Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Document Index:

Our Responsibilities

Uses and Disclosures of Protected Health Information

Individual Rights

Questions and Complaints

Contact Information

Our Responsibilities

The Illinois Comprehensive Health Insurance Plan (CHIP) is required by applicable federal and state law to maintain the privacy of your protected health information. “Protected health information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your PHI. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect April 14, 2003, and will remain in effect until we replace it.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all PHI that we maintain, including PHI we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and make the new notice available upon request.

For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Uses and Disclosures of Protected Health Information

We use and disclose PHI about you for treatment, payment, and health care operations. Following are examples of the types of uses and disclosures that we are permitted to make.

Treatment:  We may use or disclose your PHI to a physician or other health care provider providing treatment to you. We may use or disclose your PHI to a health care provider so that we can make prior authorization decisions under your benefit plan.

Payment:  We may use and disclose your PHI to make benefit payments for the health care services provided to you. We may disclose your PHI to another health plan, to a health care provider, or other entity subject to the federal Privacy Rules for their payment purposes. Payment activities may include processing claims, determining eligibility or coverage for claims, issuing premium billings, reviewing services for medical necessity, and performing utilization review of claims.

Health Care Operations: We may use and disclose your PHI in connection with our health care operations. Health care operations include the business functions conducted by CHIP. These activities may include providing participant services, responding to complaints and appeals from participants, providing case management and care coordination under the benefit plans, conducting medical review of claims and other quality assessment and improvement activities, establishing premium rates, underwriting and eligibility criteria. We may also in our health care operations disclose PHI to business associates [1] with whom we have written agreements containing terms to protect the privacy of your PHI.

We may disclose your PHI to another entity that is subject to the federal Privacy Rules and that has a relationship with you for its health care operations relating to quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, case management and care coordination, or detecting or preventing health care fraud and abuse.

On Your Authorization: You may give us written authorization to use your PHI or to disclose it to another person and for the purpose you designate.  If you give us an authorization, you may withdraw it in writing at any time.  Your withdrawal will not affect any use or disclosures permitted by your authorization while it was in effect.  Unless you give us a written authorization, we cannot use or disclose your PHI for any reason except those described in this notice or required by law.

We will make disclosures of any psychotherapy notes we may have only if you provide us with a specific written authorization or when disclosure is required by law.

Personal Representatives: We will disclose your PHI to your personal representative when the personal representative has been properly designated by you and the existence of your personal representative is documented to us in writing through a written authorization.

Disaster Relief:; We may use or disclose your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.

Health Related Services: We may use your PHI to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you. We may disclose your PHI to a business associate to assist us in these activities.

Public Benefit: We may use or disclose your PHI as authorized by law for the following purposes deemed to be in the public interest or benefit:

• as required by law;
• for public health activities, including disease and vital statistic reporting, child abuse reporting, certain Food and Drug Administration (FDA) oversight purposes with respect to an FDA-regulated product or activity, and to employers regarding work-related illness or injury required under the Occupational Safety and Health Act (OSHA) or other similar laws;
• to another government agency that is administering a government program providing public benefits if that government agency serves the same or similar populations and the disclosure of PHI is necessary to coordinate the covered functions of such programs;
• to report adult abuse, neglect, or domestic violence;
• to health oversight agencies;
• in response to court and administrative orders and other lawful processes;
• to law enforcement officials pursuant to subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on our premises, reporting crimes in emergencies, and for purposes of identifying or locating a suspect or other person;
• to avert a serious threat to health or safety;
• to the military and to federal officials for lawful intelligence, counterintelligence, and national security activities;
• to correctional institutions regarding inmates; and
• as authorized by and to the extent necessary to comply with state worker’s compensation laws.

We will make disclosures for the following public interest purposes, only if you provide us with a written authorization or when disclosure is required by law: 

• to coroners, medical examiners, and funeral directors;
• to an organ procurement organization; and
• in connection with certain research activities.

Use and Disclosure of Certain Types of Medical Information: For certain types of PHI we may be required to protect your privacy in ways more strict than we have discussed in this notice. We must abide by the following rules for our use or disclosure of certain types of your PHI:

• HIV Test Information.  We may not disclose the result of any HIV test or that you have been the subject of an HIV test unless required by law or the disclosure is to you or other persons under limited circumstances or you have given us written permission to disclose.

• Genetic Information.  We may not disclose your genetic information unless the disclosure is made as required by law or you provide us with written permission to disclose such information.
• Mental Health Information Records. We may not disclose your mental health information records except to you and anyone else authorized by law to inspect and copy your mental health information records or you provide us with written permission to disclose.
• Alcoholism or Drug Abuse Information.  We may not disclose any alcoholism or drug abuse information related to your treatment in an alcohol or drug abuse program unless the disclosure is allowed or required by law or you provide us with written permission to disclose.

Individual Rights

You may contact us using the information at the end of this notice to obtain the forms described here, explanations on how to submit a request, or other additional information.

Access:  You have the right, with limited exceptions, to look at or get copies of your PHI contained in a designated record set. A “designated record set” contains records we maintain such as enrollment, claims processing, and case management records. You may request that we provide copies in a format other than photocopies. We will use the format you request unless we cannot practicably do so. You must make a request in writing to obtain access to your PHI and may obtain a request form from us. If we deny your request, we will provide you a written explanation and will tell you if the reasons for the denial can be reviewed and how to ask for such a review or if the denial cannot be reviewed.

Disclosure Accounting:  You have the right to receive a list of instances since April 14, 2003 in which we or our business associates disclosed your PHI for purposes, other than treatment, payment, health care operations, or as authorized by you, and for certain other activities. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests. We will provide you with more information on our fee structure at your request.

Restriction:  You have the right to request that we place additional restrictions on our use or disclosure of your PHI. We are not required to agree to these additional restrictions, but if we do, we will abide by our agreement (except in an emergency).

Any agreement we may make to a request for additional restrictions must be in writing signed by a person authorized to make such an agreement on our behalf. We will not be bound unless our agreement is in writing.

Confidential Communication:  You have the right to request that we communicate with you about your PHI by alternative means or to alternative locations. You must make your request in writing. This right only applies if the information could endanger you if it is not communicated by the alternative means or to the alternative location you want. You do not have to explain the basis for your request, but you must state that the information could endanger you if the communication means or location is not changed. We must accommodate your request if it is reasonable, specifies the alternative means or location, and provides satisfactory explanation how payments will be handled under the alternative means or location you request.

Amendment:  You have the right, with limited exceptions, to request that we amend your PHI. Your request must be in writing, and it must explain why the information should be amended. We may deny your request if we did not create the information you want amended and the originator remains available or for certain other reasons. If we deny your request, we will provide you a written explanation. You may respond with a statement of disagreement to be attached to the information you wanted amended. If we accept your request to amend the information, we will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of that information.

Right to Receive a Copy of the Notice:  You may request a copy of our notice at any time by contacting the Privacy Officer or by using our web site, www.chip.state.il.us.  If you receive this notice on our web site or by electronic mail (e-mail), you are also entitled to request a paper copy of the notice.

Questions and Complaints

If you want more information about our privacy practices or have questions or concerns, please contact us using the information listed at the end of this notice.

If you are concerned that we may have violated your privacy rights, you may complain to us using the contact information listed at the end of this notice.  You also may submit a written complaint to the U.S. Department of Health and Human Services; see information at its website: www.hhs.gov.  If you request, we will provide you with the address to file your complaint with the U.S. Department of Health and Human Services.

We support your right to the privacy of your PHI. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

Contact Information

Privacy Officer
Illinois Comprehensive Health Insurance Plan
320 West Washington
Suite 700
Springfield, Illinois 62701-1150
Telephone: (217) 782 6333

([1]) A “business associate” is a person or entity who performs or assists CHIP with an activity involving the use or disclosure of medical information that is protected under the Privacy Rules. For example, our Administrator, Blue Cross and Blue Shield of Illinois, is a business associate of CHIP. (Return to text)