Indiana University Healthcare Plans Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this
information. Please review it carefully.
Effective Date: April 14, 2003
Updated: March 23, 2023
As the Plan Sponsor of employee health care plans, Indiana
University is required by law to maintain the privacy and security of
your individually identifiable health information. We protect the
privacy of that information in accordance with federal and state
privacy laws, as well as the university’s policy. We are required to
give you notice of our legal duties and privacy practices, and to
This notice applies to all employees covered under an IU-
sponsored health plan, but particularly those enrolled in IU self-
funded plans.
How the Plan May Use and Disclose Protected
Health Information about Members
P
rotected Health Information (PHI) is health information that relates
health care, or payment for provision of health care, whether past,
present or future and regardless of the form or medium, that
is received or created by the Plan in the course of providing benefits
under these Plans.
The following categories describe different ways in which Indiana
University uses and discloses health information. For each of the
categories Indiana University has provided an explanation and an
example of how the information is used. Not every use or disclosure
in a category will be listed. However, all of the ways Indiana
University is permitted
to use and disclose information will fall within
one of the categories.
Treatment
Health information may be reviewed to provide authorization of
coverage for certain medical services or shared with providers
involved in a member’s treatment. For example, the Plan may obtain
medical information from or give medical information to
a hospital that asks the Plan for authorization of services on the
member’s behalf, or in conjunction with medical case management,
disease management, or therapy management programs.
Payment
Medical information may be used and disclosed to providers so
that they may bill and receive payment for a member’s treatment and
services. For example, a member’s provider may give a medical
diagnosis and procedure description on a request for payment made
to the Plan’s claim administrator; and the claim administrator may
request clinical notes to determine if the service is covered. Similarly,
a physician may submit medical information to a Business
Associate for purposes of administering wellness program financial
incentives. Medical information may also be shared with other
covered entities for business purposes, such
as determining the Plan’s share of payment when a member is
covered under more than one health plan.
Explanations of Payments may be mailed to the physical or email
address of record for the employee, the primary insured.
He
alth Care Operations
Health information may be used or disclosed when needed
to administer the Plan. For example, Plan administration may
include activities such as quality management, administration of
wellness programs and incentives, to evaluate health care provider
performance, underwriting, detection and investigation of fraud,
data and information system management; and coordination of
Genetic information will not be used or disclosed for health plan
underwriting purposes.
Medical information may also be used to inform members about
a health-related service or program, or to notify members about
potential benefits. For example, we may work with other agencies
or health care providers to offer programs such as complex or
chronic condition management.
Individuals Involved in Your Care or Payment of Care
Unless otherwise specified, the plan may communicate health
information in connection with the treatment, payment, and health
care operations to the employee and/or any enrolled individual who
is responsible for either the payment or care of an individual
covered under the plan.Also, when a member authorizes another
party in writing to be involved in their care or payment of care, the
Plan may share health information with that party. For example,
when an employee signs an authorization allowing a close friend to
make medical decisions on their behalf, the Plan may disclose
medical information to that friend.
Legal Proceedings, Government Oversight, or Disputes Health
information may be used or disclosed to an entity with health
oversight responsibilities authorized by law, including
HHS oversight of HIPAA compliance. For example, we may share
information for monitoring of government programs or compliance
with civil rights laws. Health information may also be disclosed in
response to a subpoena, court or administrative order, or
other lawful request by someone involved in a dispute or legal
proceeding.
Research
Health information may be used or shared for health research.
Use of this information for research is subject to either a special
approval process, or removal of information that may directly
identify you.
Uses & Disclosures Requiring Your Written
Authorization
In all situations, other than the categories
described above, we will
ask for your written authorization before using or disclosing
personal information about you. The Plan will not share member
information for marketing purposes, including subsidized
treatment communications, or the sale of member information
without written permission. Members can also opt-out of
fundraising communications with each solicitation. If you have
given us an authorization, you may revoke it at any time. This
revocation does not apply to any uses or disclosures already
made in reliance on the authorization.
12 Indiana University Prescription Plan