HIPAA & Notice of Privacy Practices

We are required by law to keep protected health information private. We must notify individuals of our legal duties and privacy practices with respect to protected health information. We must also notify affected individuals following a breach of unsecured protected health information. This notice describes how your health information may be used or shared and how you can get access to this information. Please review it carefully.

ArrayRx and the ArrayRx Discount Card Program are administered by Moda Health Plan, Inc.

At Moda Health we respect the privacy of your protected health information. We will keep it confidential in a responsible and professional manner. Protected health information includes any information about your healthcare that can identify you as the person who receives the healthcare services. We are required by law to provide you with this notice and abide by its terms.

This notice explains how we gather and use information about you and when we can share this information with others. It also describes your rights as our valued customer and how you can exercise these rights.

How we collect and protect information

We collect information from forms when you apply or enroll. Examples of information gathered are: member name, address, Social Security number, general health status information, employment, and other information needed for coverage. We also collect information from healthcare coverage transactions with Moda Health and our affiliates. This includes information such as claims, service authorization requests, deductible payments and copayments. Most information we collect is in writing. We may also gather information in person, by telephone or electronically.

We keep your information secure through physical, technical and procedural safeguards. All information collected is treated in a confidential and secure manner whether you are a prospective, current, or former customer.

How we use or share information

We use protected health information in our business operations. We may also share it with others to assist in your treatment or payment for your treatment.

• Paying bills: We will use the information to pay your healthcare bills that have been submitted to us by dentists, doctors, hospitals and others.
• Providing care: We may share your information with healthcare professionals to help them provide medical and dental care to you. For example, we may send medical information about you to a specialist as part of a referral.
• Managing care: We may use or share your information with others to help manage your healthcare. For example, we may talk to your doctor to suggest a disease management or wellness program that could help improve your health.

Providing healthcare information where it’s needed

We may use information about you for the following reasons:

• To share alternative medical treatments and programs, or health-related products and services you may be interested in. For example, we sometimes send newsletters to let you know about healthy living alternatives, such as smoking cessation or weight loss programs.
• For underwriting or other activities relating to issuing a contract for healthcare coverage. Please note that legally we may not use or disclose genetic information for underwriting purposes.

We may share your information for the following reasons:

• With a family member or friend as needed to help with your healthcare or with payment for your healthcare. For example, you may not be able to authorize care or payment due to a medical emergency.
• With authorized private or public entities to help with disaster relief.
• With other people or companies who perform business functions for us. For example, we may share your information with a company that does data entry for us.
• With the sponsor, agent or consultant of your employee benefit plan. This permits them to perform plan administration functions.

Protecting your personal healthcare information

Additional types of disclosures:

We will not use or disclose your protected health information unless we are allowed or required by law to do so. We may make additional types of disclosures to:

• State and federal agencies that regulate us. (For example, the U.S. Department of Health and Human Services and the State Insurance Department.)
• Authorized public health agencies. For example, we may report problems with a prescription drug to the Food and Drug Administration.
• Appropriate authorities, if we believe you are a victim of child abuse or neglect, domestic violence or other crimes.
• The appropriate agencies, if we believe there is a serious health or safety threat to you or others.
• Health oversight agencies for activities authorized by law. This includes audits, criminal investigations, licensure or disciplinary actions.
• Law enforcement agencies for identification and location of a suspect, fugitive, material witness, crime victim or missing person.
• A court or administrative agency in response to a search warrant, subpoena or other lawful process.
• Coroners, medical examiners and organ procurement entities, and for research in limited cases.
• Military authorities and authorized federal officials for intelligence, counterintelligence, and other national security activities.
• Comply with laws relating to workers’ compensation or other similar programs.
• Public or private entities authorized by law to help with disaster relief efforts.

Where your authorization is required

You must authorize the use or disclosure of your information, except when allowed or required by law. Examples of when your authorization is required include but are not limited to:

• Most uses and disclosures of psychotherapy notes.
• Uses and disclosures of your protected health information for marketing purposes.
• Disclosures that would mean the sale of your protected health information.

Know your rights

Your rights include the right to:

• Request that we not use or disclose your protected health information for treatment, payment or healthcare operations, or to persons involved in your care. Exceptions include when authorized by you, when required by law or in an emergency. The request must be made in writing. While we will consider your request, we are not required to agree to these restrictions.
• Request that your protected health information be shared with you in a confidential manner. For example, you may ask us to send mail to an address other than your home. The request must be made in writing.
• In most cases, receive a copy of protected health information records that we use to make decisions about your care. The request must be made in writing. We may charge a reasonable fee for copying and postage.
• Request that we amend your records. You may inform us if you believe that some of your protected health information is incorrect or missing. Your request must be in writing and include the basis for your request. We may deny your request if the information was not created by us, if it is not maintained by us, or if we determine that the record is accurate.
• Be notified of a breach of your unsecured protected health information.
• Receive an accounting of certain ways we disclosed your information during the six years prior to your request. The accounting will not include disclosures that were made:
  • For treatment, payment and healthcare operations purposes
  • To you
  • Incidental to a use or disclosure otherwise permitted
  • Following your authorization
  • To persons involved in your care
  • For national security or intelligence purposes
  • To correctional institutions or law enforcement agencies
  • As part of a limited data set for research, public health or healthcare operations purposes; and
  • Prior to April 14, 2003

We will provide one accounting, upon request, every 12 months at no charge. We may charge a fee for an additional accounting within 12 months. We will inform you in advance of the fee and allow you to withdraw or modify your request.

Exercising your rights

• You have a right to receive a paper copy of this notice upon request at any time. Visit modahealth.com to access this notice.
• If you have any questions about this notice or about how we use or disclose information, please contact the Moda Health Privacy Office at 855-425-4192, or by email at privacy@modahealth.com.
• If you believe your privacy rights have been violated, you may send a complaint to:
  Moda Health
  Attn: Privacy Office
  601 SW Second Ave.
  Portland, OR 97204
• You may also file a written complaint with the Department of Health and Human Services (HHS), Office of Civil Rights. Visit www.hhs.gov/ocr to find the contact information. You may also contact our office for more specific information.
• We will not take any action against you for filing a complaint

Changes to our notice

This notice is effective on August 1, 2013. We reserve the right to change the terms of this notice and to make the new notice effective for all protected health information we maintain. If revised, we will notify you that a change has been made by mailing you a new Notice of Privacy Practices. The new notice will also be available online at modahealth.com.