Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

HPSM is committed to protecting your health information, which is any information about:

• Your past or present physical or mental health.
• Any payments for health services that can be identified with you as an individual. 

Examples of health information include your name, date of birth, diagnoses, medical treatments, medical claims, race, ethnicity, language, gender identity and sexual orientation.

This notice summarizes HPSM’s privacy practices and your rights as an HPSM member regarding your health information. It explains:

• How HPSM protects your health information in accordance with state and federal law.
• How HPSM can legally use and disclose your health information. (“Use” refers to how we share information within HPSM. “Disclose” refers to sharing information outside of HPSM.)
• How you can access your health information. 

This notice only covers HPSM’s privacy practices. Your provider may have different policies regarding their use and disclosure of your health information created in their office.

If you have questions about this notice, call HPSM Member Services at 1-800-750-4776. Hours are Monday through Friday, 8:00 a.m. to 6:00 p.m. HPSM CareAdvantage members should call 1-866-880-0606. Hours are Monday through Sunday, 8:00 a.m. to 8:00 p.m. Members with hearing or speech impairments can call the California Relay Service (CRS) at 1-800-735-2929 or 711.

This notice is effective as of: 10/01/2024.

HPSM’s legal requirements regarding health information

We are required by law to:

• Maintain security and privacy of electronic and written information, including physical, technical, and administrative procedures to prevent unauthorized access to your protected health information.
• Make sure that health information that identifies you is kept private.
• Give you this privacy practices notice.
• Follow the terms of the notice that is currently in effect.

How we may use or disclose your health information

State and federal law allow HPSM to use and disclose our members’ health information without written authorization. Below is a list of the types of health information and examples of uses and/or disclosures. It does not include every possible allowable use and disclosure. It is not intended to limit uses and disclosures that are permitted by law. However, every way we can use and disclose your health information will fall into one or another of these types.

Payment for health services

We review your health information before approving payment for a treatment your provider has asked for to make sure that it is medically necessary.

Improving HPSM operations

We may use members’ health information to review our providers’ performance and compare the quality of our services with that of other health plans.

Care management

Sharing your health information with your providers allows us to review your treatments and medications to make sure they do not conflict with each other.

Resource referrals

We may identify and recommend HPSM benefits, services and/or programs based on your health information.

Contractors who assist in our operations

Contractors agree to keep health information confidential and secure, and to only use it to assist us. For example, we contract with a “Pharmacy Benefit Manager” and provide them with the information they need to pay our members’ pharmacy claims.

Health insurance program sponsors

Employers and other organizations contract with HPSM so that we can provide health care services and pay claims. They agree to keep health information confidential and secure, and to only use it to assist us. If you have a plan sponsor, we may notify them when you enroll in or disenroll from our plan. We may also disclose your health information so the sponsor can audit HPSM’s performance.

Family members or individuals involved in your care or payment for your care

We may release your health information to family members or others who pay for your health care. We would do this if it is necessary to enable them to pay for your care or make decisions about your care. We only disclose your health information if you are present and agree to it, except when:

• Your medical condition prevents you from making decisions and we believe that disclosing your information would be in your best interest.
• After your death (unless you tell us beforehand not to share your information).

Schools

A school may be legally required to have proof of immunization for a student enrolling or enrolled in the school. In those cases, we may provide the school with that student’s immunization record.

Special Situations

We disclose health information about you:

• When required by federal, state or local law.
• To avoid a serious threat to your health and safety or the health and safety of others. We would only disclose the information to someone who can help prevent the threat.
• If you are a member of the armed forces or a veteran as required by military authorities or to assist in determining your eligibility for veteran’s benefits.
• If you are in custody of a correctional institution as part of coordinating your care.
• To programs that provide workers compensation and other benefits for work-related injuries or illness.
• For public health activities, such as:
  • Preventing or controlling disease, injury or disability.
  • Reporting child abuse or neglect.
  • Reporting births or deaths.
  • Reporting reactions to medications or problems with products.
  • Notifying you of recalls of products you may be using.
  • Notifying you if you may have been exposed to a disease or may be at risk for contracting or spreading a disease.
  • Notifying the appropriate government authority if we believe you are the victim of abuse, neglect or domestic violence. We will only disclose this if you agree or when authorized by law.
• To health oversight agencies for activities authorized by law. For example, we may disclose your health information to the public agency responsible for overseeing HPSM’s operations. These activities are necessary to enable the government to monitor the health care system and government health benefit programs.
• For lawsuits and disputes if ordered by a court, tribunal, subpoena or other lawful process. We only do this after unsuccessful efforts to notify you of the request or obtain an order protecting the information requested.
• To law enforcement officials in limited circumstances (i.e., if the official requests it or to report criminal conduct). Generally, this would have to be in connection with a criminal investigation, court order, warrant or legally authorized national security activity.
• To assist in a military mission or other governmental activity related to intelligence, national security or protecting the President.
• To coroners, medical examiners and funeral directors so they can perform their duties after members are deceased.
• To organ transplant organizations working on organ or tissue transplantation for the purposes of facilitating a transplant.
• 50 years after death. We may disclose the health information of members who are deceased to any agency after the member has been deceased for at least 50 years.
• To disaster relief organizations. If you do not want us to disclose your information for disaster relief, you have the right to prevent such sharing.

The previous examples are all subject to the prohibitions and conditions we explain below related to reproductive health care.

Legal limitations

We comply with laws that may limit or prevent the disclosures listed above. For example:

• There are special limits on disclosing health information about HIV/AIDS status, mental health treatment, developmental disabilities, and drug and alcohol abuse treatment.
  • We will not use or disclose the records we receive subject to 42 C.F.R. Part 2, or testimony relaying the content of such records, in civil, criminal, administrative, or legislative proceedings against you unless we have your written consent or a court order, after notice and an opportunity to be heard in court is provided to you. Any court order we receive for a use or disclosure of these records must be accompanied by a subpoena or other legal obligation before we may use or disclose the record.
• Information about race, ethnicity, language, gender identity and sexual orientation cannot be used in underwriting, rate setting, denial of services, coverage and benefit determinations.
• We cannot sell your information.

Authorization

Other than the situations described above, we do not allow use and disclosure of your health information without your written permission or authorization. For example, we may use and share health information about you for research purposes only if we have your authorization. Your decision to grant us an authorization will not affect your medical treatment, health plan benefits, payment for treatment or enrollment eligibility. You have the right to revoke your authorization even after you have signed an authorization for use or release of your health information. In that case, we would no longer use or disclose your health information for that purpose. However, we cannot reverse any disclosures we made during the time we had your permission to do so.

• Uses and disclosures related to reproductive health care. Unless we have received an authorization from you, we are prohibited from disclosing your health information when the request is made by someone other than you or your personal representative for either of the following activities (“Prohibited Purposes”):
  • To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
  • The identification of any person for the purpose of conducting such investigation or imposing such liability.

Your rights regarding your health information

You have the right to:

Get a paper copy of this privacy notice

You can also get this notice on our website at www.hpsm.org/privacy-policy.

Assign someone to represent you

You can give someone medical power of attorney, which allows that person to act on your behalf and make choices about your health information. This right also applies if you have a legal guardian. We will take reasonable steps to confirm that anyone who claims to represent you has this authority before we take any action.

Request restrictions or limits on the use or disclosure of your health information

In your request, you must tell us:

• What health information you want to limit.
• Whether you want to limit our use of information, disclosure of information, or both.
• To whom you want the limits to apply.

Control information about sensitive services you receive

Sensitive services include mental health counseling, reproductive health services, sexually transmitted disease services, sexual assault services and drug treatment. Those who are of the age and capacity to consent to these services are not required to get anyone’s authorization to get them or submit a claim on their behalf.

Request confidential communications

You have the right to request that we contact you about medical matters (including sensitive services) privately and with special handling. We will then not give your specified information to anyone without your written permission.

• You can ask us to send communications about medical matters or sensitive services to another mailing address, email address or telephone number that you choose. If you do not provide another contact method, we will send communications to you at the address or telephone number we have on file. 
• We will honor your requests to get confidential communications in the form and format you asked for. Or we will make sure your communications are easy to put in the form and format you asked for.
• Your request for confidential communications lasts until you cancel it or submit a new request for confidential communications.
• We will not ask you for the reason for your request. While we will make every effort to accommodate reasonable requests, we are not required to agree to requests.If we do agree, we will comply unless the information is needed to provide you with emergency treatment.

Access your health information.

Subject to certain exceptions, you have the right to view or get a copy of your PHI that we maintain in records relating to your care or decisions about your care or payment for your care. To request a copy summary, or explanation of this  health information, mail a written request to HPSM’s Privacy Officer. We may charge a reasonable, cost-based fee.

Receive notice of a breach

A breach is when protected health information is obtained, used or revealed in a way that violates relevant privacy laws. We are required to send you a notice that explains:

• What happened.
• The types of information involved in the breach.
• Steps you should take to protect your information.
• What HPSM is doing to investigate the situation, minimize harm to you and prevent future breaches.

Amend incorrect or incomplete health and claims records

ou have the right to request an amendment for as long as we maintain the information. A written comment will then be added to your health information at HPSM. To request an amendment, mail a written request to HPSM’s Privacy Officer specifying the inaccurate or incorrect health information and reason or evidence that supports your request.

• If we deny your request to amend your health information, we will tell you why and  explain your right to file a written statement of disagreement.. You must clearly tell us in writing if you want us to include your statement in future disclosures we make of that part of your record. We may include a summary instead of your statement. 

An accounting of disclosures

You have the right to request a list of disclosures that we made of your health information. The list does not include some disclosures, such as those made for your treatment, payment for your care, and our operations. It also does not include most other disclosures that we are required or permitted to make without your authorization (such as governmental agencies that review our programs or disclosures you authorize us to make). To request an accounting of disclosures, mail a written request to HPSM’s Privacy Officer. Your request must only include dates within the last six years of the date of your request.

You will be notified of changes to this notice

We reserve the right to change this notice then make it effective for all health information we already have about you as well as any we receive in the future. We will notify you of changes to this notice by mail within 60 days of the changes. We will also post a copy of the most current notice on our website at www.hpsm.org/privacy-policy.

How to file a grievance regarding your privacy rights

If you believe your privacy rights have been violated, you may file a grievance with HPSM. You will not be penalized for filing a grievance. You may also contact the U.S. Department of Health and Human Services to file a complaint.