- Marketing or Sale of Health information. Most uses and sharing of your health information for marketing purposes or
any sale of your health Information are strictly limited and require your written authorization.
- Separation Between Covered Functions and Non-Covered Functions. To comply with the requirements of HIPAA, the
University must maintain separation between covered functions (including the University’s Group Health Plans), and non-
covered functions (such as employer-related functions not associated with the University’s Group Health Plans). The
University prohibits the use or disclosure of member PHI for employment-related actions or decisions; nor may it be used or
disclosed in connection with any other benefit or employee benefit plan of the University. Workforce members engaged in
multiple roles, some part of which involves use and disclosure of PHI, must take special care to keep those roles separate. A
disclosure of PHI from the SPHC to a non-covered function or unit may require written authorization.
- Disclosures to Subcontractors. A Self-Funded Plan shall ensure that any agents (including any subcontractor) to whom the
Plan provides PHI agree to the same restrictions and conditions that apply to the Plan with respect to such information.
- Other Uses and Disclosures of Health Information. Other ways we share and use your health information not covered by
this Notice will be made only with your written authorization. If you authorize us to use or disclose your health information,
you may cancel that authorization, in writing, at any time. However, the cancellation will not apply to information we have
already used and disclosed based on the earlier authorization.
Special laws apply to certain kinds of health information considered particularly private or sensitive to a patient. This
sensitive information includes psychotherapy notes, sexually transmitted diseases, drug and alcohol abuse treatment
records, mental health records, and HIV/AIDS information. When required by law, we will not share this type of
information without your written permission. In certain circumstances, a minor’s health information may receive additional
protections.
- Genetic Information is Protected Health Information. In accordance with the Genetic
Information Nondiscrimination Act (GINA), a Self-Funded Plan will not use or disclose genetic
information for underwriting purposes, which includes eligibility determinations, premium
computations, applications of any pre-existing condition exclusions, and any other activities related to
the creation, renewal, or replacement of a contract of health insurance or health benefits.
Your Rights
You have the following rights regarding the PHI that a Self-Funded Plan maintains about you:
- Right to Inspect and Copy. With certain exceptions you have the right to inspect and obtain a copy
of your PHI that is maintained by or for a Self-Funded Plan. To inspect and obtain a copy of the PHI
you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street
Oakland, CA 94607, Attention: Privacy Officer. You may be charged a fee for the costs of copying
mailing or other supplies associated with your request.
A Self-Funded Plan may deny your request to inspect and/or obtain a copy in certain limited
circumstances. For example, HIPAA does not permit you to access or obtain copies of psychotherapy
notes. If your request is denied, you will be informed in writing, and you may request that the denial be
reviewed. The person conducting the review will not be the person who denied your request. The plan
will comply with the outcome of the review.
- Right to Request an Amendment. If you believe that the PHI maintained by a Self-Funded Plan is
incorrect or incomplete, you may request that the plan amend the information. You have the right to
request an amendment for as long as the information is kept by or for the plan. A request for an
amendment should be made in writing and submitted to the UC Healthcare Plan Privacy Office, 1111
Franklin Street
Oakland, CA 94607, Attention: Privacy Officer. In addition, you must provide a reason that supports
your request.