HIPAA Privacy Policy

NOTICE OF PRIVACY PRACTICES
FOR
PIPELINE INDUSTRY BENEFIT FUND
HEALTH BENEFIT WELFARE FUND

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date of this Notice: September 23, 2013
This Notice of Privacy Practices (Notice) describes the Plan’s privacy practices and legal obligations and your legal rights regarding your protected health information (PHI) held by the Plan, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)and the Health Information Technology for Economic and Clinical Health Act (HITECH). Among other things, this Notice describes how your PHI may be used or disclosed to carry out treatment, payment or health care operations, or for any other purposes that are permitted or required by law.
The HIPAA Privacy Rule protects only certain medical information known as “protected health information” or “PHI”. Generally, PHI is health information, including demographic information, that is collected from you or created or received by the Plan in any form (oral, written, or electronic), from which it is possible to individually identify you. In addition, it must relate to your past, present, or future health or condition (physical or mental); to providing health care to you; or to paying for your health care (may be past, present, or future payment).

If you have questions about this Notice or our privacy practices or need a form to exercise your individual rights, please contact the Privacy Officer for the Plan as follows:
Fund Director, P.O. Box 470950, Tulsa, OK 74147-0950, (918) 280-4800

OUR RESPONSIBILITIES
We are required by law to do the following with regard to your PHI:

(1) maintain its privacy;

(2) notify you if we discover a breach of unsecured PHI;

(3) provide you with certain rights;

(4) provide you with a Notice of our legal duties and privacy practices; and

(5) follow the terms of the Notice that is currently in effect.
The Plan has the right to change its privacy practices and the terms of this Notice for all PHI that it maintains. If we make a material change to this Notice, we will provide you with a revised Notice. The Fund will prominently post this Notice on the Plan’s website by the effective date of the material change and provide a hard copy in the next regular mailing.

HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

By law we may use or disclose your PHI under the circumstances described below, without your authorization or opportunity to object. For each category, we explain what we mean and give an example. Not every use or disclosure within a category is listed, but every way that we may use and disclose PHI falls within one of the categories listed.

For Your Health Care Treatment:

“Treatment” means providing, coordinating, managing or facilitating your health care treatment and services. For example, the Plan may disclose PHI to your physician related to your treatment.

For Payment:

“Payment” means actions taken to ensure that your health care treatment and services are properly billed and paid under the terms of the Plan. It may also include actions related to coverage determinations, coordination of benefits, claims management, subrogation, reimbursement, collections, obtaining payment under reinsurance, medical necessity reviews, and utilization review. For example, the Plan determines if an employee has worked enough hours in covered employment to be eligible for benefits, and may confirm coverage with a hospital in connection with billing and payment for an employee’s inpatient stay.

For Health Care Operations:

“Health care operations” mean the Plan’s business operations and activities that are related to its functioning as a health plan and provision of health benefits to you. They include conducting quality assessment and improvement activities, coordinating or managing care, evaluating health care provider and plan performance, insurance activities related to obtaining, renewing, and replacing health insurance or reinsurance contracts, conducting or arranging for medical review, legal services, and auditing functions (such as fraud and abuse detection and compliance programs), business planning and development, business management and general administrative activities. The Plan may not use your genetic information for underwriting purposes. For example, the Plan may share PHI with its consultants to project future benefit costs.

Treatment Alternatives or Health-Related Benefits and Services:

Your PHI may be used and disclosed in connection with communications to you about treatment alternatives or health-related benefits and services that might be of interest to you (provided no direct or indirect payment is received by the Plan in exchange for the communication).

To Business Associates:

“Business associates” are persons or entities that provide services or perform functions involving PHI on the Plan’s behalf, such as actuarial, accounting, legal, consulting or third-party administrative services. Before disclosing PHI to a business associate, the Plan will require the business associate to sign a written agreement that obligates the business associate to implement appropriate privacy and security safeguards to protect PHI. For example, we may disclose PHI to the Plan’s legal counsel to handle a subrogation matter, but only after the Plan and legal counsel have entered into a business associate agreement.

To Plan Sponsor:

The Board of Trustees is the “Plan Sponsor”. The Plan permits the disclosure of PHI to Trustees and Fund Office employees as needed to perform administrative functions on the Plan’s behalf, and requires them to protect the privacy and security of all PHI that is received. Your PHI cannot be used for employment purposes without your specific written authorization.

To Family Members or Others:

The Plan may disclose to your family member, a close friend, or other person identified by you, PHI that is directly related to his or her involvement with your health care or its payment, subject to the following conditions. If you are present or available before the disclosure, you must either agree to the disclosure, or be given an opportunity to object to the disclosure and not object, or the Plan must reasonably infer from the circumstances that you do not object to the disclosure. If you are not present, or the opportunity to agree or object is not possible because of your incapacity or emergency circumstances, the Plan may disclose such PHI if it determines that disclosure is in your best interest.

As Required by Law:

We will disclose your PHI when required to do so by federal, state, or local law.
To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI if it is necessary to prevent a serious threat to the health and safety of you or another person.

Other Uses and Disclosures Which May Be Made Without Your Authorization or Opportunity to Object:
Organ and Tissue Donation – to organizations handling organ, eye, or tissue procurement or transplantation to facilitate the donation and transplantation, if you are an organ donor.

Military – to military command authorities as required, if you are a member of the military.

Workers’ Compensation – to workers’ compensation or similar programs providing benefits for work-related injuries or illness, as necessary to comply with applicable law.

Public Health Risks – for the following public health activities:
-To prevent or control disease, injury, or disability;
-To report births and deaths;
-To report child abuse or neglect;
-To report reactions to medications or problems with products;
-To notify people of recalls of products they may be using;
-To notify a person who may have been exposed to, or is at risk of contracting or spreading, a
disease;
-To notify the appropriate government authority if you are believed to be a victim of abuse,
neglect or domestic violence, when required or authorized by law.
Health Oversight Activities and Disaster Relief – to a disaster relief organization to assist with disaster relief efforts, consistent with what the U.S. Department of Health and Human Services (HHS) has indicated is permissible, or to a health oversight agency for activities authorized by law (such as audits, investigations, inspections and licensure).
Lawsuits and Disputes – in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful processes, but only if efforts have been made to tell you about the request or to obtain a court or administrative order protecting the information requested.

Law Enforcement – if asked to do so by a law enforcement official:
– In response to a court order, subpoena, warrant, summons, or similar process;
– To identify or locate a suspect, fugitive, material witness, or missing person;
– About a crime victim if we are unable to obtain the victim’s consent;
– About a death that we believe may be the result of criminal conduct; and
– About criminal conduct.
Coroners, Medical Examiners, and Funeral Directors – to a coroner or medical examiner to identify a deceased person or determine the cause of death, or to a funeral director as necessary to carry out his duties.
National Security and Intelligence Activities – to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Inmates – to correctional institutions or law enforcement officials if necessary to provide health care to inmates, to protect the health and safety of inmates, or for safety and security.
Research – to researchers when the individual identifiers have been removed, or an institutional review board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of the requested information and approves the research.
Government Audits -to the Secretary of HHS, upon request, for an investigation related to the Plan’s HIPAA compliance.

Other Disclosures:
Disclosures to You or Your Personal Representative – We are required to disclose to you, upon request, the portion of your PHI that contains medical records, billing records, and other records used to make decisions about your Plan’s health care benefits. We will also disclose PHI to individuals authorized by you, or designated as your personal representative or attorney-in-fact, so long as you provide us with sufficient written notice and authorization (such as a power of attorney for health care purposes or court order). A parent usually acts as the personal representative of an unemancipated minor child, unless otherwise provided by state law or court order. However, we do not have to disclose information to your personal representative if we reasonably believe that (1) you have been or may be subjected to domestic violence, abuse, or neglect by such person, or (2) treating such person as your personal representative could endanger you, and (3) in the exercise of professional judgment, it is not in your best interest to do so.
Disclosures to Covered Spouses and Dependents – Written explanation of benefits (EOBs), for covered spouses and Dependent children age 18 or older, will be mailed to the spouse or Dependent child unless he or she provides other written instructions to the Plan.
Uses and Disclosures of PHI Requiring Your Written Authorizations – Uses and disclosures of PHI that are not described above will only be made with your written authorization. For example, if you ask a local business agent for help with a claim, we will not disclose your PHI to the business agent without your authorization. With limited exceptions permitted under HIPAA,

We will not do the following without your written authorization:
(1) use or disclose your psychotherapy notes if you are receiving treatment for a mental illness;

(2) use or disclose your PHI for marketing (except for face-to-face communications between you and the Plan, or promotional gifts of nominal value provided by the Plan); or

(3) sell your PHI.
Authorizations must be acceptable to the Plan and state what PHI may be disclosed, who may receive it, when it expires, affirm your right to revoke it in writing at any time and, if applicable, describe any remuneration the Plan will receive. You are entitled to receive a copy of any authorization form that you sign. Written revocations will be effective only for future uses and disclosures, and not for information used or disclosed by the Plan before it receives your written revocation.

YOUR INDIVIDUAL RIGHTS WITH RESPECT TO PHI
You have the following rights with respect to your PHI. In order to exercise any of these rights, you must do so in writing on a form that is acceptable to the Plan and sent to the Privacy Officer at the address listed on page one. Forms are available from the Fund Office upon request.
Right to Inspect and Copy: You may inspect and copy certain PHI held by or for the Plan, that may be used to make decisions about your medical benefits under the Plan. If the requested information is maintained electronically and you request an electronic copy, it will be provided in the electronic form and format requested if it can be readily produced in that form and format. Otherwise, we will work with you to come to an agreement on form and format. If we cannot agree, we will provide you with a paper copy.
If you request a copy, we may charge a reasonable fee for the cost of copying, mailing, or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances permitted under HIPAA. If you are denied access to your medical information, we will give you a written explanation of the reasons for denial, your review rights, and how to file a complaint with the Plan or HHS.
Right to Amend: If you feel that the PHI about you is incorrect or incomplete, you may ask the Plan to amend the information for as long as it is kept by or for the Plan. We may deny your request if:
It is not in writing or does not include a reason to support the request;
-The information was not created by us unless whoever created it is no longer available to amend it;
-The information is not part of the medical information kept by or for the Plan;
-The information is not part of the information you would be permitted to inspect or copy; or
-The information is already accurate and complete.
If approved, we will notify you and use reasonable efforts to notify any persons you identify as needing the amended information. If denied, we will give written notice of:

(1) the reasons for denial;

(2) your right to file a statement of disagreement with us to include with any future disclosures of the disputed information;

(3) if you do not file a statement, your right to ask that your request to amend and our denial be provided with any future disclosures of the disputed information; and

(4) how to file a complaint with the Plan or HHS.

Right to Accounting of Disclosures:

You may request an “accounting” of certain disclosures of your PHI. You must state the time period for which it is requested (which may not be longer than six years before the date of the request). You should indicate the form in which you want to receive it (e.g., paper or electronic).

The accounting will include only the information required by HIPAA and presently does not have to include disclosures:

(1) for purposes of treatment, payment, or health care operations;

(2) to you or based on your authorization;

(3) to a family member, friend, or other person identified by you who is involved in your health care or its payment;

(4) for national security or intelligence purposes;

(5) to correctional institutions or law enforcement officials; or

(6) that is incidental to otherwise permissible disclosures.
The first list you request within a 12-month period will be provided free of charge. For additional lists provided within a 12-month period, we may charge you a reasonable cost-based fee. We will notify you of the cost in advance, and you may withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions:

You may ask the Plan to restrict or limit PHI that it uses or discloses for treatment, payment or health care operations, or discloses to someone who is involved in your health care or its payment. We do not have to agree to your request. If we agree, we will honor the restriction until you revoke it or we notify you.
To request restrictions, you must tell us

(1) what information you want to limit;

(2) whether you want to limit our use, disclosure, or both; and

(3) to whom you want the limits to apply (e.g., disclosures to your spouse).

You may terminate a restriction at any time, either orally or in writing, by notice to the Plan’s Privacy Officer.

Right to Request Confidential Communications:

If you believe that disclosure of your PHI by the normal means could endanger you, you may ask the Plan to communicate with you by a different means or at a different location. Your request must specify how or where you wish to be contacted. For example, you may ask that PHI be sent to an address other than your home address. We will accommodate your request if reasonable.

Right to be Notified of a Breach:

You have the right to be notified in the event that we (or a Business Associate) discover a breach of your unsecured PHI, as required by applicable law.

Right to Receive Paper Copy of Notice:

You have the right to obtain a paper copy of this Notice at any time by written request to the Plan’s Privacy Officer. You may also obtain a copy of this notice at our website: https://pibf.org/go/h-and-w-benefits

COMPLAINTS
If you believe that your privacy rights have been violated, you may file a complaint with the Plan by contacting the Privacy Officer (see page one for contact information). You may also submit a complaint with the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services. The address for the regional OCR for Arkansas, Louisiana, New Mexico, Oklahoma, and Texas is Office for Civil Rights, U.S. Department of Health & Human Services, 1301 Young Street, Suite 1169, Dallas, TX 75202. Complaints must be in writing by mail, fax, or email at the proper address. You will not be penalized or in any other way retaliated against for filing a complaint with us or HHS.