UCAR may only use or disclose your Protected Health Information, as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), for the purpose of making or obtaining payment for your care, conducting its health care operations, or as otherwise allowed by HIPAA. Protected Health Information (“PHI”) is considered to be individually identifiable health information that is transmitted or maintained by UCAR in any form. UCAR will only use or disclose PHI in a manner that complies with HIPAA. All responses to requests for PHI will be limited to the minimum amount of information needed to accomplish the purpose of the request or disclosure. An individual may authorize use, request restrictions, inspect his or her records, and amend and request an accounting of disclosures of his/her PHI. The NOTICE OF HIPAA PRIVACY PRACTICES describes in more detail how an individual’s PHI may be used and disclosed.

The HIPAA Contact Person will receive all requests, inquiries, questions and complaints with regard to the use and disclosure of PHI and any questions under this Policy, the Procedures, or the Notice of HIPAA Privacy Practices. If an individual believes that it would be inappropriate to contact the Contact Person, the individual should immediately contact the Director of Human Resources. The Privacy Officer will assist in the interpretation of all laws and regulations related to this Policy, the procedures and practices, and will guide the Contact Person and UCAR in their implementation.

Violations of this Policy or any other policies or procedures intended to secure and protect PHI from unauthorized access, use, alteration, deletion and transmission may result in disciplinary action up to and including termination.

See the Human Resources Web site for HIPAA privacy procedures and Notice of HIPAA Privacy Practices.