Vision Benefits of America
Notice of Privacy Practices

NOTICE

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

This Notice outlines the ways in which Vision Benefits of America (VBA) may use and disclose protected health information about you.  Protected health information (PHI) is health information that identifies a patient and relates to a patient’s mental or physical condition, medical treatment or payment for medical treatment.

We at VBA take great care to properly handle any personal health information about you and to maintain your privacy. This Notice is required by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).  This Notice describes how VBA protects the confidentiality of your health care information in our possession. Some examples of personal health information include your name, address, telephone and/or fax number, e-mail address, social security number or other identification number, date of birth, date of vision benefit services, enrollment and other claims records. VBA receives, uses and/or discloses your personal health information to administer your vision benefit plan as permitted or required by law.  Any other disclosure of your personal health information without your authorization is strictly prohibited.

VBA must follow the privacy practices described in this Notice and also comply with any more stringent requirements under federal or state law.  We are also required to notify affected individuals following a breach of unsecured health information. 

We will inform you of these privacy practices the first time you become a VBA member.  We must follow the privacy practices described in this Notice as long as it is in effect.  This Notice is effective as of September 1^st, 2016, and will remain in effect unless we replace it.  We reserve the right to change this Notice. We reserve the right to make the revised Notice effective for medical information we already have about you as well as any information we receive in the future.  Any change to this Notice will be posted on our website.  The revised Notice will contain its effective date on the first page.

You may request a copy of this Notice at any time.  You may contact VBA’s Privacy Department with any questions or concerns regarding our privacy policies.  For more information about our privacy practices, or for additional copies of this Notice, please contact us using the information at the end of this Notice. 

USE AND DISCLOSURE OF YOUR PROTECTED HEALTH INFORMATION

Disclosures required by HIPAA

1. Disclosures to the Secretary of the U.S. Department of Health and Human Services – We are required to disclose your protected health information to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy Rule
2. Disclosures to You – We are required to disclose to you most of your protected health information that is in a “designated record set” (defined by HIPAA Privacy Rule) when you request access to this information.  Generally, a designated record set contains medical and billing records, as well as other records that are used to make decisions about your vision care benefits. We are also required to provide, upon your request, an accounting of certain disclosures of your protected health information that are for reasons other than treatment, payment and health care operations.  

Permitted Uses and Disclosures

Under HIPAA, VBA is permitted to use and disclose your personal health information for certain purposes without your prior authorization. These permitted uses and disclosures include:

1. Disclosure to you; and
2. Disclosures for treatment, payment or health care operations.
   1. For example:
      1. Treatment - We may use and disclose your personal health information to determine eligibility for vision benefit services and/or materials or to coordinate vision benefit coverage. 
      2. Payment - We may use and disclose your personal health information to bill you or your plan sponsor.  
      3. Health Care Operations - We may use and disclose your personal health information to review the quality of care provided by our network providers. 

VBA uses administrative, technical and physical safeguards to maintain the privacy of your personal health information, and we are required by law to limit the use and disclosure of your personal health information to the minimum amount necessary.

Uses and Disclosures of Personal Health Information to Other Entities

VBA may disclose your personal health information to other covered entities, business associates or other individuals (as permitted by HIPAA) who assist us in administering our programs and delivering services to our members.  These parties are required by law to sign a contract with VBA agreeing to protect the confidentiality of your personal health information.

1. Business Associates – In connection with our payment and health care operations activities, we contract with individuals and entities (called “business associates”) to perform various functions on our behalf or to provide certain types of services.  To perform these services, business associates will receive, create, maintain, use or disclose protected health information, but only after we require the business associates to agree in writing to contract terms designed to appropriately safeguard your information. 
2. Plan Sponsors – If your vision benefit program is sponsored by your employer or another party, VBA may disclose your personal health information in certain instances to permit the plan sponsor to perform plan administration functions.   We will make such disclosures to the plan sponsor only if the plan sponsor has certified that it has put into place plan provisions requiring the sponsor to keep the health information protected.  We may also disclose “summary health information” (defined in the HIPAA Privacy Rule) about the enrollees in your group health plan to the plan sponsor.  For example, a plan sponsor may contact us regarding members’ questions or concerns regarding claims, benefits, services, coverage, etc.  The plan sponsor may use this information to obtain premium bids for the health insurance coverage offered through your group health plan or to decide whether to modify, amend or terminate your group health plan. 

Health Care Providers - VBA may disclose your personal health information to participating vision care providers. These providers are required to implement their own privacy policies and procedures that comply with applicable federal and state laws.

Other Permitted Disclosures of Personal Health Information

Under HIPAA, VBA is permitted to use and disclose your personal health information without your prior authorization under the following conditions:

• When required by law;
• For public health activities;
• Disclosures about victims of abuse, neglect or domestic violence;
• Health oversight activities;
• Judicial and administrative proceedings (e.g. in response to court order or subpoena);
• Law enforcement, organ donation or research purposes;
• Uses and disclosures about decedents;
• To avert a serious threat to health or safety;
• For specialized government functions (e.g. military and veterans’ activities);
• Regarding workers’ compensation;
• For underwriting purposes; however, we are prohibited from using or disclosing your genetic information for these purposes.  

Uses and Disclosures Requiring You to Have an Opportunity to Agree or Object

Unless you object, VBA may disclose your protected health information to a family member, close friend or other person you have identified as being involved in your health care.  We also may disclose your information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.  If you are not present or able to agree to these disclosures of your protected health information, then we may, using our professional judgment, determine whether the disclosure is in your best interest. 

Uses Requiring Your Written Authorization

We are required to obtain your written authorization for use or disclosure of your health personal health information in the following instances:

1. Use or disclosure of your PHI for marketing purposes;
2. If we intend to sell your PHI; and
3. Most uses and disclosures of psychotherapy notes. 

OTHER USES OF PERSONAL HEALTH INFORMATION

Other uses and disclosures of personal health information not described above will be made only with your written authorization.  If you provide us with such written authorization, you may revoke that authorization in writing at any time, and this revocation will be effective for future uses and disclosures of personal health information.  However, the revocation will not be effective for information that we already have used or disclosed in reliance on the authorization. 

YOUR INDIVIDUAL RIGHTS

The following is a description of your rights with respect to your Protected Health Information.

Right to Inspect and Copy. You have the right to inspect and obtain a copy of your PHI. You may access your PHI by submitting your request in writing to the privacy contact listed at the end of this Notice. You must include (1) your name, address, telephone number and identification number and (2) a description of the PHI you are requesting. VBA may charge a reasonable fee for providing you copies of your PHI.  VBA only maintains the PHI that it obtains or utilizes in providing your vision care benefits.

Right to Request Restrictions. You have the right to request a restriction on the PHI we use or disclose about you for treatment, payment or health care operations.  We will consider your request but are not legally required to accept it. If VBA accepts your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and/or disclosures that VBA is legally required or allowed to make.

Right to Amend. You have the right to correct or update your PHI. This means that you may request an amendment of your PHI for as long as VBA maintains this information. In certain cases, VBA may deny your request for amendment. If so, you have the right to file a statement of disagreement with VBA. VBA may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. If your PHI was sent to VBA by another entity, we may refer you to that entity to amend your PHI (i.e., if applicable, to your employer to amend your enrollment information). Please contact VBA as noted below if you have questions about amending your PHI.

Right to Request Confidential Communications. You have the right to request or receive confidential communications from VBA by alternative means or at a different address. VBA will agree to accommodate a reasonable request if disclosure of your PHI through standard means of communication could endanger you. You may be required to provide VBA with a written statement of possible danger, a different address or another method of contact or information as to how payment will be handled.

Right to an Accounting of Disclosures. You have the right to receive an accounting of certain disclosures VBA has made of your PHI. This right does not apply to disclosures for purposes of treatment, payment or health care operations.  Your request may be for disclosures made up to six (6) years before the date of your request, but in no event for disclosures made before April 14, 2003. Please contact VBA if you would like to receive an accounting of disclosures or if you have questions about this right.

Right to a Paper Copy of this Notice. You have the right to receive a paper copy of this Notice. Even if you have agreed to receive this Notice via e-mail, you are still entitled to a paper copy.  To obtain a paper copy of this Notice, please contact VBA per the information at the end of this Notice. 

COMPLAINTS

If you believe that any of your privacy rights have been violated, you may file a complaint with VBA.  Contact our Privacy Department which will provide you with a form for your complaint, or you may obtain the complaint form from our website at www.vbaplans.com.  You may complain to VBA by submitting the complaint form to us in writing, at the address or fax number provided at the end of this Notice. 

If you believe any of your privacy rights have been violated, you may also submit a written complaint to the Secretary of the U.S. Department of Health and Human Services at the following address:

U.S. Department of Health & Human Services

200 Independence Avenue, S.W.

Room 509F – HHH Building

Washington, D.C. 20201

Attention: Centralized Case Management Operations

(800) 368-1019

TTD number (800) 537-7697

More information about submitting a complaint to the U.S. Department of Health & Human Services is available at the following website:  http://www.hhs.gov/ocr/privacy.

You may also file a written complaint to VBA using the procedure listed in this section in response to a denial by us regarding any of your individual rights listed in this Notice.  For example, if you disagree with a decision we made about access to your PHI or in response to a request you made to amend or restrict the use or disclosure of your PHI.

We support your right to protect the privacy of your protected health information.  You will not be retaliated against in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

CONTACT INFORMATION

For questions about this Notice of Privacy Practices, or if you wish to file a complaint, please contact:

Telephone:                  (412) 881-4900

                                   (800) 432-4966 (toll free)

Fax:                             (412) 881-4898