Notice of Privacy Practices Cover Letter

Notice of Privacy Practices

UCAR HIPAA Privacy and Security Policy

HIPAA Privacy Rights Forms

Notice of Privacy Practices

September 2013



UCAR may use your health information, that is, information that constitutes protected health information (PHI) as defined in the Privacy Rule of the Administrative Simplification provision of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), for purposes of making or obtaining payment for your care and conducting health care operations. UCAR has established a policy and procedures regarding disclosure of your PHI.


To Make or Obtain Payment. UCAR may use or disclose your PHI to make payment to or collect payment from third parties, such as other health plans or providers, for the care you receive. For example, UCAR may provide information regarding your coverage or health care treatment to other health plans to coordinate payment of benefits.

To Conduct Health Care Operations. UCAR may use or disclose PHI for its own operations to facilitate the administration of the UCAR health plan and, as necessary, to provide coverage and services to all of UCAR's participants. Health care operations include such activities as:

  • Quality assessment and improvement activities.

  • Activities designed to improve health care or reduce health care costs.

  • Clinical guideline and protocol development, case management and care coordination.

  • Contacting health care providers and participants with information about treatment alternatives and other related functions.

  • Health care professional competence or qualifications review and performance evaluation.

  • Accreditation, certification, licensing or credentialing activities.

  • Underwriting, premium rating or related functions to create, renew or replace health insurance or health benefits.

  • Review and auditing, including compliance reviews, medical reviews, services and compliance programs.

  • Business planning and development including cost management and planning related analyses and formulary development.

  • Business management and general administrative activities of the UCAR health plan, including customer service and resolution of internal grievances.

  • For example, UCAR may use your PHI to conduct case management, quality improvement and utilization review, and provider credentialing activities or to engage in customer service and grievance resolution activities.

For Distribution of Health-Related Benefits and Services. UCAR may use or disclose your PHI to provide you with information on health-related benefits and services.

When Legally Required. UCAR will disclose your PHI when it is required to do so by any federal, state or local law.

To Conduct Health Oversight Activities. UCAR may disclose your PHI to a health oversight agency for authorized activities including audits, civil administrative or criminal investigations, inspections, licensure or disciplinary action. UCAR, however, may not disclose your PHI if you are the subject of an investigation and the investigation does not arise out of or is not directly related to your receipt of health care or public benefits.

In Connection With Judicial and Administrative Proceedings. As permitted or required by state law, UCAR may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order or in response to a subpoena, discovery request or other lawful process, but only when UCAR makes reasonable efforts to either notify you about the request or to obtain an order protecting your PHI.

For Law Enforcement Purposes. As permitted or required by state law, UCAR may disclose your PHI to a law enforcement official for certain law enforcement purposes, including, but not limited to, if UCAR has a suspicion that your death was the result of criminal conduct or in an emergency to report a crime.

In the Event of a Serious Threat to Health or Safety. UCAR may, consistent with applicable law and ethical standards of conduct, disclose your PHI if UCAR, in good faith, believes that such disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public.

For Specified Government Functions. In certain circumstances, federal regulations require UCAR to use or disclose your PHI to facilitate specified government functions related to the military and veterans, national security and intelligence activities, protective services for the president and others, and correctional institutions and inmates.

For Worker's Compensation. UCAR may release your PHI to the extent necessary to comply with laws related to worker's compensation or similar programs.


Other than as stated above, UCAR will not disclose your PHI other than with your written authorization. Thus, unless expressly authorized by you or by a regulation, UCAR will not sell your PHI, use your PHI for marketing or disclose any of your psychotherapy notes. If you authorize UCAR to use or disclose your PHI, you may revoke that authorization in writing at any time.


You have the following rights regarding your PHI that UCAR maintains:

Right to Request Restrictions. You may request restrictions on certain uses and disclosures of your PHI. You have the right to request a limit on UCAR's disclosure of your PHI to someone involved in the payment of your care. However, UCAR is not required to agree to your request. If you wish to make a request for restrictions, please contact UCARís HIPAA Contact Person at 303-497-8702.

Right to Receive Confidential Communications. You have the right to request that UCAR communicate with you in a certain way if you feel the disclosure of your PHI could endanger you. For example, you may ask that UCAR only communicate with you at a certain telephone number or by email. If you wish to receive confidential communications, please make your request in writing to the HIPAA Contact Person at UCAR, P.O. Box 3000, Boulder, CO 80307 (Human Resources), or fax to 303-497-8701. UCAR will attempt to honor your reasonable requests for confidential communications.

Right to Access, Inspect and Copy Your PHI.

UCAR will retain all records subject to the HIPAA Privacy Rule for six years. All records designated by HIPAA in this retention requirement will be maintained in a manner that allows for access within a reasonable period of time (thirty days, unless conditions warrant thirty-day extension permissible by regulations) by an individual making a request. The six year records retention period may be extended at UCARís discretion to meet with other governmental regulations or those requirements imposed by UCARís professional liability carrier.

You and your personal representatives have the right to inspect and copy your PHI. A request to inspect and copy records containing your PHI must be made in writing to the HIPAA Contact Person at UCAR, P.O. Box 3000, Boulder, CO 80307 (Human Resources), or fax to 303-497-8701.

Right to Amend Your PHI. If you believe that your PHI records are inaccurate or incomplete, you may request that UCAR amend the records. That request may be made as long as the information is maintained by UCAR. A request for an amendment of records must be made in writing to the HIPAA Contact Person at UCAR, P.O. Box 3000, Boulder, CO 80307 (Human Resources). UCAR may deny the request if it does not include a reason to support the amendment. The request also may be denied if your PHI records were not created by UCAR, if the PHI you are requesting to amend is not part of UCAR's records, if the PHI you wish to amend falls within an exception to the PHI you are permitted to inspect and copy, or if UCAR determines the records containing your PHI are accurate and complete.

Right to an Accounting. You have the right to request a list of disclosures of your PHI made by UCAR. The request must be made in writing to the HIPAA Contact Person at UCAR, P.O. Box 3000, Boulder, CO 80307 (Human Resources). The request should specify the time period for which you are requesting the information. Accounting requests may not be made for periods of time going back more than six (6) years.

Right to a Paper Copy of this Notice. You have a right to request and receive a paper copy of this Notice at any time, even if you have received this Notice previously or agreed to receive the Notice electronically. To obtain a paper copy, please contact UCARís HIPAA Contact Person at 303-497-8702. You also may obtain a copy of the current version of UCAR's Notice at its Web site,


Only certain employees within UCAR, primarily within UCARís Human Resources Department, will have access to PHI, in order for UCAR to facilitate the payment of health care benefits or work with health care providers. No employee with authorized access to PHI may engage in any intimidating or retaliatory acts against persons who file complaints or otherwise exercise their rights under the HIPAA regulations. Enrollment or eligibility for benefits for any individual may not be conditioned on an individual providing an authorization to disclose PHI. Any employee authorized to handle PHI who intentionally or unintentionally violates any of the applicable policies or any procedures may be subject to disciplinary procedures up to and including termination.

Appropriate physical safeguards are in place to reasonably safeguard PHI from any intentional or unintentional use or disclosure that is in violation of the HIPAA Privacy Regulations. These safeguards will include physical protection of premises and PHI, technical protection of PHI maintained electronically and administrative protection. These safeguards will extend to the oral communication of PHI. These safeguards will extend to PHI that is removed from UCAR.

UCAR is required by law to maintain the privacy of your PHI as set forth in this Notice and to provide you this Notice of its duties and privacy practices with respect to PHI and to notify the affected individual following a breach of unsecured PHI. UCAR is required to abide by the terms of this Notice, which may be amended from time to time. UCAR reserves the right to change the terms of this Notice and to make the new Notice provisions effective for all health information that it maintains. If UCAR changes its policies and procedures, UCAR will revise the Notice and will provide a copy of the revised Notice to you within 60 days of the change. You have the right to express complaints to UCAR and to the Secretary of the Department of Health and Human Services if you believe that your privacy rights have been violated. Any complaints to UCAR should be made in writing to the UCAR Privacy Officer or the HIPAA Contact Person at UCAR, P.O. Box 3000, Boulder, CO 80307. UCAR encourages you to express any concerns you may have regarding the privacy of your information. You will not be retaliated against in any way for filing a complaint.

Oversight agencies such as the Office for Civil Rights of the Department of Health and Human Services will be given full support and cooperation in their efforts to ensure the protection of PHI within UCAR


UCAR has designated Laurie Carr, UCAR Senior Human Resources Manager, as its HIPAA Contact Person for all issues regarding patient privacy and your privacy rights. Correspondence may be sent to P.O. Box 3000, Boulder, CO 80307.


This Notice was originally effective April 14, 2003. Last updated September 10, 2013.

If you have any questions regarding this notice, please contact the UCAR HIPAA Contact Person, P.O. Box 3000, Boulder, CO 80307.

September 2013

Questions or comments about this site? Contact: