Section 2160.270  Health Insurance Portability and Accountability Act (HIPAA)

The State shall comply with the uses and disclosures of Protected Health Information (PHI), permitted by HIPAA and 45 CFR 160-164, where applicable, in Plan documents.

a)         The Department shall provide an annual notice of privacy practices outlining the legal duties and privacy practices concerning the PHI of Members and Dependents.

b)         PHI may be disclosed:

1)         to health care providers who take care of Members and Dependents;

2)         to process claims and make payments for covered services;

3)         for healthcare operations;

4)         to remind Members or Dependents of an upcoming appointment; and

5)         as required or authorized by law.

c)         Members and Dependents have the right to:

1)         request restrictions on how their PHI is used for purposes of treatment, payment and healthcare operations;

2)         receive confidential communications about their PHI;

3)         request to inspect information used to make decisions about them;

4)         request an amendment to their PHI;

5)         receive an accounting of disclosures that have been made of their PHI;

6)         obtain a paper copy of the annual notice of privacy practices provided by the Department; and

7)         file a complaint if they feel that their privacy rights have been violated. 

d)         PHI may not be disclosed:

1)         for any purpose other than administration of the benefit plan;

2)         for any fundraising activity;

3)         for the marketing of any products or services.

(Source:  Added at 32 Ill. Reg. 15994, effective September 11, 2008)