Why am I receiving this notice?
The Christian and Missionary Alliance Health Plan (“the Plan”) is subject to the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”).

The privacy of your personal health information that is created, used, or disclosed by the Plan is protected by HIPAA. The Plan is required by law to:

• maintain the privacy of your protected health information (“PHI”);
  
• provide you with this Notice of the Plan’s legal duties and privacy practices with respect to your PHI; and abide by the terms of this Notice.

What is PHI?
PHI, or protected health information, is the identifiable health information about you created, received or maintained by the Plan, regardless of the form or medium of the information. It does not include employment records held by The Christian and Missionary Alliance in its role as employer (ie: the National Office (including International Ministries), C&MA district offices or local churches, or any agency, auxiliary organization, or institution officially related to the C&MA). How will the Plan use my PHI?
Under HIPAA, the Plan must disclose your PHI:

• to you or your legal representative when you ask for information;
  
• to the U.S. Department of Health and Human Services, if necessary, to make sure your privacy is protected; and where otherwise required by law.

The Plan, and the individuals who administer it, may use, receive or disclose your PHI for treatment, payment or health care operations without obtaining a written authorization from you. These activities cover a broad range of activities, including

• Treatment. The Plan may disclose protected health information to your providers for treatment, including the provision of care (diagnosis, cure, etc.) or the coordination or management of that care.
  
• Payment. The Plan may use and disclose your protected health information to pay benefits. Payment activities may include receiving claims or bills from your health care providers, processing payments, sending explanations of benefits (EOBs) to the plan member, reviewing the medical necessity of the services rendered, conducting claims appeals and coordinating the payment of benefits between multiple medical plans.
  
• Health Care Operations. The Plan may use and disclose your protected health information for plan operational purposes. For example, the Plan may use or disclose your protected health information for plan administration activities such as enrollment, verification to your doctors or hospitals that you are eligible for benefits under the plan, disease management programs and other plan-related activities, including audits of claims.

The Plan may also use and disclose your protected health information to provide information to you about disease management programs, treatment alternatives or other health-related benefits and services that may be of interest to you.

The Plan contracts with other businesses for certain plan administrative services, such as Highmark or CBSA, our third-party claims administrators. The Plan may release your health information to one or more of these “business associates” for plan administration if the business associate agrees in writing to protect the privacy of your information.

The Plan Sponsor of the C&MA Health Plan is the Christian and Missionary Alliance through the Benefit Board. Administration of the Plan is through the Office of Employee Benefits. Access to your protected health information within The Christian and Missionary Alliance, including the Benefit Board, will be limited to persons in The Office of Employee Benefits responsible for the Plan’s administration.

Unless you authorize the Plan otherwise in writing (or the individually identifying data is deleted from the information), your protected health information will be available only to the individuals who need the information to conduct these plan administration activities and the release of your PHI will be limited to the minimum disclosure required, unless otherwise permitted or required by law. Under what circumstances would my PHI be released for other than Plan administration?
The Plan is also permitted to use or disclose your protected health information, without obtaining a written authorization from you, in the following circumstances:

• For certain required public health activities (such as reporting disease outbreaks);
  
• To prevent serious harm to you or other potential victims, where abuse, neglect or domestic violence is involved;
  
• For health oversight agency for oversight activities authorized by law;
  
• In the course of any judicial or administrative proceeding in response to a court or administrative tribunal’s order, subpoena, discovery request or other lawful process;
  
• For a law enforcement purpose to a law enforcement official if certain legal conditions are met (such as providing limited information to locate a missing person);
  
• For research studies that meet all privacy law requirements (such as research related to the prevention of disease or disability);
  
• To avert a serious threat to the health or safety of you or any other person; and
  
• To the extent necessary to comply with laws and regulations related to workers’ compensation or similar programs.

Any other use or disclosure of your protected health information not identified within this Notice will be made only with your written authorization. Does my state privacy law also apply to PHI?
If your state laws provide more stringent privacy protections than HIPAA, the more stringent state law will still apply to protect your rights. If you have a question about your rights under any particular federal or state law, please contact the person identified below as the Privacy Contact. How do I authorize a release of my PHI?
You will need to complete a written authorization form. An authorization form is available from the Office of Employee Benefits by calling 800-700-2651, or e-mail benefits@cmalliance.org

You have the right to limit the type of information that you authorize the Plan to disclose and the persons to whom it should be disclosed. You may revoke your written authorization at any time, and the revocation will be followed to the extent action on the authorization has not yet been taken. What are my individual rights with respect to my PHI?
You have the right to:

• Request the Plan to restrict its uses and disclosures of your PHI. The Plan is not required to agree to a requested restriction. To request a restriction, please write to the Privacy Contact (identified at the end of this Notice) and provide specific information as to the disclosures that you wish to restrict and the reasons for your request. The Plan will respond in writing.
  
• Request that the Plan’s confidential communications of your PHI be sent to another location or by alternative communicative means. For example, you may ask that we send all explanation of benefits statements (EOBs) to your office rather than your home address. The Plan is not required to accommodate your request unless your request is reasonable and you state that the Plan’s ordinary communication process could endanger you.
  
• To inspect and obtain a copy of the PHI held by the Plan. However, access to psychotherapy notes, information compiled in reasonable anticipation of, or for use in legal proceedings and under certain other, relatively unusual, circumstances may be denied. Your request should be made in writing. A reasonable fee may be imposed for copying and mailing the requested information.
  
• Request that the Plan amend your protected health information or record if the information is incorrect or incomplete.
  
• Receive a list of those individuals or entities that have accessed your PHI for reasons other than for treatment, payment or Plan operations or that you have authorized in writing.
  
• Get a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

How do I make a complaint if I think my rights have been violated?
You may file a complaint with the Plans’ Privacy Contact and with the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated by any Plan. Their addresses are available under contact information below. All complaints must be filed in writing. You will not be retaliated against for filing a complaint. To whom should I address questions?
If you have any questions about this Notice, please contact the Privacy Contact:

Manager of the Office of Employee Benefits c/o C&MA Health Plan, Office of Employee Benefits
P.O. Box 35690
Colorado Springs, CO 80935-3569

E-mail: benefits@cmalliance.org
Phone: 800-700-2651 or
719-599-5999 x8102

How do I contact the federal government if I want to make a complaint or inquiry?
To contact the Secretary of Health and Human Services, write to:

U.S. Department of Health and Human
Services, Office of Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
(202) 619-0257 or
Toll free: 1-877-696-6775
Web: www.hhs.gov/contacts

What is the effective date of this notice?
The effective date of this Notice is April 14, 2003. Can The C&MA Health Plan make changes to this notice?
The Plan reserves the right to change the terms of this Notice and its information practices and to make the new provisions effective for all protected health information it maintains. Any amended Notice will be provided to you.