THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Hartford Life Insurance Company and Hartford Life and Accident Insurance Company (collectively “The Hartford” or “we”) are committed to protecting the privacy of your health information. The Hartford is required by a federal law - the Health Insurance Portability and Accountability Act (HIPAA) - to take reasonable steps to ensure the privacy of your “Protected Health Information” (PHI) and to provide you with this Notice of Privacy Practices. PHI includes all individually identifiable health information transmitted or maintained by The Hartford and/or its business associates regardless of form (oral, written, electronic).
This Notice applies to PHI obtained through the following coverages only: Senior Medical Insurance Plan, Group Retiree Insurance Plan and Medicare Supplement for Employer Groups, Tricare/CHAMPUS, Prescription Drug coverage, Association Medicare Supplement, Medical Conversion, Long-Term Care and other Medical Products only.
Effective Date: This Notice was originally effective April 14, 2003 and as revised is effective September 23, 2016.
Uses and Disclosures of Your PHI
This section of the Notice explains how The Hartford uses and discloses your PHI with our employees, business associates, and other organizations as required or permitted by law without your authorization. We also require our business associates to protect the privacy of your PHI through written agreements with The Hartford. As explained below, we will request your written authorization in some instances to use or disclose PHI. In the event applicable law, other than HIPAA, prohibits or materially limits our uses and disclosures of PHI as described herein, we will restrict our uses and disclosures of PHI in accordance with this more restrictive law.
Required Disclosures. The use and disclosure of your PHI may be required by the Secretary of the Department of Health and Human Services to investigate and/or determine The Hartford’s compliance with HIPAA’s privacy regulations.
Uses and Disclosures Related to Treatment, Payment and Healthcare Operations. The Hartford and/or its business associates may use and disclose PHI without your authorization or opportunity to agree or object for activities related to treatment, payment, and healthcare operations. In these instances, The Hartford will not request your authorization to share PHI. As described in the next section titled Your Privacy Rights, you have the right to request a restriction on the use and disclosure of your PHI for treatment, payment, or healthcare operations purposes. The Hartford may not use any PHI that is “genetic information” (as defined by the Genetic Information Nondiscrimination Act of 2008) for underwriting purposes. If we use or disclose your protected health information for fundraising activities, we will provide you the choice to opt out of those activities.
Examples of activities related to treatment include: treatment provided by a specialist who asks a primary care physician to share a patient’s PHI.
Examples of activities related to payment include: payment of healthcare claims, determinations whether a member is eligible for healthcare coverage, or collection of premiums.
Examples of activities related to healthcare operations include: quality improvement; fraud and abuse prevention and detection; case management and medical review; underwriting; and complaint resolution.
Uses and Disclosures of Your PHI That Do Not Require Your Authorization or Opportunity to Object. Your PHI may be disclosed without your authorization in the following circumstances: when required by law; public health activities; instances involving victims of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, as required or permitted by law; governmental health oversight activities (including audits, investigations, and inspections); judicial and administrative proceedings; certain law enforcement purposes; deceased persons to coroners, health examiners, and funeral directors; organ and tissue donation; certain government-approved research purposes; upon reasonable belief to avert a serious threat to health or safety; specialized government functions (such as military personnel, and inmates in correctional facilities); to individuals involved in your care or payment for your care; emergency treatment situations; disaster relief; or workers’ compensation.
Use and Disclosures to Plan Sponsor. In some circumstances, The Hartford may also disclose PHI to the sponsor of your group health plan for plan administration functions.
Use and Disclosure to Contact You Regarding Health-Related Benefits and Services. The Hartford or its business associates may also contact you regarding health-related benefits and services that may be of interest to you.
Uses and Disclosures That Require Your Written Authorization. In all other circumstances not described above, uses and disclosures of your PHI will only be made with your written authorization. For example, we will need your authorization for the following circumstances:
- most uses or disclosures of psychotherapy notes;
- marketing communications; and
- disclosures that constitute a sale of PHI.
You may revoke such an authorization at any time, except to the extent The Hartford, its business associates, or other entities have relied on such disclosure.
Your Privacy Rights
This section of the Notice describes your rights as an individual with respect to your PHI and a brief description of how you may exercise these rights.
Right to Restrict Uses and Disclosures for Treatment, Payment and Healthcare Operations Purposes. You have the right to request that we restrict uses and disclosure of your PHI for activities related to treatment, payment and healthcare operations as described above. Your request for the restriction must be in writing. We will evaluate all requests for restrictions, however, we are generally not required to agree to the restriction. In certain circumstances, we may be obligated to honor your request for a restriction on disclosures to another health plan relating to a health care item or service for which you paid in full. If we agree to the restriction, we will abide by it, except in the case of emergency treatment or when required by law. We will terminate our agreement to a restriction if you agree to or request the termination of the restriction. If we decide to terminate our agreement to the restriction, we will notify you of our decision.
If you have paid for a health care item or service out-of-pocket and in full, you may request that we do not disclose to a health plan any PHI related solely to the item or service. We are obligated to honor that request unless we are required by law to make a disclosure.
Right to Request Confidential Communications. You may request that we communicate with you by alternative means or at alternative locations. For example, you may wish to receive communications from us at your work location rather than your home. We will evaluate all such requests, however, we must only accommodate your request if you clearly state that the communication of all or part of your PHI could endanger you.
Right to Inspect and Copy Your PHI. You have a right to access, inspect, and copy your PHI contained in a “designated record set” for as long as The Hartford maintains the PHI in the designated record set. Your right to access your PHI contained in a designated record set extends to any such information that is maintained in an electronic health record or another electronic form. However, you do not have an automatic right to access psychotherapy notes or information compiled in reasonable anticipation of, or for use in, a criminal, civil or administrative action or proceeding. We will act on a request for access within 30 days of receiving your request if the information is maintained and accessible on site or within 60 days otherwise (with a possible 30-day extension). We will provide you with a summary of the PHI requested if you agree in advance to the summary and to the fees imposed.
We may deny your request to access your PHI under certain circumstances. If your request is denied, we will send you a notice that explains our reason for the denial, your review rights (if any), and how to file a complaint with our Privacy Officer or the Secretary of the Department of Health and Human Services. In certain instances we will provide you with an opportunity for a review of the denial. The review decision must be made in a reasonable period of time, and we will send you a written notice of the review decision. We may charge a reasonable fee for access, inspection and/or copying of your PHI. This fee is based on the costs associated with copying, mailing, and summary preparation costs.
Right to Amend Your PHI. You have the right to request that we amend your PHI if you believe the information is incorrect or inaccurate. We may deny your request to amend your PHI if we did not create the PHI, if the information is not part of our records, if the information was not available for inspection, or if the information is accurate and complete. We will respond to your written request to amend your PHI within 60 days of the request (with a possible 30-day extension).
If your request for amendment is granted, we will notify you that the amendment was approved. Upon your identification of relevant persons, we will obtain your agreement to inform them of the change. We will make reasonable efforts to inform and provide the amendment within a reasonable time to persons identified by you and by us, including our business associates.
If your request for the amendment is denied, we will send you a written notice that explains the reason for the denial, your right to submit a written statement of disagreement or to have the request for amendment included with future disclosures, and your right to file a complaint with our Privacy Officer and/or the Secretary of the Department of Health and Human Services.
We may prepare a rebuttal statement to your statement of disagreement. We will provide you with a copy of the rebuttal statement.
Any future disclosures of your PHI will include the statement of disagreement or request for amendment, the denial notice, and the rebuttal or summary of this information.
Right to an Accounting of Disclosures. You have the right to receive an accounting of disclosures of your PHI made by The Hartford during the six years prior to the date of your request. We will act on your request for an accounting of disclosures within 60 days (with a possible 30-day extension).
This accounting of disclosures will not include disclosures made: prior to effective date of HIPAA, April 14, 2003; for treatment, payment, and healthcare operations; to you or your personal representative; pursuant to an authorization; for national security or intelligence purposes, as provided in regulations under HIPAA; to correctional institutions or law enforcement officials, as provided in regulations under HIPAA; incident to a use or disclosure permitted or required by law; and to persons involved in your care (if you were present), you were incapacitated, or for disaster relief purposes.
We will provide you with one free accounting each year. For subsequent requests, we will charge a reasonable fee. The written accounting of disclosures will include the following information for each disclosure: the date of the disclosure, the person to whom the information was disclosed, a brief description of the information disclosed or in lieu of the summary, a copy of the written request for the disclosure.
Right to be Notified Following a Breach. You have a right to notified if there has been a breach involving your unsecured PHI.
Right to a Copy of Notice of Privacy Practices. You have the right to receive a paper copy of this Notice upon request, even if you agreed to receive the Notice electronically.
Complaints. You may file a complaint with The Hartford or the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated. To file a complaint with The Hartford, contact the Corporate Privacy Office at CorporatePrivacyOffice@thehartford.com. We will not retaliate against you for filing a complaint. If you have any questions about this Notice, or the subjects addressed in it including how to exercise your rights as set forth in this Notice, please contact the Corporate Privacy Office at the email address above or call us at: 860-547-5000.
The Hartford’s Duties
The Hartford will abide by the terms of this Notice of Privacy Practices.
The Hartford reserves the right to change its privacy practices and apply the changes to any PHI received or maintained by The Hartford prior to that date. If a privacy practice is materially changed, The Hartford will provide you with a revised Notice of Privacy Practices by mail or any other reasonable method of communication used to process or service your insurance or transactions with us.
The Hartford® is The Hartford Financial Services Group, Inc. and its subsidiaries.