Policy on Privacy Requirements for Protection and Use of Member PHI/PH - Changes

This notice is being sent to advise our strategic alliance partners and their agents of the pertinent revisions made to Federal Legislation 45 CFR Parts 160 and 164 of HIPAA, HITECH, Privacy and Confidentiality effective September 23, 2013.This communication outlines only three of the updated 2013 requirements. It includes changes made to:

1.  Restrictions of disclosures to health plans
2. Right to access PHI in an electronic format
3. Prohibition on the sale of PHI

Restrictions of Disclosure to Health Plans 
Individuals may ask their provider to not disclose PHI (claims, prescriptions, and/or medical records) to a health insurer by choosing instead to pay for the services or drugs themselves without involving the insurer. This means the provider or pharmacist is prohibited from sending the claim or prescription to the carrier.    Important: When the member pays for services in full and requests that PHI related to the service rendered not be disclosed to the health plan (insurer), it is the responsibility of the health care provider or pharmacy to comply with this privacy request. When paid in full and requested by the member, the provider is not to submit a claim or disclose any PHI related to that service to the insurer.

Members who choose to pay the service in full may pay by either cash, credit card or use of an FSA or HSA account. When the member chooses to pay the health care provider or pharmacy in full at the time service is rendered, the payment is being made without involving the patient's health plan and without benefit of insurer negotiated (contracted) rates. In this case, the member can attempt to negotiate their own discount with the provider prior to or at the time the service is rendered.

Should the member approach you about information that was sent to Humana in error, agents should inform the member of the following:

• The provider, not Humana, was responsible to guarantee the claim or prescription was not sent to Humana.
• Complaints are to be directed to the provider who submitted the information to Humana in error. The patient should refer to the Provider's Notice of Privacy Practices and contact the provider's privacy office or officer.

Right to Access PHI in an Electronic Format 
This requirement addresses changes made to Federal Legislation 45 CFR Parts 160 and 164 of HIPAA, HITECH, Privacy and Confidentiality effective September 23, 2013. It states that Humana must comply with a member request for copies of PHI (claims and records) which Humana has on record for that member. Humana is required to provide that information in the format requested by the member (i.e., PDF format, Word format). If Humana does not have the capability to supply the PHI in the format requested, alternative options can be discussed and used if the member is agreeable.

If the PHI requested is maintained in an electronic designated record set and the member requests an electronic copy of such information, the information must be provided in the electronic form and format requested by the individual, if it is readily producible in such form and format. If the form or format requested by the individual cannot be produced the information must be provided in such form that can be agreed to by both the entity and the individual. For example, if the patient asks for a copy of their medical records in a PDF file and the facility does not have that capability, they may discuss with the patient and agree on providing the information in a "Word" file format instead.

Timeframes for responding to requests for Access to PHI in electronic format are unchanged. Information should be provided timely and not to exceed 30 days. An individual can request that their PHI be directed to another person. These requests must be made in writing, signed by the individual and clearly identify the designated person to receive the information and where to send the copy of PHI. Agents should have members complete a Consent for Release of Protected Health Information form to document the authorization of release to another party and send it to the address or fax number on the form. Signed requests should be retained by Humana for 6 years. Members also have the right to terminate previously granted permission for Humana to release or disclose a member's protected health information by filling out a Revocation of Consent for Release of Protected Health Information form.

If a member specifically requests unsecure mailing, the member must be informed of the risk. If the member still wants the information sent in an unsecure manner the insurer is required to send it in that manner requested by the member. Agent's default processes for communicating PHI pursuant to an access request should always be in a secure manner.     Prohibitions on the Sales of PHI 
This requirement addresses changes made to Federal Legislation 45 CFR Parts 160 and 164 of HIPAA, HITECH, Privacy and Confidentiality effective September 23, 2013. It states that Humana must obtain written permission from the member or patient prior to using or disclosing PHI for marketing purposes. Additional guidance pertaining to when written permission must be received from the member will be disclosed in the near future.

Please contact your national account manager if you have any questions.