CASE MANAGEMENT SPECIALISTS (CMS)
NOTICE OF PRIVACY PRACTICES

Disclaimer
This Model Notice of Health Plan Privacy Practices is Copyright  by the HIPAA Collaborative of Wisconsin (“HIPAA COW”). It may be freely redistributed in its entirety provided that this copyright notice is not removed. When information from this document is used, HIPAA COW shall be referenced as a resource. It may not be sold for profit or used in commercial documents without the written permission of the copyright holder. This Model Notice of Health Plan Privacy Practices is provided “as is” without any express or implied warranty. This Model Notice of Health Plan Privacy Practices is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney. Unless otherwise noted, HIPAA COW has not addressed all state pre-emption issues related to Model Notice of Health Plan Privacy Practices. Therefore, this document may need to be modified in order to comply with Wisconsin/State law.

* * * *

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Case Management Specialists (CMS) is required by law to maintain the privacy of your health information and to provide you with notice of its legal duties and privacy practices with respect to your health information. If you have questions about any part of this Notice or if you want more information about the privacy practices at CMS, please contact:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750

How CMS May Use or Disclose Your Health Information

The following categories describe the ways that CMS may use and disclose your health information. For each category of uses and disclosures, we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all the ways we are permitted to use and disclose information will fall within one of the categories.

1. Payment Functions. We may use or disclose health information about you to determine eligibility for plan benefits, obtain premiums, facilitate payment for the treatment and services you receive from health care providers, determine plan responsibility for benefits, and to coordinate benefits. Health information may be shared with other government programs such as Medicare, Medicaid, or private insurance to manage your benefits and payments. For example, payment functions may include reviewing the medical necessity of health care services, determining whether a particular treatment is experimental or investigational, or determining whether a treatment is covered under your plan.

2. Health Care Operations. We may use and disclose health information about you to carry out necessary insurance-related activities. For example, such activities may include underwriting, premium rating and other activities relating to plan coverage; conducting quality assessment and improvement activities; submitting claims for stop-loss coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; and business planning, management and general administration.

3. Required by Law. As required by law, we may use and disclose your health information. For example, we may disclose medical information when required by a court order in a litigation proceeding such as a malpractice action.

4. Public Health. Information may be reported to a public health authority or other appropriate government authority authorized by law to collect or receive information for purposes related to: preventing or controlling disease, injury or disability; reporting child abuse or neglect; reporting domestic violence; reporting to the Food and Drug Administration problems with products and reactions to medications; and reporting disease or infection exposure.

5. Health Oversight Activities. We may disclose your health information to health agencies during the course of audits, investigations, inspections, licensure and other proceedings related to oversight of the health care system.

6. Judicial and Administrative Proceedings. We may disclose your health information in the course of any administrative or judicial proceeding.

7. Law Enforcement. We may disclose your health information to a law enforcement official for purposes such as identifying of locating a suspect, fugitive, material witness or missing person, complying with a court order or subpoena and other law enforcement purposes.

8. Public Safety. We may disclose your health information to appropriate persons in order to prevent or lessen a serious and imminent threat to the health or safety of a particular person or the general public.

9. National Security. We may disclose your health information for military, prisoner, and national security.

10. Worker’s Compensation. We may disclose your health information as necessary to comply with worker’s compensation or similar laws.

11. Marketing. We may contact you to give you information about health-related benefits and services that may be of interest to you. If we receive compensation from a third party for providing you with information about other products or services (other than drug refill reminders or generic drug availability), we will obtain your authorization to share information with this third party.

12. Disclosures to Plan Sponsors. We may disclose your health information to the sponsor of your group health plan, for purposes of administering benefits under the plan. If you have a group health plan, your employer is the plan sponsor.

13. Research. Under certain circumstances, and only after a special approval process, we may use and disclose your health information to help conduct research.

When CMS May Not Use or Disclose Your Health Information

Except as described in this Notice of Privacy Practices, we will not use or disclose your health information without written authorization from you. If you do authorize us to use or disclose your health information for another purpose, you may revoke your authorization in writing at any time. If you revoke your authorization, we will no longer be able to use or disclose health information about you for the reasons covered by your written authorization, though we will be unable to take back any disclosures we have already made with your permission.

• Your authorization is necessary for most uses and disclosures of psychotherapy notes.

• Your authorization is necessary for any disclosure of health information in which the health plan receives compensation.

Genetic Information and Underwriting Activities. CMS is prohibited from using or disclosing genetic information for underwriting purposes, including determination of benefit eligibility. If we obtain any health information for underwriting purposes and the policy or contract of health insurance or health benefits is not written with us or not issued by us, we will not use or disclose that health information for any other purpose, except as required by law.

Applicability of More Stringent State Law. Some of the uses and disclosures described in this notice may be limited in certain cases by applicable State laws that are more stringent than Federal laws, including disclosures related to mental health and substance abuse, developmental disability, alcohol and other drug abuse (AODA), and HIV testing.

Statement of Your Health Information Rights

Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of your health information. CMS is not required to agree to the restrictions that you request. If you would like to make a request for restrictions, you must submit your request in writing to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750
We will let you know if we can comply with the restriction or not.

Right to Request Confidential Communications. You have the right to receive your health information through a reasonable alternative means or at an alternative location. To request confidential communications, you must submit your request in writing to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750
We are not required to agree to your request.

Right to Inspect and Copy. You have the right to inspect and receive an electronic or paper copy of health information about you that may be used to make decisions about your plan benefits. To inspect and copy such information, you must submit your request in writing to: Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750
If you request a copy of the information, we may charge you a reasonable fee to cover expenses associated with your request.

Right to Request Amendment. You have a right to request that CMS amend your health information that you believe is incorrect or incomplete. We are not required to change your health information and if your request is denied, we will provide you with information about our denial and how you can disagree with the denial. To request an amendment, you must make you request in writing to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750
You must also provide a reason for your request. [OPTIONAL if organization requires].

Right to Accounting of Disclosures. You have the right to receive a list or “accounting of disclosures” of your health information made by us in the past six years, except that we do not have to account for disclosures made for purposes of payment functions or health care operations, or made to you. To request this accounting of disclosures, you must submit your request in writing to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750
CMS will provide one list per 12 month period free of charge; we may charge you for additional lists.

Right to a Copy. You have a right to receive an electronic or paper copy of this Notice of Privacy Practices at any time. To obtain a paper copy of this Notice, send your written request to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750

Right to be Notified of a Breach. You will be notified in the event of a breach of your unsecured protected health information.

If you would like to have a more detailed explanation of these rights or if you would like to exercise one or more of these rights, contact:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750

Changes to this Notice and Distribution
CMS reserves the right to amend this Notice of Privacy Practices at any time in the future and to make the new Notice provisions effective for all health information that it maintains.

CMS will provide a copy of our notice upon your enrollment to Case Management services and will remind you at least every three years where to find our notice and how to obtain a copy of the notice if you would like to receive one. If we have more than one Notice of Privacy Practices, we will provide you with the Notice that pertains to you. We will communicate to you within 60 days of a material change to the Notice of Privacy Practices. We will describe what change(s) occurred, provide you with a copy of the revised Notice or inform you how to obtain the revised Notice.

Complaints

Complaints about this Notice of Privacy Practices or about how we handle your health information should be directed to:
Cory Schneider, President and Chief Security Officer
553 S. Industrial Drive
Hartland, WI 53029
800-861-8750

CMS will not retaliate against you in any way for filing a complaint. All complaints to CMS must be submitted in writing. If you believe your privacy rights have been violated, you may file a complaint with the Secretary of the Department of Health and Human Service at http://www.hhs.gov/ocr/privacy/hipaa/complaints/ or call (800) 368-1019.

Effective Date of This Notice: 1/1/18