AultCare/Aultra Insurance Plans—Notice of Privacy Practices Your Information. Your Rights. Our Responsibilities.

Introduction

AultCare Insurance Company (dba AultCare HMO), which is part of an Organized Health Care Arrangement with AultCare Corporation, AultCare Health Insuring Corporation dba PrimeTime Health Plan, and Aultra Administrative Group (AultCare or We) is a Group Health Plan Covered Entity under HIPAA.

We’re committed to safeguarding the Privacy and Security of Protected Health Information of its enrollees and their eligible dependents (you) in paper (PHI) or electronic form (ePHI).

This NPP describes our HIPAA-compliant policies and procedures for the Use and Disclosure of your PHI/ePHI, including the use of PHI/ePHI for eligibility, enrollment, underwriting, claims processing, coordination of benefits, and payment of treatment under your group health plan in compliance with HIPAA’s Privacy and Security Rules (updated by the Omnibus Rule of 2013), the HITECH Act, and the Genetic Information Nondiscrimination Act (GINA).

You may access this NPP on our website www.aultcare.com. If you do not have a computer or internet access, or if you want a paper copy of this NPP, please call our Service Center at 330-363-6360 or 1-800-344-8858  (TTY:711).

Not every use or disclosure of PHI, with or without a signed Authorization, is listed in this NPP. Uses or disclosures not specified in this NPP often require Authorization. Please contact our Privacy Officer if you have a question, concern, or need further guidance.

Terms

Accounting. An Accounting is a list of disclosures of your PHI/ePHI we have made.

Authorization. An Authorization is a document signed and dated by the individual who authorizes the use or disclosure of PHI/ePHI for purposes other than treatment, payment, or healthcare operations.

Business Associates. We contract with outside business associates that may access, use, or disclose PHI/ePHI to perform covered services for us. Examples include auditing, accounting, accreditation, actuarial services, and legal services. Business associates must protect the privacy and security of your PHI/ePHI to the same extent we do. If a business associate delegates services to a subcontractor or agent, that subcontractor or agent also is a business associate that must comply with HIPAA.

Covered Entities. Covered entities include healthcare providers (e.g. hospitals, doctors, nurses, nursing homes, home health agencies, durable medical equipment suppliers, other healthcare professionals, and suppliers), and group health plans. AultCare is a group health plan-covered entity.

Designated Record Set. A designated record set is a group of records containing PHI in paper or electronic form that we created and store. A designated record set include medical, healthcare and service records, billing, claims and payment information, eligibility and enrollment information, and other information we use to make decisions regarding the coverage and payment of medical care under your plan. Records created by others are not part of a designated record set.

Disclose. Disclose means our releasing, transferring, providing access to, or divulging PHI/ePHI to a third party, including covered entities and their business associates: (1) for treatment, payment, and healthcare operations; or (2) when you permit us by your signed authorization; or (3) as required by law.

Genetic Information. Genetic information includes genetic testing of the individual or family members.

Health Plan. Health plan means an individual or group health plan that provides, or pays the cost of, medical care and includes a health insurance issuer, HMO, Part A or B of Medicare, Medicaid, voluntary prescription drug benefit program, issuer of Medicare supplemental policy, issuer or a long-term care policy, employee welfare benefit plan, plan for uniformed services, veterans healthcare program, CHAMPUS, Indian health service program, federal employee health benefits program, Medicare Advantage plan, approved state child health plan, high-risk pool, and any other individual or group health plans or combination that provides or pays for the cost of medical care. AultCare is a group health plan.

Healthcare Operations. Healthcare operations include quality assurance, performance improvement, utilization review, accreditation, licensing, legal compliance, provider/supplier credentialing, peer review, business management, auditing, enrollment, underwriting, stop-loss/reinsurance, and other functions related to your health plan, as well as offering and providing preventive, wellness, case management, and related services.

Individual. Individual means the enrollee or eligible dependent (including minors) to whom PHI belongs. It also applies to your family member or personal representative acting on your behalf.

Minimum Necessary. We will limit the use or disclosure of your PHI/ePHI to the minimum needed to accomplish the intended purpose of the use, disclosure, or request.

Payment. Payment means the activities by a group health plan to obtain premiums or to determine or fulfill its responsibility for coverage and the provisions of benefits under your plan and includes eligibility or coverage determination, coordination of benefits, adjudication and subrogation of health benefit claims, billing, claims management, EOBs, healthcare data processing, reinsurance (including stop-loss and excess), determination of medical necessity, utilization review (including pre-certification and retrospective review), and related activities.

Personal Representative. Personal Representative means a person acting on behalf of the individual, including family, spouse, guardian, attorney-in-fact under a durable or general power of attorney, or friend assisting the individual with healthcare and payment decisions.

Protected Health Information (PHI/ePHI). PHI/ePHI means individually identifiable medical and health information regarding your medical condition, treatment of your medical condition, and payment of your medical condition, and includes oral, written, and electronically generated and stored information. PHI/ePHI excludes de-identified information or health information regarding a person who has been deceased for more than 50 years.

Treatment. Treatment means the provision, coordination, and management of healthcare and services by one or more health care providers, including referrals and consultations between providers or suppliers.

Use. Use means our accessing, sharing, employing, applying, utilizing, examining, or analyzing your PHI/ePHI within the AultCare organization for payment and healthcare operation purposes. Your PHI/ePHI is accessible only to members of AultCare’s workforce who have been trained in HIPAA Privacy and have signed a confidentiality agreement that limits their access and use of PHI/ePHI, according to the minimum necessary standard, to perform the authorized purpose.

Wellness Program. Wellness Program means a program that an employer has adopted to promote health and disease prevention, which is offered to employees as part of an employer-sponsored group health plan or separately as a benefit of employment.

Your Rights

When it comes to your health information, you have certain rights. This section explains some of your rights and our responsibilities.

You may get a copy or summary of your health and claims records:

•  You may ask to see or get a copy of your health and claims records and PHI kept in a designated record set. Please call Customer Service to ask how to do this. There are some restrictions.
• We will get you a paper copy or electronic version of your health and claims records, or give you a summary, usually within 30 days of your request. We may charge reasonable, cost-based fees.

You may ask us to correct your health and claims records:

• You may ask us in writing to correct your health and claims records in a designated record set if you believe they are incorrect, inaccurate, or incomplete. Please call Customer Service or visit our website to get an amendment request form.
• We may say “no” to your request, but we’ll tell you why in writing within 60 days.
• You will have an opportunity to appeal.

You may request confidential communications by alternative means:

• You may ask us to contact you about claims, premiums, EOBs, or other matters about your health plan and coverage in a specific way, such as home phone, office phone, or cell phone, or by alternate means, such as an address different from your home or usual email address.
• Let us know if you do not want us to leave any voice mail messages.
• Contact Customer Service to request. We will consider all reasonable requests.

You may ask us to limit (restrict) what we use or disclose:

• You may ask us in writing not to use or disclose certain health information for treatment, payment, or operations. We may honor your request if you pay for treatment in full out-of-pocket.
• Please call Customer Service for a restriction request form or visit our website.
• While we will consider reasonable requests, we are not required to agree to your request. We may say “no” if restricting information could affect your care or if disclosure is required by law.

You may request a list (“Accounting”) of those to whom we’ve disclosed PHI/ePHI:

• You may ask in writing for a list of disclosures of your PHI/ePHI (Accounting) for the six years prior to your request.
• We will include all disclosures except for those about treatment, payment, and healthcare operations, and disclosures made to you or you authorized us to make. We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

You may get a copy of this NPP:

You may ask for a paper copy of this NPP at any time, even if you have agreed to receive this NPP electronically. We will provide you with a paper copy promptly.

You may access electronic copy of this NPP on our website at any time.

You may choose someone to act for you:

• You may choose a family member or personal representative to receive PHI/ePHI from us, exercise your rights, and make choices for you.
• We will use reasonable efforts to confirm that the person is authorized to act on your behalf before we take any action. You may file a complaint if you believe your rights have been violated.
• If you believe your privacy or your HIPAA rights have been violated, we urge you to contact our privacy officer, either by calling Customer Service or filing a written complaint at AultCare, P.O. Box 6029, Canton, OH 44706.
• We take all complaints very seriously. We will investigate and take appropriate action if needed.
• You also may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696- 6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/
• We will never retaliate against you for filing a complaint, asking a question, or expressing a concern.

Communicating with you

This section describes how we may communicate with you, family members, or your personal representative.

Communicating with You:

We may communicate with you about claims, premiums, or other things regarding your health plan.

Communicating with Family or Others Involved In Your Care:

• We may disclose your PHI/ePHI to designated family, friends, guardians, persons named in a durable or general power of attorney, personal representatives, or others assisting in your care or payment of claims.

Minors and Emancipated Minors:

• We may disclose a minor’s PHI/ePHI to the minor’s parent(s) or guardian, unless there are legal or policy reasons not to.
• We will not disclose PHI/ePHI to the parent(s) or guardian of an emancipated minor. A minor is emancipated if he/she: (1) does not live with his/her parent(s); (2) is not covered by parental health insurance; (3) is financially independent of parent(s); (4) is married; (5) has children; or (6) is in the military.

Deceased Enrollees:

• If you die, we may disclose your PHI to the executor or administrator of your estate.
• We may disclose PHI/ePHI to your spouse, family, personal representative, or others who were involved in your care or management of your affairs, unless doing so would be inconsistent with your wishes made known to us.

Uses and Disclosures

This section describes how we typically use or disclose your PHI/ePHI with and without Authorization.

No Authorization Needed:

• We will create, receive, or access your PHI/ePHI, which we may use or disclose to other covered entities for treatment, payment, and healthcare operations, without the need for you to sign an Authorization.
• We will disclose PHI/ePHI needed to treat or authorize treatment. For example, a doctor or health facility involved in your care may request your PHI/ePHI to make treatment decisions covered by the plan.
• We will use or disclose your PHI needed for payment. For example, we will use information about your medical procedures and treatment to process and pay claims, to determine whether services are medically necessary, and to pre-authorize or certify services covered by your health plan.
• We may disclose PHI/ePHI to governmental or commercial health plans that may be obligated under coordination of benefit rules to process and pay your claims.
• We will use and disclose your PHI/ePHI as necessary or required by law to administer your plan and for our healthcare operations. For example, we may use or disclose PHI/ePHI for underwriting purposes. We will not use or disclose genetic information for underwriting purposes.
• We may disclose PHI/ePHI to business associates to perform covered services. It is not necessary for you to sign an Authorization for us to share PHI/ePHI with our business associates for covered services.
• We will use PHI/ePHI gathered from our online enrollment tools to complete certain applications for enrollment. The use of these tools is voluntary and alternate methods of enrollment may be available should you choose not to provide all of the requested information needed to complete the online enrollment.

Authorization Needed:

We will not use or disclose your PHI/ePHI for any purpose other than treatment, payment, or healthcare operations without your signed HIPAA-compliant Authorization, unless required by law.

• We will not disclose psychotherapy notes without a signed Authorization unless required by law.
• We will not disclose your PHI/ePHI to your employer without your signed Authorization. We may disclose PHI/ePHI to the plan sponsor of your health benefit plan on condition that the plan sponsor certifies that it will maintain the confidentiality of PHI/ePHI and will not use PHI to make employment-related decisions or employee benefit determinations.
• We will not release medical records if subpoenaed, unless you sign an Authorization, or the lawyers sign a qualified protective order, or if we receive a valid court or administrative order.

You may choose to receive information about health-related products or services or fundraising:

• We may use your PHI/ePHI if we believe you may be interested in, or benefit from, treatment alternatives, wellness, preventive, disease management, or health-related programs, products or services that may be available to you as an enrollee or eligible beneficiary under your health plan. For example, we may use your PHI/ePHI to identify whether you have a particular illness, and contact you to let you know about a disease management program is available to help manage your illness.
• Let us know if you do not want to be contacted or receive information about these services and programs. Opting out will not affect coverage or services.
• We will not sell or disclose your PHI/ePHI to third-parties for marketing without your Authorization, which will indicate whether we are paid for selling PHI.
• We may contact you about charitable fundraising. If you do not want to be contacted or receive fundraising materials, let Customer Service know. Opting out will not affect coverage or services.

Wellness Programs:

• If you voluntarily choose to participate in a Wellness Program, you may be asked to answer questions on a Health Risk Assessment (HRA) and/or undergo biometric screenings for risk factors.
• Wellness Programs may also provide educational health-related information or services that may include nutrition classes, weight loss and smoking cessation programs, onsite exercise facilities, and/or health coaching to help employees meet their health goals.
• If your employer has entered or may enter into a contract with us to perform services, as well as receive, collect, use, disclose, and store data in connection with a Wellness Program. We will protect the privacy of your PHI.

Use and Disclosure of Health Information Permitted or Required by Law

We may use or disclose PHI/ePHI, without your Authorization, as required by law, including, but not limited to:

• Workers’ Compensation
• Public health agencies
• FDA and OSHA
• Ohio Department of Insurance and other regulatory and licensing agencies
• Armed Forces to assist in notifying family members of your location, general condition, or death
• Law Enforcement
• Homeland security
• Emergency and disaster
• Prevent threat of serious harm
• Proof of immunization

Breach Notification

• You have the right to notification if a breach of your PHI/ePHI occurs. We will promptly notify you by firstclass mail, at your last known address, or by email (if you prefer) if we discover a breach of unsecured PHI/ePHI, which includes the unauthorized acquisition, access, use, or disclosure of your PHI/ePHI, unless we determine through a risk analysis that a low probability exists that the compromise of your PHI would cause you financial, reputational, or other harm.
• We will include in the breach notification a brief description of what happened, a description of the types of unsecured PHI involved, steps you should take to protect yourself from potential harm, a brief description of what we are doing to investigate the breach and mitigate any potential harm, as well as contact information for you to ask questions and learn additional information.

Changes to this NPP

This section describes how and when we make changes and how we will inform you of any material changes.

• We reserve the right to change this NPP at any time, which we may make effective for PHI/ePHI we already used or disclosed, and for any PHI/ePHI we may create, receive, use, or disclose in the future.
• We will make material amendments based on changes in the HIPAA laws.
• The revised NPP will be posted on our website www.aultcare.com. Copies of revised NPPs will be mailed to all enrollees covered by the plan, and copies may be obtained by mailing a request to: Privacy Coordinator, P.O. Box 6029, Canton, Ohio 44706.

If you have questions or need further assistance regarding this NPP, you may contact the Customer Service at 330-363-6360 or 1-800-344-8858. If you are hearing impaired and have access to a TTY phone, you may reach us at our TTY line 711. Our Customer Service hours are from 7:30 a.m. to 5:00 p.m., Monday-Friday.

Review Date: October 1, 2021

AultCare/Aultra General Tag Lines for the State of Ohio

English

If you, or someone you are helping, have questions about AultCare/Aultra you have the right to get help and information in your language at no cost. To speak with an interpreter, call Local: 330.363.6360 Outside Stark County: 1.800.344.8858 TTY 711

Spanish

Español

Si usted, o alguien a quien usted está ayudando, tiene preguntas acerca AultCare/Aultra tiene derecho a obtener ayuda e información en su idioma sin costo alguno. Para hablar con un intérprete, llame al Local : 330.363.6360 Fuera del condado de Stark : 1.800.344.8858 TTY 711

Chinese

中文

如果您，或是您正在協助的對象，有關於AultCare/Aultra保险公司 方面的問題，您有權利免費以您的母語 得到幫助和訊息。洽詢一位翻譯員，請撥電話 本地： 330.363.6360 斯塔克縣外： 1.800.344.8858 TTY 711。

German

Deutsche

Falls Sie oder jemand, dem Sie helfen, Fragen zum AultCare/Aultra haben, haben Sie das Recht, kostenlose Hilfe und Informationen in Ihrer Sprache zu erhalten. Um mit einem Dolmetscher zu sprechen, rufen Sie bitte die Nummer Local: 330.363.6360 Außerhalb von Stark County : 1.800.344.8858  TTY 711

Arabic

العربیة العربیة، لدیك الحق في الحصول على المساعدة والمعلومات الضروریة بلغتك من دون ایة تكلفة. للتحدث مع مترجم اتصل ب Aultra/AultCare إن كان لدیك أو لدى شخص تساعده أسئلة بخصوص شركة التأمین 1.800.344.8858 : ستارك مقاطعة خارج TTY 711 

Pennsylvania Dutch

Deitsch

Wann du hoscht en Froog, odder ebber, wu du helfscht, hot en Froog baut AultCare/Aultra hoscht du es Recht fer Hilf un Information in deinre eegne Schprooch griege, un die Hilf koschtet nix. Wann du mit me Interpreter schwetze witt, kannscht du Local: 330.363.6360 Außerhalb von Stark County: 1.800.344.8858 TTY 711

Russian

русский

Если у вас или лица, которому вы помогаете, имеются вопросы по поводу Страховая компания AultCare/Aultra, то вы имеете право на бесплатное получение помощи и информации на вашем языке. Для разговора с переводчиком позвоните по телефону Местный: 330.363.6360 Вне Старка County : 1.800.344.8858 TTY 711

French

Français

Si vous, ou quelqu'un que vous êtes en train d’aider, a des questions à propos de Compagnie d'Assurance AultCare/Aultra, vous avez le droit d'obtenir de l'aide et l'information dans votre langue à aucun coût. Pour parler à un interprète, Appelez Locale 330.363.6360 En dehors du comté de Stark : 1.800.344.8858 ligne ATS 711

Vietnamese

Việt Nam

Nếu quý vị, hay người mà quý vị đang giúp đỡ, có câu hỏi về Công ty Bảo hiểm AultCare/Aultra quý vị sẽ có quyền được giúp và có thêm thông tin bằng ngôn ngữ của mình miễn phí. Để nói chuyện với một thông dịch viên, xin gọi Địa phương: 330.363.6360 Bên ngoài của Stark County : 1.800.344.8858 TTY 711

Cushite-Oromo

Isin yookan namni biraa isin deeggartan AultCare/Aultra, irratti gaaffii yo qabaattan, kaffaltii irraa bilisa haala ta’een afaan keessaniin odeeffannoo argachuu fi deeggarsa argachuuf mirga ni qabdu. Nama isiniif ibsu argachuuf, lakkoofsa bilbilaa Local: 330.363.6360 Outside of Stark County: 1.800.344.8858 TTY 711

Korean

한국어

만약 귀하 또는 귀하가 돕고 있는 어떤 사람이AultCare/Aultra 보험 회사 에 관해서 질문이 있다면 귀하는 그러한 도움과 정보를 귀하의 언어로 비용 부담없이 얻을 수 있는 권리가 있습니다. 그렇게 통역사와 얘기하기 위해서는 지역 : 330.363.6360 스타크 카운티 의 외부 : 1.800.344.8858 TTY 711

로 전화하십시오.

Italian

Italiano

Se tu o qualcuno che stai aiutando avete domande su AultCare/Aultra, hai il diritto di ottenere aiuto e informazioni nella tua lingua gratuitamente. Per parlare con un interprete, puoi chiamare Locale: 330.363.6360 Al di fuori di Stark County : 1.800.344.8858 TTY 711

Japanese

日本語

ご本人様、またはお客様の身の回りの方でもAultCare/Aultra保険会社についてご質問がございました ら、ご希望の言語でサポートを受けたり、情報を入手したりすることができます。料金はかかりませ ん。通訳とお話される場合、 ローカル： 330.363.6360 スターク郡の外： 1.800.344.8858 TTY 711

Dutch

Nederlands

Als u, of iemand die u helpt, vragen heeft over AultCare/Aultra, heeft u het recht om hulp en informatie te krijgen in uw taal zonder kosten. Om te praten met een tolk, bel Local : 330.363.6360 Buiten Stark County : 1.800.344.8858 TTY 711

Ukrainian

український

Якщо у Вас чи у когось, хто отримує Вашу допомогу, виникають питання про Страхова компанія AultCare/Aultra, у Вас є право отримати безкоштовну допомогу та інформацію на Вашій рідній мові. Щоб зв’язатись з перекладачем, задзвоніть на Місцевий : 330.363.6360 Поза Старка County : 1.800.344.8858 TTY 711

Romanian

Română

Dacă dumneavoastră sau persoana pe care o asistați aveți întrebări privind Compania de Asigurari AultCare/Aultra, aveți dreptul de a obține gratuit ajutor și informații în limba dumneavoastră. Pentru a vorbi cu un interpret, sunați la Locale : 330.363.6360 In afara Stark Judet : 1.800.344.8858 TTY 711

Non-Discrimination Notice:

AultCare/Aultra complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex. AultCare/Aultra does not exclude people or treat them differently because of race, color, national origin, age, disability, or sex. AultCare/Aultra provides free aids and services to people with disabilities to communicate effectively with us, such as: Qualified sign language interpreters and written information in other formats (large print, audio, accessible electronic formats, other formats). AultCare/Aultra provides free language services to people whose primary language is not English, such as: Qualified interpreters and information written in other languages.

If you need these services, or if you believe that AultCare/Aultra has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, or sex, you can contact or file a grievance with the: AultCare/Aultra Civil Rights Coordinator, 2600 6th St. S.W. Canton, OH 44710, 330-363-7456, CivilRightsCoordinator@aultcare.com.

You can file a grievance in person or by mail, fax, or email. If you need help filing a grievance, our Civil Rights staff is available to help you.

You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights electronically through the Office for Civil Rights Complaint Portal, available at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at: U.S. Department of Health and Human Services 200 Independence Avenue, SW Room 509F, HHH Building Washington, D.C. 20201

1-800-368-1019, 800-537-7697 (TDD).

Complaint forms are available at http://www.hhs.gov/ocr/office/file/index.html.