Hobart and William Smith Colleges

HIPAA Notice of Privacy Practices for Personal Health Information

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Legal Duty

We are required by applicable federal and state law to maintain the privacy of your medical information. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your medical information. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect April 14, 2003, and will remain in effect until we replace it.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all medical information that we maintain, including medical information we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and send the new notice available to our health plan subscribers at the time of the change.

You may request a copy of our notice at any time. For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Uses and Disclosures of Medical Information

We use and disclose medical information about you for treatment, payment, and health care operations. For example:

Treatment: We may use or disclose your medical information to a physician or other health care provider in order to provide treatment to you.

Payment: We may use and disclose your medical information to pay claims from physicians, hospitals and other providers for services delivered to you that are covered by your health plan, to determine your eligibility for benefits, to coordinate benefits, to examine medical necessity, to obtain premiums, to issue explanations of benefits to the person who subscribes to the health plan in which you participate, and the like. We may disclose your medical information to a health care provider or entity subject to the federal Privacy Rules so they can obtain payment or engage in these payment activities.

Health Care Operations: We may use and disclose your medical information in connection with our health care operations. Health care operations include:

• Rating our risk and determining our premiums for your health plan;

• Quality assessment and improvement activities;

• Medical review, legal services, and auditing, including fraud and abuse detection and compliance;

• Business planning and development; and

• Business management and general administrative activities, including management activities relating to privacy, customer service, resolution of internal grievances, and creating de-identified medical information or a limited data set.

Public Health, Auditing, Research, Emergency Purposes and When Required by Law: We may use or disclose identifiable health information about you without your authorization for several additional reasons. Subject to certain requirements, we may give out health information without your authorization for public health purposes, for auditing purposes, for research studies, and for emergencies. We provide information when otherwise required by law, such as for law enforcement in specific circumstances.

Others Involved in Your Care or Payment of Your Care: We also may disclose your medical information to a family member, friend or other person to the extent necessary to help with your health care or with payment for your health care. We may use or disclose your name, location, and general condition or death to notify, or assist in the notification of (including identifying or locating), a person involved in your care.

Before we disclose your medical information to a person involved in your health care or payment of your health care, we will provide you with an opportunity to object to such uses or disclosures. If you are not present, or in the event of your incapacity or an emergency, we will disclose your medical information based on our professional judgment of whether the disclosure would be in your best interest.

Plan Sponsors: We may disclose your medical information and the medical information of others enrolled in your group health plan to the employer or other organization that sponsors your group health plan to permit the plan sponsor to perform plan administration functions. Please see your group health plan document for a full explanation of the limited uses and disclosures that the plan sponsor may make of your medical information in providing plan administration.

We may also disclose summary information about the enrollees in your group health plan to the plan sponsor to use to obtain premium bids for the health insurance coverage offered through your group health plan or to decide whether to modify, amend or terminate your group health plan. The summary information we may disclose summarizes claims history, claims expenses, or types of claims experienced by the enrollees in your group health plan. The summary information will be stripped of demographic information about the enrollees in the group health plan, but the plan sponsor may still be able to identify you or other enrollees in your group health plan from the summary information.

Situations Other Than Those Above: In any situation other than those above, we will ask for your written authorization before using or disclosing any identifiable health information about you. If you choose to sign an authorization to disclose information you can later revoke that authorization to stop any future uses and disclosures.

Individual Rights

In most cases, you have the right to look at or get a copy of health information about you that we use to make decisions about you. If you request copies, we will charge you $.05 (5 cents) for each page. You also have the right to receive a list of instances where we have disclosed health information about you for reasons other than treatment, payment or related administrative purposes. If you believe that information in your record is incorrect or if important information is missing, you have the right to request that we correct the existing information or add the missing information. All requests for access to your medical information must be made in writing by you and directed to the contact person named below.

Additionally, you have the right to request that we communicate with you about your medical information by alternative means or to alternative locations. We will accommodate your request if it is reasonable, specifies the alternative means or location, and continues to permit us to collect premiums and pay claims under your health plan.

Finally, you may request in writing that we not use or disclose your information for treatment, payment and operations except when specifically authorized by you, when required by law, or in emergency circumstances. We will consider your request but are not legally required to accept it.

Questions and Concerns

If you want more information about our privacy practices or have questions or concerns, please contact us using the information listed at the end of this notice.

If you are concerned that we may have violated your privacy rights, or you disagree with a decision we made about access to your medical information or in response to a request you made to amend or restrict the use or disclosure of your medical information or to have us communicate with you by alternative means or at alternative locations, you may complain to us using the contact information listed at the end of this notice. You may also submit a written complaint to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services upon request.

We support your right to the privacy of your medical information. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.