The HIPAA privacy regulation is a "use and disclosure" set of requirements enacted in 2003 that defines how we can use and share your confidential medical information. The regulation limits the use and disclosure of Protected Health Information (PHI). PHI is individually identifiable health information that includes your demographic and clinical information as well as related business and insurance data.
Under the HIPAA Privacy Rule, you have individual rights that allow you to request the following:
Notice of privacy practices
Authorize the release of Protected Health Information (PHI)
Appoint a personal representative
Access to your medical record and be permitted a copy of it
An accounting of your medical information and record disclosures
Amendment to your Protected Health Information
Confidential communication
Restriction on the use and sharing of your medical information
Make a privacy complaint
File a request
Notice of Privacy Practices
A Notice of Privacy Practices is issued to all Service Benefit Plan contract holders when they enroll and whenever there is a material change to the privacy practices provided in the notice. In situations where there are material changes, the revised Notice of Privacy Practices will be distributed to all contract holders within 60 days of the change. To review our current privacy practices please download the following:
Authorization for Release of Protected Health Information (PHI)
In order for BlueCross and BlueShield Health Plans to disclose information about you that is not for the purposes of treatment, payment or healthcare operations, you must first authorize a person and/or organization to receive your PHI. By completing and submitting an Authorization for Release of Protected Health Information form, you are allowing the designated individual(s) to have access to only the PHI specified by you on the form.
This form is ideal if you need assistance with handling specific claims or only wish for the designated individual to have limited access to your PHI that will expire in a timeframe not more than one year. It is important to note that this form does not allow the authorized individual(s)/organization(s) to make any healthcare decisions on your behalf. If you wish to authorize the designated individual to be able to make healthcare decisions on your behalf you will need to use a Personal Representative Authorization Form.
This form will generally require the following information (1) a description of the PHI to be Used or Disclosed, (2) a statement of who is authorized to receive the PHI, (3) A description of the purpose for which the disclosure is permitted, (4) an expiration date, and (5) member's signature.
Personal Representative Authorization
The Personal Representative Authorization form allows you to designate a personal representative who will act on your behalf in making decisions related to healthcare, which includes treatment and payment issues. This individual can be a family member, friend, lawyer or unrelated third party.
Your designated personal representative stands in your shoes and has the ability to act for you and exercise your rights. For instance, at your request BCBS must provide your personal representative access to your Protected Health Information (PHI) to the extent such information is relevant. In addition to exercising your rights under the Privacy Rule of the Health Insurance Portability and Accountability Act, a personal representative may also authorize disclosures of your Protected Health Information (PHI).
This form is ideal if you require ongoing, comprehensive assistance. It is important to understand that the individual you list as your personal representative has the authority to make healthcare-related decisions on your behalf. If you require permanent assistance with your healthcare needs, you may also submit a legal power of attorney to BCBS.
Request for Access
The Request for Access form is used to make a request to inspect and/or obtain copies of your Protected Health Information (PHI) maintained by BCBS and our Business Associates.
Please note that the BCBS reserves the right to deny access to psychotherapy notes, information compiled for legal proceedings, on-going research or obtained from a confidential source. We also reserve the right to deny access if we believe it may cause you any harm, but we must grant you a review procedure.
Request for Accounting of Disclosures
The Request for an Accounting of Disclosures form allows you to receive an accounting of the disclosures of your Protected Health Information (PHI) by BCBS or our business associates. The maximum disclosure accounting period is the six years immediately preceding the accounting request; however we are not obligated to account for any disclosure made prior to the Privacy Rule compliance date of April 14, 2003.
The Privacy Rule does not require accounting for disclosures:
- for treatment, payment or healthcare operations
- to you or your personal representative
- for notification of or to persons involved in your healthcare or payment for healthcare, for disaster relief or for facility directories
- pursuant to an authorization
- of a limited data set
- for national security or intelligence purposes
- to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody
- incident to otherwise permitted or required uses or disclosures
Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities.
BCBS must respond to your written request within 60 days from the date it was received. However, if we are unable to give the requested accounting to you within the 60-day deadline, we will notify you in writing that we will be utilizing our right to a 30-day extension provided we explain the reason for the delay and when we will act on your request.
Request for Amendment
The Request for Amendment form allows you to ask BCBS to amend medical information we have about you that you feel is incorrect or incomplete. You have the right to request an amendment as long as the information is kept by or for BCBS. Requests for amendments must provide a reason that supports your request and can be denied.
BCBS may deny your request only if the information was not created by us and the originator is no longer available, access is deniable or the Protected Health Information (PHI) in question is accurate and complete. If the amendment is denied, BCBS must accept a written statement of disagreement that will be kept with your designated record set.
The BCBS must respond to your written request within 30 days from the date it was received.
Request for Confidential Communication
The Request for Confidential Communication form allows you to request an alternative means or location for receiving communications of Protected Health Information (PHI) by means other than those that we typically employ. For example, you may request that the Health Plan communicate with you through a designated address or phone number.
BCBS must accommodate reasonable requests if you indicate that the disclosure of all or part of the PHI could endanger you. The Health Plan may not question your statement of endangerment. However, we may condition compliance with a confidential communication request on you specifying an alternative address or method of contact and explaining how any payment will be handled.
Once a request for confidential communication goes into effect, all of your PHI will be processed in accordance with your instructions. This means that we cannot process a request to withhold only the PHI relating to a specific condition, diagnosis, or treatment. Therefore, all documents that might contain PHI about all of the service you receive will be addressed to you and not the contract holder.
Even if you request confidential communications, the check for services you receive from a non-participating provider could be sent to you but made payable to the contract holder, unless you have made other payment arrangements with us. Therefore, we urge you to discuss with us how we can arrange to pay your claims for services that you receive from a non-participating provider. Accumulated payment information such as deductible status and catastrophic protection benefits in which your PHI might appear, will continue to appear on all future Explanation of Benefits (EOB) sent to the contract holder for service rendered by all providers (participating and non-participating).
If you terminate your request for confidential communication, the restriction will be removed for all of your PHI that we hold, including PHI that was previously protected. Therefore, you should not terminate a request for confidential communications if you remain concerned that disclosure of your PHI will endanger you.
Request for Restriction
The Request for Restriction form allows you to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
This form will generally require that you provide (1) the information you want to limit, and (2) how you want us to limit the use and/or disclosure of the information.
Make a Privacy Complaint
You may file a complaint to us if you believe that we have violated your privacy rights. This form will generally only require a description of the privacy right violation and your contact information for follow-up communication. As stated above, to make a complaint please contact the Privacy contact for your Blue Cross Blue Shield Plan.
How to file a request
All forms can be obtained from your Local Plan. To file a request, please submit the appropriate form for each item to the designated contact for your Local Plan, listed in the Local BCBS Privacy Assistance Information [PDF 30 KB]. Please note, it is important that you direct your request to this contact. In order to ensure your request is addressed in a timely manner.