27
SYRACUSE UNIVERSITY
Notice of Privacy Practices
This notice describes how medical information
about you may be used and disclosed and how
you can get access to the information. Please
review it carefully.
This Notice of Privacy Practices (“NPP”) is made
in compliance with the Standards for Privacy of
Individually Identifiable Health Information (the
“Privacy Standards”) established by the United
States Department of Health and Human Services
(“DHHS”) pursuant to the Health Insurance
Portability and Accountability Act of 1996
(“HIPAA”). This NPP summarizes the privacy
practices of Syracuse University’s Group Health
Plans. The Privacy Standards shall control in the
event of a discrepancy between this NPP and
the Privacy Standards. Syracuse University’s
Group Health Plans, which include the Syracuse
University Medical Benefits Plan; the Syracuse
University Retiree Medical Benefits Plan; the
Syracuse University Retiree Prescription Drug
Plan; the Syracuse University Dental and Vision
Benefits Plan; and the Syracuse University Health
Care Flexible Spending Account (included
within the Syracuse University Cafeteria Plan
and Summary Plan Description; (collectively, the
“Health Plans”)), are required by law to maintain
the privacy of your Protected Health Information
(“PHI”) as defined below, and to inform you,
through this NPP, about:
1. the Health Plans’ duties with respect to your
PHI;
2. how the Health Plans may use and disclose
your PHI;
3. your privacy rights with respect to your PHI;
4. your right to file a complaint with the Health
Plans and with the Secretary of DHHS; and
5. who to contact for further information about
the Health Plans’ privacy practices.
PHI, as defined by HIPAA, includes all individually
identifiable information about you that is
transmitted or maintained by the Health Plans,
including demographic information, and includes
information that is created or received by the
Health Plans that relates to:
• your past, present or future physical or
mental health or condition;
• the provision of health care services to you;
or
• the past, present or future payment for the
provision of health care to you.
The Health Plans are required to abide by the
terms of the NPP that is currently in effect for
the Health Plans. The Health Plans reserve the
right to revise or amend the terms of this NPP.
Any revision or amendment will be effective for
all records that the Health Plans have created or
maintained in the past and for any of your records
that we may create or maintain in the future. You
will be informed of any material changes made to
this NPP. In addition, the Health Plans will post, at
all times, a copy of its most current NPP online at
policies.syr.edu/legal-notices/hipaa-notice-of-
privacy-practices. You may also obtain a copy of
the most current NPP at any time by calling the
Syracuse University Office of Human Resources at
315.443.4042.
If you have any questions about this NPP or would
like further information about HIPAA, please
contact Human Resources at 315.443.4042.
HOW THE HEALTH PLANS MAY USE AND
DISCLOSE YOUR PHI
HIPAA permits the Health Plans, its Business
Associates and their agents/subcontractors, if
any, to use and/or disclose your PHI, without prior
authorization, for the purposes of treatment,
payment and other health care operations of
the Health Plans, which are described below.
Consistent with the Genetic Information
Nondiscrimination Act (GINA), the Health Plans
are prohibited from using or disclosing genetic
information for underwriting purposes. The
Health Plans will disclose your PHI to its Business
Associates only if it has received satisfactory
assurances that the Business Associates will
appropriately safeguard your PHI. HIPAA also
permits the Health Plans to use and disclose of
your PHI, without prior authorization, for other
specific purposes that are also described below.
For each category, a description and some
examples of the permitted uses and/or disclosures
has been provided. The following examples are
illustrative and are not meant to be a complete
description of the permitted uses and disclosures
of the Health Plans.
A. Treatment. The Health Plans may use
and/or disclose your PHI to health care
providers who are involved in your care
and treatment. The Health Plans may use or
disclose PHI about you to physicians, nurses,
paraprofessionals, technicians or other health
care providers who are involved in your care
and treatment. For example, we may disclose
your PHI to a physician or a pharmacy to
assist in the management of your health care.
B. Payment. The Health Plans may use and/
or disclose your PHI to fulfill its obligation
for coverage and the provision of health
benefits under the Health Plans. For example,
the Health Plans may use or disclose PHI
to obtain or provide reimbursement for the
provision of health care. Payment includes,
but is not limited to, actions relating to
eligibility or coverage determinations, billing,
claims management, collection activities,
reviews for medical necessity determinations
and appropriateness of care, utilization
review and pre-authorizations.
C. Health Care Operations. The Health Plans
may use and/or disclose PHI in order to
conduct its normal business operations. For
example, the Health Plans may use your
PHI to conduct quality assessment and
improvement activities, population-based
activities relating to improving or reducing
health care costs, contacting health care
providers and patients with information
regarding treatment alternatives, reviewing
the competence or qualifications of health
care professionals, evaluating health plan
performance and other insurance-related
activities.
D. Follow-up Telephone Calls/Emails. The
Health Plans may call you to follow up on
care or treatment you received by a health
care provider or to ask questions relating
to treatment, payment or other health care
operations of the Health Plans.
E. Treatment Alternatives or Other Health-
Related Benefits and Services. The Health
Plans may use and/or disclose PHI to tell your
health care providers about or recommend
possible treatment alternatives or health-
related benefits or services that may be of
interest to you or your health care provider.
F. Individuals Involved in Your Care or
Payment for Your Care. HIPAA permits
the Health Plans to disclose PHI to a family
member, other relative, a close personal
friend or any other person identified by
you if:
1. you are present for or otherwise available
prior to the disclosure and we have
either obtained your agreement to the
disclosure, provided you the opportunity
to object to the disclosure or the Health
Plans have reasonably inferred from the
circumstances that you do not object to
the disclosure;
2. due to your incapacity or an emergency
circumstance, the Health Plans have
determined that a disclosure is in your
best interest—in such circumstances,
the Health Plans will only disclose PHI
that is directly relevant to the person’s
involvement with your health care.
G. As Required By Law. The Health Plans
may use and/or disclose your PHI if we are
required to do so under any federal, state or
local law.
H. Public Health Risks. The Health Plans
may use and/or disclose your PHI to
authorized public health officials (or a foreign
government agency collaborating with such
officials) so such officials may carry out
public health activities. For example, the
Health Plans may disclose your PHI to public
health officials for the following reasons: