Privacy Notice

This Notice Describes How Medical Information About You May Be Used and Disclosed and How You Can Get Access To This Information. Please Review It Carefully.

The C&O Employees’ Hospital Association (the "Plan") recognizes the importance of keeping your personal health information private. As of April 14, 2003, the Plan will comply with the health information privacy standards issued under the federal Health Information Portability and Accountability Act ("HIPAA"). HIPAA requires the Plan to provide this notice to you. This notice describes the Plan’s legal duties and its policies and procedures regarding your individual health information (referred to herein as "Protected Health Information" or "PHI").

HIPAA requires the Plan to follow the policies and procedures described in this notice. The Plan reserves the right to change its policies and procedures at any time, consistent with applicable law. Any such changes will apply to all Protected Health Information the Plan maintains and will be communicated to you through a separate mailing made to all Plan participants.

Treatment, Payment and Health Care Operations

The Plan is permitted by law to use and disclose your Protected Health Information without your prior authorization for purposes of treatment, payment, and health care operations under the Plan.

1. Treatment. The Plan may use or disclose your PHI to health care providers in coordinating or managing your health care and its related services. Health care providers include physicians, hospitals, and other health caregivers who provide services to you.

2. Payment. The Plan may use and disclose PHI submitted by you or your health care provider in making determinations concerning coverage or eligibility, such as when itemized medical bills are submitted to the Plan or its third party administrators for reimbursement. The submitted medical bills will usually include information that identifies you, as well as the services or procedures provided and supplies used. The Plan may, for example, use information from your health care provider to process your claim.

3. Health Care Operations. The Plan may use and disclose your Protected Health Information for plan administration purposes. The Plan may use your Protected Health Information to assess the quality of care and outcome of services provided to you and others like you in an effort to improve the quality of health care provided. Your information could be used, for example, to assist in the evaluation of one or more service providers who support the Plan. Other health care operation activities include responding to your questions, grievance or external review programs, disease management, case management, care coordination, detection and investigation of fraud, auditing, underwriting and ratemaking, and other general administrative activities.

Other Permitted Uses or Disclosures

In addition, HIPAA permits the Plan to use or disclose your Protected Health Information without your authorization, in certain circumstances including the following:

1. To the Plan’s Directors. The Plan may disclose PHI to the Plan’s Sponsor, the Board of Directors of the C and O Hospital Association, for purposes related to plan administration. The Plan Sponsor has amended its Plan documents to protect your PHI as required by federal law. Your information could be disclosed to the Board of Trustees, for example, to allow them to review an appeal of a benefit claim denial.

2. As Required by Law. The Plan may use or disclose your Protected Health Information to the extent that such use or disclosure is required by law and complies with and is limited to the relevant requirements of such law.

3. Public Health Activities. The Plan may disclose your Protected Health Information to (i) a public health authority authorized by law to receive information for the purposes of preventing or controlling disease, injury, or disability or to receive reports of child abuse or neglect; (ii) a person under the Food and Drug Administration’s jurisdiction for purposes related to the quality, safety, or effectiveness of a regulated product or activity; or (iii) to the extent authorized by law to notify a person who has or who is at risk of contracting or spreading a communicable disease.

4. Abuse, Neglect, and Domestic Violence. Except as described above, the Plan may disclose Protected Health Information about an individual it reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority (i) to the extent the disclosure is required by, complies with and is limited to the relevant requirements of law; (ii) if the individual agrees to the disclosure; or (iii) if the disclosure is authorized by law and (a) the Plan believes it is necessary to prevent harm to the individual or others or (b) the individual is unable to agree due to incapacity and a public official authorized to receive the information represents that the Protected Health Information is not intended to be used against the individual and that an immediate law enforcement activity would be materially and adversely affected by waiting until the individual is able to agree to the disclosure. If the Plan makes such a disclosure, it must promptly inform you that the disclosure has been or will be made, unless it believes doing so would put you at risk of harm.

5. Health Oversight Activities. The Plan may disclose your PHI to a health oversight agency for oversight activities authorized by law, unless you are the subject of the activity or investigation and the activity or investigation does not arise out of and is not directly related to the receipt of health care; a claim for public benefits related to health; or qualification for, or receipt of, public benefits or services when a patient’s health is integral to the claim for public benefits or services.

6. Judicial and Administrative Proceedings. The Plan may disclose your PHI (i) pursuant to a court or administrative tribunal order; or (ii) pursuant to a subpoena, discovery request, or other lawful process if the Plan (a) receives satisfactory assurance that you have been notified of the PHI request or (b) the Plan receives satisfactory assurance that reasonable efforts to obtain a qualified protective order (as defined under HIPAA) have been made.

7. To Law Enforcement Officials. The Plan may disclose your PHI (i) as required by law; (ii) pursuant to a court-ordered warrant to subpoena or summons issued by a judicial officer; (iii) pursuant to a grand jury subpoena; or (iv) pursuant to an administrative request, provided that the information sought is material and relevant to a legitimate law enforcement inquiry, the request is specific and limited in scope to the extent reasonably practicable under the circumstances, and de-identified information could not be used. Your name and address, date and place of birth, social security number, blood type and rh factor, type of injury, date and time of treatment, date and time of death, and distinguishing physical characteristics ("Identifying Information") may be disclosed in response to a law enforcement official’s request for the purpose of identifying or locating a fugitive, suspect, material witness, or missing person. Except as permitted by the preceding sentences, the Plan may disclose your PHI in response to a law enforcement official’s request for such information if you are or are suspected of being a crime victim if (i) you agree to the disclosure; or (ii) the Plan is unable to obtain your agreement due to your incapacity or emergency circumstances and the law enforcement official represents that (a) your PHI is necessary to determine whether a crime committed by someone other than you has occurred; (b) the disclosed PHI is not intended to be used against you; (c) an immediate law enforcement activity depends on the disclosure and would be materially and adversely affected by waiting until your agreement to the disclosure can be obtained, and (d) the Plan determines that the disclosure is in your best interest. The Plan also may disclose your PHI to a law enforcement official if you have died, for the purpose of alerting the law enforcement official of your death, if the Plan has a suspicion that your death resulted from criminal conduct.

8. To a Coroner or Medical Examiner or Funeral Director. The Plan may disclose your PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or other duties authorized by law. The Plan may disclose your PHI to a funeral director, consistent with applicable law, as necessary for the funeral director to carry out his or her duties. Such information may be provided in reasonable anticipation of your death.

9. For Organ, Eye or Tissue Donation Purposes. The Plan may use or disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

10. For Research Purposes. The Plan may use or disclose your PHI for research provided that certain requirements are satisfied, including (i) the approval by an "Institutional Review Board" under federal regulations or by a privacy board that meets the requirements of HIPAA and (ii) representations by the researcher that the PHI is necessary for the research.

11. To Avert a Serious Threat to Health or Safety. The Plan may, consistent with applicable law and ethical standards, use or disclose your PHI if the Plan, in good faith, believes doing so is necessary to prevent or lessen a serious imminent threat to the health or safety of a person or the public. The disclosure must be to a person reasonably able to prevent or lessen the threat including the target of the threat. The Plan also may use or disclose your Identifying Information (defined in (6), above) if it in good faith believes that doing so is necessary for law enforcement to identify or apprehend an individual (i) because of a statement by an individual admitting participating in a violent crime that the Plan reasonably believes may have caused serious physical harm to the victim, or (ii) because it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody. The Plan may not so disclose your Identifying Information, however, as a result of information learned in the course of treatment to affect the propensity to commit the criminal conduct in question or through your request to be referred for such treatment.

12. For Specialized Government Functions. If you are a member of the United States Armed Forces, the Plan may use and disclose your PHI for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, provided that the appropriate military authority has published by notice in the Federal Register the following information: (i) the appropriate military command authorities, and (ii) the purpose for which the PHI may be used or disclosed. Similar rules apply if you are a member of the armed forces of a foreign nation. Additionally, your PHI may be used and disclosed for purposes of national security and for the protection of the President of the United States or foreign heads of state under certain circumstances specified in the HIPAA health information privacy regulations.

13. For Workers’ Compensation Purposes. The Plan may disclose your PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

The Plan may disclose to one of your family members, a relative, a close personal friend or any other person identified by you, Protected Health Information that is directly relevant to the person's involvement with your care or payment related to your care. In addition, the Plan may use or disclose Protected Health Information to notify a member of your family, your personal representative, another person responsible for your care, or certain disaster relief agencies of your location, general condition, or death. You have the right to agree or object to such disclosures. If you are incapacitated, there is an emergency, or you are not present, the Plan will do what in its judgment is in your best interest regarding such disclosure and will disclose only the information that is directly relevant to the person's involvement with your health care.

The Plan may disclose information to its vendors who agree in writing to protect the privacy of your information.

Except for the situations described above, the Plan will not use and disclose your Protected Health Information, including psychotherapy notes, without your prior written authorization to release such information. In addition, use of protected health information for marketing purposes and disclosures of protected health information in a manner that constitutes a sale requires your authorization. You may also revoke your authorization at any time (except to the extent that the Plan has relied on your authorization) by submitting a written revocation to the person and address in the section below on "Contacting the Plan."

Right to Notification Following a Breach of Unsecured Protected Health Information

You will receive notifications from the Plan of breaches of your unsecured protected health information.

Minimum Necessary Rule

Generally, the Plan may only use or disclose the minimum protected health information necessary to accomplish the intended purpose of the use or disclosure. The minimum necessary requirement does not apply to uses and disclosures that are required by law, that are made to you, that are pursuant to an authorization initialed by you, disclosures to or requests by a health care provider for treatment purposes, uses or disclosures required for compliance with HIPAA’s administrative or simplification provisions, or disclosures to the Secretary of the Department of Health and Human Services for purposes of enforcing the HIPAA privacy rules.

Other Laws

The Plan also may be subject to state and local health information privacy laws that are more stringent than the HIPAA requirements.

Your Rights

You have the following rights with respect to your Protected Health Information:

1. Inspect and copy your Protected Health Information. You generally have the right to inspect and obtain a copy of your Protected Health Information in the Plan’s possession. Under limited circumstances, the Plan may deny your request. The Plan may charge you a reasonable fee if you wish to copy your Protected Health Information. You may exercise this right by contacting the individual or office identified at the end of this notice in "Contacting the Plan."

2. Request to correct your Protected Health Information. If you believe your Protected Health Information in the Plan’s possession is incorrect, you may request in writing to have the Plan correct the information. Under limited circumstances, the Plan may deny your request. You may exercise this right by contacting the individual or office identified at the end of this notice in "Contacting the Plan."

3. Request restrictions on certain uses and disclosures. You may ask the Plan to restrict uses and disclosures of your Protected Health Information to carry out treatment, payment, or health care operations, or to restrict uses and disclosures to family members, relatives, friends, or other persons identified by you who are involved in your care or payment for your care. The Plan reserves the right to refuse your request. You may exercise this right by contacting the individual or office identified at the end of this notice in "Contacting the Plan."

4. Accounting of certain confidential disclosures. You have the right to request a list of certain disclosures of your Protected Health Information that the Plan has made on or after April 14, 2003. The list will not include disclosures that were permitted to be made for treatment, payment or health care operation purposes or for national security, law enforcement or certain health care oversight activities, however. For that reason, your request for an accounting may be denied if the Plan has not made any disclosures for which an accounting is required.

5. Confidential communication to you of Protected Health Information. You have the right to request in writing that you receive your Protected Health Information by alternative means or at an alternative location if you reasonably believe that disclosure could pose a danger to you.

6. Obtain a paper copy of this notice. You have the right to receive a paper copy of this notice upon request, even if you agreed to receive the notice electronically.

If you believe that your privacy rights have been violated, you may complain to the Plan in writing at the location described below under "Contacting the Plan" or to the Secretary of the Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Avenue SW, Washington, DC 20201. You will not be retaliated against for filing a complaint.

Contacting the Plan

You may exercise the rights described in this notice by contacting: Privacy Official, C&O Employees’ Hospital Association, 427 E. Ridgway Street, Clifton Forge, Virginia 24422 (telephone: (800) 679-9135).

You have the right to receive a copy of the full annual report, or any part thereof, on request. The items listed below are included in that report:

1. An accountant’s report
2. Assets held for investment

To obtain a copy of the full annual report, or any part thereof, write C&O Employees Hospital Association, Attention Michelle Hoke, 427 E. Ridgway Street, Clifton Forge, VA 24422. Our phone number is (540) 862-5728 or 1-800-679-9135.

You also have the right to receive from the plan administrators (Michelle Hoke or Anna Brooks), on request, a statement of the assets and liabilities of the plan and accompanying notes, or a statement of income and expenses of the plan and accompanying notes, or both. If you request a copy of the full annual report from the plan administrator, these two statements and accompanying notes will be included as part of that report. A nominal fee to cover copying costs may be charged.

You also have the legally protected right to examine the annual report at the main office of the plan (C&O Employees Hospital Association, 427 E. Ridgway Street, Clifton Forge, VA 24422) and at the U.S. Department of Labor in Washington D.C., or to obtain a copy from the U.S. Department of Labor upon payment of copying costs. Requests to the Department should be addressed to: Public Disclosure Room, Room N1513, Employee Benefits Security Administration, U.S. Department of Labor, 200 Constitution Avenue, N.W., Washington D.C. 20210.