Privacy Policy

PRIVACY POLICY

STATEMENT OF PRIVACY

The City of Columbus provides a workplace for City employees, which protects a person’s Protected Health Information (PHI). It is the policy of the City of Columbus that any entity with whom the City has a relationship and may have access to PHI shall comply with the requirements of Health Insurance Portability Accountability Act (HIPAA). The City will maintain physical, electronic, and procedural safeguards to protect PHI against unauthorized access. The City will collect information about an employee that is necessary in the treatment, payment and health care operations of its employee benefit programs.

Protected Health Information (PHI)

Protected health information is information that relates to past, present or future physical, mental health or medical condition and in the provision or payment for health care. It permits individual identification that is created or received by a covered entity or employer. The PHI does not include employment, disability or workers compensation records.

A covered entity may use or disclose PHI without individual authorization only for treatment, payment and health care operations; or for disclosures to individuals who request their PHI.

Why the City Collects Information

The City collects information about the employee and the employee’s dependents in order to provide insurance coverage or requested services. Information the City receives from various sources in the operation, treatment and payment of its employee benefit programs, including transactions with health care providers, other insurers, third-party administrators, vendors, consultants, and City representatives. Examples of this information include but are not limited to health care claims, eligibility information, payment information, coordination of benefits information, and /or appeal information. Information collected may include hard copy, electronic, or oral communication data.

Uses and Disclosures for Treatment, Payment and Health Care Operations

The City will make reasonable efforts to limit requests for and disclosures of PHI to the minimum necessary to accomplish the intended purpose. Procedures for meeting this requirement for disclosure and requests are made on a routine and recurring basis within each City Department’s Human Resources and Benefits Division.

Customer service activities to assist the employee with various eligibility and claims questions involve the intake of questions from employees and beneficiaries, collecting information relevant to question; documenting decision; communicating with employee and beneficiary, as appropriate, to apprise them of the status and resolution; communicating with Business Associates as appropriate.

The City of Columbus may use and disclose PHI for the proper management and administration of its employee benefit insurance programs and all associated reports. The information helps the City serve its employees’ needs and to operate its employee benefit programs. Other than as permitted by law, the City will not share PHI with non-affiliated third parties, such as, Brokers, Agents, and/or claims services. Other than as described above, the City will not share its employees’ PHI with non-affiliated third parties without giving the employee an opportunity to state want they do not want the City to share.

The City will make reasonable efforts to limit the disclosures to the minimum necessary to accomplish the intended purpose.

Permissible Disclosures of PHI

• Workers’ Compensation disclosures or similar programs that provide benefits for work-related injuries or illness without regard to fault

• Disclosure necessary to prevent or lessen serious threat or health or safety to public or personal health or safety.

• Disclosures of PHI in response to a court or administrative order, subpoena, or law process; to identify a deceased or determine the cause of death.

• Disclosures of PHI on research projects; for the oversight of the health care system, government benefit programs; Armed Forces; national security or intelligence activities.

• Disclosure of PHI to Health and Human Services to investigate or determine the City’s compliance with the HIPAA Privacy Rule.

How the City Protects Information

The City restricts access to information to those employees or service providers who need to know the information in order to provide services. When the City shares information with vendors of employee services, it will require that they have standards to keep the information private. The City shall ensure that each agent and subcontractor to whom it provides PHI agrees to the same restrictions and conditions set forth in this policy.

Complaints and Resolutions

Complaints should be filed with the Manager of Labor Relations in writing and include the nature of the particular complaint. The Manager of Labor Relations will review the complaint, address the situation, consult with the proper individuals (if necessary), and attempt to come to an appropriate resolution of the complaint.

Employees with Access to PHI

Each department and division should chart the individuals in their department having access to PHI, the type of information, what is minimally necessary, and the condition under which they need access. All employees who must access their PHI will be required to sign a confidential non-disclosure form.

Business Associate Agreement

The City will obtain from each Business Associate a written contract or written agreement between the City and the business associate that contains the elements identifying the uses and disclosures of PHI. The Business Associate agreement will state the permitted uses and disclosures of PHI.

The City will require a Business Associate to determine the minimum necessary type and amount of PHI required to perform its services. The Business Associate will submit in writing a statement with the stated purposes. The City will rely on the professional judgment of Business Associates to determine the type and amount of PHI necessary for their purposes.

Training

The City will review the Privacy Notice with all workforce members who perform Plan functions, during their initial training and annually thereafter.