelled in writing. If an authorization is cancelled in writing, FCC will not disclose PHI after receiving the cancellation, except for disclosures which were being processed before the cancellation notice was received.

C. MEMBERS HAVE SEVERAL RIGHTS REGARDING THEIR PHI

1. Members have the right to request restrictions on uses and disclosures of PHI.

Members have the right to request that FCC restrict the use and disclosure of their PHI. The request must be made in writing and sent to the Privacy Officer at the address on the front of this Notice. However, if FCC agrees to a request, in certain situations restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described in subsection 4 of the previous section of this Notice. Also, effective as of February 17, 2010, FCC must agree to a member’s request to restrict disclosure of PHI for payment or health care operations if the member has paid the provider in full out-of-pocket. This restriction will not apply to disclosures of PHI for treatment purposes.

2. Members have the right to request that FCC communicate with them in certain ways.

Under certain circumstances, members have the right to request how and where FCC contacts them about PHI. For example, a member may request to be contacted at a work address or phone number or by email. The request must be in writing and clearly state that disclosure of all or part of that information could endanger the member. FCC must accommodate reasonable requests, but, when appropriate, may condition that accommodation on the member providing information regarding how payment, if any, will be handled and specification of an alternative address or other method of contact. Members may request alternative communications by sending a written request to the Privacy Officer at the address on the front of this Notice.

3. Members have the right to see and copy their PHI.

Members have the right to request to see and receive a copy of PHI contained in clinical, billing and other records used by FCC. The request must be in writing. FCC may charge fees for providing copies. Instead of providing a full copy of the PHI, FCC may give a summary or explanation of the PHI, if the member agrees in advance to the form and cost of the summary or explanation. There are certain situations in which FCC is not required to comply with a request. Under these circumstances, FCC will respond in writing, stating why it will not grant the request and describing any rights to request a review of the denial. A member may request to see and receive a copy of PHI by sending a written request to the Privacy Officer at the address on the front of this Notice.

Effective February 17, 2010, Members have the right to access electronically an electronic health record that contains the member’s PHI or to direct that a copy of the electronic health record be sent to a designated individual.

4. Members have the right to request amendment of their PHI.

Members have the right to request that FCC make amendments to clinical, billing and other records used to make decisions about the member. The request must be in writing and must explain the reason(s) for the amendment. FCC may deny the request if: 1) the information was not created by FCC (unless the member proves the creator of the information is no longer available to amend the record); 2) the information is not part of the records used to make decisions about the member; 3) FCC believes the information is correct and complete; or 4) the member would not have the right to see and copy the record as described in paragraph 3 above.

FCC will tell the member in writing the reasons for the denial and describe the rights to give a written statement disagreeing with the denial. If FCC accepts a request to amend the information, FCC will make reasonable efforts to inform others of the amendment, including persons the member names who have received PHI and who need the amendment. An amendment of PHI may be requested by sending a written request to the Privacy Officer at the address on the front of this Notice.

5. Members have the right to request a listing of certain disclosures FCC has made.

Members have the right to receive a written list of certain of disclosures of their PHI. Members may ask for disclosures made up to six (6) years before their request (not including disclosures made prior to April 14, 2003). FCC is required to provide a listing of all disclosures of PHI except those relating to the following:

• For treatment
• For payment for treatment
• For health care operations
• Made to or requested by the member, or that the member authorized
• Occurring as a by product of permitted uses and disclosures
• Made to individuals involved in the member’s care, for directory or notification purposes, or for other purposes described in subsection B.5 above
• Allowed by law when the use and/or disclosure relates to certain specialized government functions or relates to correctional institutions and in other law enforcement custodial situations (please see subsection B.4 above) and
• As part of a limited set of information which does not contain certain information which would identify the member.

The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the information, a brief description of the information disclosed, and the purpose of the disclosure. If, under permitted circumstances, PHI has been disclosed for certain types of research projects, the list may include different types of information.

If a member requests a list of disclosures more than once in 12 months, FCC can charge a reasonable fee. Members may request a listing of disclosures by sending a written request to the Privacy Officer at the address on the front of this Notice.

Please note that, effective February 17, 2010, members have a right to receive an accounting of electronic health record disclosures of PHI (including disclosures for purposes of payment, treatment, or health care operations), but only for a 3-year period prior to the date of the request. FCC may charge a fee for responding to a request.

6. Members have the right to receive notice of any breach of their unsecured PHI.

Beginning on or about September 1, 2010, FCC will be required to notify members of any breaches of unsecured PHI. Generally a breach is defined as unauthorized acquisition, access, use or disclosure of PHI which comprises the security or privacy of such information. Security and privacy are considered compromised when the disclosure poses a significant risk of financial, reputational or other harm to the member.

The notice of breach must be sent no later than 60 days from the date the breach was discovered. It must contain a description of the breach and types of unsecured PHI involved in the breach, protective measures the member should take, if any, to protect against losses and actions taken by FCC to investigate and mitigate any losses from the breach.

7. Members have the right to a copy of this Notice.

Members have the right to request a paper copy of this Notice at any time by sending a written request to the Privacy Officer. FCC will provide a copy of this Notice no later than the date coverage begins.

D. MEMBERS MAY FILE A COMPLAINT ABOUT FCC PRIVACY PRACTICES.

If a member thinks his/her privacy rights have been violated by FCC, or a member wants to make a complaint about FCC privacy practices, he/she may contact the person listed below:

Privacy Officer
FirstCarolinaCare Insurance Company
42 Memorial Drive
Pinehurst, North Carolina 28374
910-715-8100
ryoung@firstcarolinacare.com

Members also may file complaints with the federal Department of Health and Human Services Office for Civil Rights. For instructions on how to file a complaint, please go to http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html

If a complaint is filed, FCC will not take any action against or change its treatment of the member in any way.

E. EFFECTIVE DATE OF THIS NOTICE

This Notice of Privacy Practices was revised as of October 31, 2009.

APPENDIX A

NORTH CAROLINA STATE LAW AND OTHER ISSUES

Some North Carolina state laws provide more protection than the federal law under which this Notice is required. Where applicable, FCC will follow the requirements of those state laws. The following North Carolina laws may apply:

• North Carolina law protects the privacy of communications regarding mental health treatment between a patient and a therapist, psychologist or psychiatrist. Before disclosing certain mental health information to others for treatment, payment, or health care operations, FCC will request that the member sign a written form giving FCC permission to make the disclosure.

There are some exceptions to this requirement. FCC can disclose mental health information to members of its workforce, professional advisors and to agencies or individuals which help FCC carry out our responsibilities or which oversee operations, or individuals providing emergency medical services to members. FCC may also disclose information to other mental health facilities or professionals in order to coordinate care. If FCC believes that, based upon information provided to it, there is an immediate danger to the health, safety or welfare of the member or others, or that there is a reason to suspect abuse or neglect of a child or disabled adult, FCC may disclose personal information to protect such individual(s). FCC may disclose information that would be required in a court proceeding regarding a member’s mental health status, such as a commitment hearing. FCC may disclose mental health information to public health authorities if a member has a communicable disease and FCC has reason to believe, based upon information provided to it, that there is a public health risk, such as evidence of noncompliance with a treatment plan. FCC may provide information to a member’s next of kin, upon request, if the next of kin plays a legitimate role in the member’s therapy; but otherwise, only the fact of admission to or discharge from a mental health facility may be disclosed to the next of kin. In addition, FCC is required to provide access to personal information in situations in addition to those required under this Notice.

• Under North Carolina law, minors, with or without the consent of a parent or guardian, have the ability to consent to services for the prevention, diagnosis and treatment of certain illnesses including: venereal disease and other diseases that must be reported to the State; pregnancy; abuse of controlled substances or alcohol; and emotional disturbance. Abortion services, however, still require the consent of the parent, guardian or a grandparent with whom the minor has been living for at least six (6) months unless a court has determined that the minor should be treated as an adult. Minors may petition a court to waive this requirement for parental consent.
• If treatment and rehabilitation for drug dependence is requested, the request will be treated as confidential. FCC will not disclose a member name to any police officer or other law-enforcement officer unless the member consents to such disclosure. Even if FCC refers a member to another person for treatment and rehabilitation, FCC will continue to keep the member’s name confidential.
• If a member suffers from a communicable disease (for example, tuberculosis, syphilis or HIV/AIDS), information about the disease will be treated as confidential. Other than circumstances described in other sections of this Notice, FCC will not release any information about such diseases except as required to protect public health, to prevent the spread of a disease, or at the request of the State or Local Health Director.
• Federal laws generally require written consent before disclosing protected health information related to substance abuse services. There are some exceptions to this requirement. FCC can disclose substance abuse information within program to members of our workforce and to agencies or individuals which help FCC carry out our responsibilities, or individuals providing emergency medical services. FCC may also disclose information to other substance abuse facilities or professionals in order to coordinate care. If there is a reason, based upon information provided to FCC, to suspect abuse or neglect of a child, FCC may disclose member information to protect such individual(s). FCC may disclose information that would be required by a court order. FCC may disclose information to communicate with law enforcement personnel about a crime or threatened crime on the premises of a program or against program personnel.

 

© 2009 FirstCarolinaCare Insurance Company
Web Site Policy and Usage Agreement
Notice of Privacy Practices