Human Resources

• This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. This Notice is provided to you on behalf of:» Health Insurance Plan for Ferrum College» Delta Dental Plan for Ferrum College» Vision Insurance Plan for Ferrum College» Employee Assistance Plan for Ferrum College» Ferrum College Section 125 Cafeteria PlanThese plans comprise what is called an “Affiliated Covered Entity” and are treated as a single plan for purposes of this Notice and the privacy rules that require it. For purposes of this Notice, we’ll refer to these plans as a single “Plan.” The Plan’s Duty to Safeguard Your Protected Health Information.
  Individually identifiable information about your past, present, or future health or condition, the provision of health care to you, or payment for the health care is considered “Protected Health Information” (“PHI”). The Plan is required to extend certain protections to your PHI and to give you this Notice about its privacy practices that explains how, when, and why the Plan may use or disclose your PHI. Except in specified circumstances, the Plan may use or disclose only the minimum necessary PHI to accomplish the purpose of the use or disclosure. The Plan is required to follow the privacy practices described in this Notice, though it reserves the right to change those practices and the terms of this Notice at any time. If it does so, and the change is material, you will receive a revised version of this Notice either by hand delivery, mail delivery to your last known address, or some other fashion. This Notice, and any material revisions of it, will also be provided to you in writing upon your request (ask your Human Resources representative, or contact the Plan’s Privacy Official, described below), and will be posted on any website maintained by Ferrum College that describes benefits available to employees and dependents. You may also receive one or more other privacy notices, from insurance companies that provide benefits under the Plan. Those notices will describe how the insurance companies use and disclose PHI and your rights with respect to the PHI they maintain. How the Plan May Use and Disclose Your Protected Health Information.
  The Plan uses and discloses PHI for a variety of reasons. For its routine uses and disclosures, it does not require your authorization, but for other uses and disclosures, your authorization or the authorization of your personal representative (e.g., a person who is your custodian or guardian or has your power-of-attorney) may be required. The following offers more description and examples of the Plan’s uses and disclosures of your PHI.

Treatment: Generally, and as you would expect, the Plan is permitted to disclose your PHI for purposes of your medical treatment. Thus, it may disclose your PHI to doctors, nurses, hospitals, emergency medical technicians, pharmacists and other health care professionals where the disclosure is for your medical treatment. For example, if you are injured in an accident, and it’s important for your treatment team to know your blood type, the Plan could disclose that PHI to the team in order to allow it to more effectively provide treatment to you.

Payment: Of course, the Plan’s most important function, as far as you are concerned, is that it pays for all or some of the medical care you receive (provided the care is covered by the Plan). In the course of its payment operations, the Plan receives a substantial amount of PHI about you. For example, doctors, hospitals, and pharmacies that provide you care send the Plan detailed information about the care they provided so that they can be paid for their services. The Plan may also share your PHI with other plans in certain cases. For example, if you are covered by more than one health care plan (e.g., covered by this Plan, and your spouse’s plan, or covered by the plans covering your father and mother), we may share your PHI with the other plans to coordinate payment of your claims.

Health care operations: The Plan may use and disclose your PHI in the course of its “health care operations.” For example, it may use your PHI to evaluate the quality of services you received or disclose your PHI to an accountant or attorney for audit purposes. In some cases, the Plan may disclose your PHI to insurance companies for purposes of obtaining various insurance coverage.

The law provides that the Plan may use and disclose your PHI without authorization in the following circumstances:

To the Plan Sponsor: The Plan may disclose PHI to the employers (such as Ferrum College) who sponsor or maintain the Plan for the benefit of employees and dependents. However, the PHI may only be used for limited purposes, and may not be used for purposes of employment-related actions or decisions or in connection with any other benefit or employee benefit plan of the employers. PHI may be disclosed to: the human resources or employee benefits department for purposes of enrollments and dis-enrollments, census, claim resolutions, and other matters related to Plan administration; the payroll department for purposes of ensuring appropriate payroll deductions and other payments by covered persons for their coverage; information technology department, as needed for preparation of data compilations and reports related to Plan administration; finance department for purposes of reconciling appropriate payments of premium to and benefits from the Plan, and other matters related to Plan administration; internal legal counsel to assist with resolution of claim, coverage and other disputes related to the Plan’s provision of benefits.

Required by law: The Plan may disclose PHI when a law requires that it report information about suspected abuse, neglect, or domestic violence, or relating to suspected criminal activity, or in response to a court order. It must also disclose PHI to authorities that monitor compliance with these privacy requirements.

For public health activities: The Plan may disclose PHI when required to collect information about disease or injury or to report vital statistics to the public health authority.

For health oversight activities: The Plan may disclose PHI to agencies or departments responsible for monitoring the health care system for such purposes as reporting or investigation of unusual incidents.

Relating to decedents: The Plan may disclose PHI relating to an individual’s death to coroners, medical examiners, or funeral directors and to organ procurement organizations relating to organ, eye, or tissue donations or transplants.

For research purposes: In certain circumstances, and under strict supervision of a privacy board, the Plan may disclose PHI to assist medical and psychiatric research.

To avert threat to health or safety: In order to avoid a serious threat to health or safety, the Plan may disclose PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm.

For specific government functions: The Plan may disclose PHI of military personnel and veterans in certain situations, to correctional facilities in certain situations, to government programs relating to eligibility and enrollment, and for national security reasons.

Uses and Disclosures Requiring Authorization: For uses and disclosures beyond treatment, payment, and operations purposes and for reasons not included in one of the exceptions described above, the Plan is required to have your written authorization. Your authorizations can be revoked at any time to stop future uses and disclosures, except to the extent that the Plan has already undertaken an action in reliance upon your authorization.

Uses and Disclosures Requiring You to Have an Opportunity to Object: The Plan may share PHI with your family, friend, or other person involved in your care or payment for your care. We may also share PHI with these people to notify them about your location, general condition, or death. However, the Plan may disclose your PHI only if it informs you about the disclosure in advance and you do not object (but if there is an emergency situation and you cannot be given your opportunity to object, disclosure may be made if it is consistent with any prior expressed wishes and disclosure is determined to be in your best interests; you must be informed and given an opportunity to object to further disclosure as soon as you are able to do so).

You have the following rights relating to your protected health information:

To request restrictions on uses and disclosures: You have the right to ask that the Plan limit how it uses or discloses your PHI. The Plan will consider your request but is not legally bound to agree to the restriction. To the extent that it agrees to any restrictions on its use or disclosure of your PHI, it will put the agreement in writing and abide by it except in emergency situations. The Plan cannot agree to limit uses or disclosures that are required by law.

To choose how the Plan contacts you: You have the right to ask that the Plan send you information at an alternative address or by an alternative means. The Plan must agree to your request as long as it is reasonably easy for it to accommodate the request.

To inspect and copy your PHI: Unless your access is restricted for clear and documented treatment reasons, you have a right to see your PHI in the possession of the Plan or its vendors if you put your request in writing. The Plan, or someone on behalf of the Plan, will respond to your request, normally within 30 days. If your request is denied, you will receive written reasons for the denial and an explanation of any right to have the denial reviewed. If you want copies of your PHI, a charge for copying may be imposed but may be waived, depending on your circumstances. You have a right to choose what portions of your information you want copied and to receive, upon request, prior information on the cost of copying.

To request amendment of your PHI: If you believe that there is a mistake or missing information in a record of your PHI held by the Plan or one of its vendors, you may request, in writing, that the record be corrected or supplemented. The Plan or someone on its behalf will respond, normally within 60 days of receiving your request. The Plan may deny the request if it is determined that the PHI is: (i) correct and complete; (ii) not created by the Plan or its vendor and/or not part of the Plan’s or vendor’s records; or (iii) not permitted to be disclosed. Any denial will state the reasons for the denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to your PHI. If the request for amendment is approved, the Plan or vendor, as the case may be, will change the PHI, so inform you and tell others who need to know about the change in the PHI.

To find out what disclosures have been made: You have a right to get a list of when, to whom, for what purpose, and what portion of your PHI has been released by the Plan and its vendors, other than instances of disclosure for which you gave authorization, or instances where the disclosure was made to you or your family. In addition, the disclosure list will not include disclosures for treatment, payment, or healthcare operations. The list also will not include any disclosures made for national security purposes to law enforcement officials or correctional facilities or before the date the federal privacy rules applied to the Plan. You will normally receive a response to your written request for such a list within 60 days after you make the request in writing. Your request can relate to disclosures going as far back as six years. There will be no charge for up to one such list each year. There may be a charge for more frequent requests.

If you think the Plan or one of its vendors may have violated your privacy rights, or if you disagree with a decision made by the Plan or a vendor about access to your PHI, you may file a complaint with the person listed in the section immediately below. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services. The law does not permit anyone to take retaliatory action against you if you make such complaints.

Contact Person for Information or to Submit a Complaint.
If you have questions about this Notice, please contact the Plan’s Privacy Official or Deputy Privacy Official(s) (see below). If you have any complaints about the Plan’s privacy practices or handling of your PHI, please contact the Plan’s Privacy Official (see below).

Privacy Official
The Plan’s Privacy Official, the person responsible for ensuring compliance with this Notice, is:

Bobby W. Thompson, Senior Vice President & Treasurer, (540) 365-4233

The Plan’s Deputy Privacy Official(s) is/are:
Melanie B. Shandor, Director Of Human Resources, (540) 365-4235
Linda P. Edwards, Assistant Director Of Human Resources, (540) 365-4244

Organized Health Care Arrangement Designation
The Plan participates in what the federal privacy rules call an “Organized Health Care Arrangement.” The purpose of that participation is that it allows PHI to be shared between the members of the Arrangement, without authorization by the persons whose PHI is shared, for healthcare operations. Primarily, the designation is useful to the Plan because it allows the insurers who participate in the Arrangement to share PHI with the Plan for purposes such as shopping for other insurance bids.

The members of the Organized Health Care Arrangement are:

• » Health Insurance Plan for Ferrum College
• » Delta Dental Plan for Ferrum College
• » Vision Insurance Plan for Ferrum College
• » Employee Assistance Plan for Ferrum College
• » Ferrum College Section 125 Cafeteria Plan
• » Southern Health Services
• » Delta Dental Plan of Virginia
• » Vision Service Plan
• » Carilion Health System

Effective Date
The effective date of this Notice is: April 14, 2004.