Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This notice is effective April 1, 2010.

At Group Health Cooperative, safeguarding your privacy and the confidentiality of your personal information has always been a priority.

Our internal policies and procedures are designed to control and protect the confidentiality and security of your personal information whether in written, oral, or electronic format. We train our employees on these policies and procedures. Employees who violate our confidentiality and security policies are subject to disciplinary action.

This notice is based on state and federal law, as well as on our own code of ethics. We are required by law to protect the privacy of your personal information and provide you with this notice, which explains our responsibilities and privacy practices regarding your personal information. We are also required to abide by the terms of this notice.

In this notice, the term "personal information" refers to any medical or financial information that can reasonably be used to identify you and that relates to your physical or mental health or condition, the provision of health care to you, or the payment for that care. Personal information may include your name, social security number, address, telephone number, employment, medical history, health records, claims information, or credit card number.

This notice applies to all patients receiving care in Group Health Cooperative-owned and -operated facilities as well as to enrollees covered under Group Health Cooperative and Group Health Options, Inc. plans. This notice applies to patients being cared for in Group Health Cooperative facilities by Group Health Permanente doctors and clinicians as well as by other contracted providers with which we have organized health care arrangements (OHCA). Group Health Cooperative and our OHCA partners use and share our patients' personal information to provide health care treatment, receive payment for health care services provided, and conduct health care operations. Health care operations are business activities that support the delivery of health care. In this notice the terms "we," "us," "our," and "Group Health" describe and apply to all of these entities.

About Group Health

Group Health Cooperative and Group Health Options, Inc. offer health care coverage to enrollees through individual and group plans. Group Health Cooperative also directly delivers care in medical facilities we own and operate. Depending on your relationship with Group Health, we may collect, use, and share your information in slightly different ways.

When you apply for health coverage with Group Health, we may receive your personal information directly from you or from third parties, which may include agents, brokers, a trust, or your employer. We may share your personal information with the health plan administrator through which you receive your health benefits, to permit them to manage the business functions of the health plan. For example, we may share enrollment and eligibility information with plan administrators. We may also share information that does not identify specific enrollees with a plan administrator to obtain premium bids or to modify or terminate a health plan.

If you are enrolled in a self-funded plan through your employer, Group Health Cooperative and Group Health Options, Inc. may act as an "administrative services organization" for your self-funded plan and may receive and share information with the plan administrator, usually your employer, for certain administrative activities. For example, we may share claims information for health care services you have received. The plan administrator must confirm that it will protect your personal information in accordance with law. Please ask your employer for more details.

If you are a patient at a Group Health Cooperative-owned and -operated medical facility, we keep a record of health care services you receive from us, as well as medical records sent to us from other providers. We will not share your information with others unless you direct us to or the law authorizes or requires us to. For more information, see the section in this notice, "How we may use and share your personal information."

Your Rights

You have rights regarding personal information that we maintain about you. If you do not receive treatment in a Group Health Cooperative medical facility, some of these statements may not apply to you. You may get more information about exercising any of these rights by calling the Privacy Office at 206-448-2422.

Request Restrictions: You may request that we limit the way we use or share your personal information outside of Group Health. You may also ask that we limit the information we give to friends and family members involved in your care.

Confidential Communication: You may ask that we contact you at a different address or phone number. We will usually be able to accommodate your request. Please make your request to us in writing.

Inspect and Copy: You may review and request a copy of information in your medical record maintained by Group Health Cooperative. We may ask you to make this request in writing. We may charge a reasonable fee for the cost of producing and mailing the copies. In certain situations we may deny your request and tell you why we are denying it. You have the right to ask for a review of our denial.

Amendments: You may ask us to correct or amend information in your medical record. Your request for a change to your medical record must be in writing and must give a reason for your request. We may deny your request, but you may respond by filing a written statement of disagreement and ask that the statement be included with your medical record.

Accounting of Disclosures: You may seek an accounting of certain disclosures by asking us for a list of the times we have shared your personal medical information. Your request must be in writing and must give us the specific information we need in order to respond to your request.

Receive an additional copy of this notice: You may request a copy or ask general questions about this notice by calling Group Health Customer Service at 206-901-4636 or toll free at 1-888-901-4636. You may also view this notice on our Web site at www.ghc.org.

How We May Use and Share Your Personal Information

Group Health uses and shares your personal information in a number of ways connected to your treatment, payment for your care, and our health care operations. Some examples of how we may use or share your personal information without your authorization are described below. If you do not receive your health care from Group Health Cooperative, some of the following examples may not apply to you.

Treatment

If you are a patient in a Group Health Cooperative medical facility, we may use or share your personal information to provide you medical care. For example, our physicians, nurses, pharmacists, and lab technicians may share your health information to provide you health care services. In addition, we may share your health information with health care providers or suppliers outside of Group Health for consultation, referral, or coordination of your care.

Payment

If you are a Group Health Cooperative or Group Health Options, Inc. enrollee, we may receive your personal information from health care providers who treat you, so we can pay them in accordance with your health benefit plan. We may use or share your personal information for payment of the care you receive. Payment purposes could also include determining benefit eligibility and coordinating benefits with other health plans, reviewing services for medical necessity, paying a claim, performing utilization review, obtaining premiums, subrogating a claim, and collection activities.

Health care operations

We may use and share your personal information to carry out health care operations. For example, we may use your personal information to review and improve the care you receive, to provide care management, for health plan underwriting, to administer and review a health plan, to conduct medical reviews, and to provide customer service. Other uses may include determining coverage policies, business planning, arranging for legal and auditing services, and obtaining accreditations and licenses. Please note that Group Health is not allowed to use or share your genetic information for underwriting purposes, to adjust premiums, or to make enrollment/eligibility determinations based on your predisposition to a genetic condition. Group Health is also prohibited from requesting, requiring, or purchasing genetic information about an individual prior to enrollment. Incidental collection of genetic information does not violate the law.

We may also contract with individuals or entities known as business associates to work on our behalf, which may require us to use and share your personal information. Our business associates must agree in writing to safeguard the confidentiality of your personal information.

Certain state and federal laws may require us to share your personal information. For example, we may be obligated to share your information:

• With an authorized public health authority or their agent to protect public health and safety; to prevent or control certain diseases, injuries, or conditions; to report vital events such as births or deaths; and to investigate or track problems with prescription drugs and medical devices when requested by the U.S. Food and Drug Administration (FDA). We may also participate in registries required by law, such as the cancer registry or the trauma registry.
• With the workers' compensation program, which provides benefits to you if you have a work-related injury or illness.
• With government benefit programs, like Medicare and Medicaid, in order to review your eligibility and enrollment in these programs.
• With government entities authorized to receive reports regarding child or vulnerable adult abuse or neglect.
• With health oversight agencies. As health plans and health care providers, we must agree to oversight reviews by federal and state agencies. These agencies may, by law, conduct audits, perform inspections and investigations, license health care providers, health plans, and health care facilities, and enforce federal and state regulations.
• In response to a court order and, in certain cases, in response to a subpoena, discovery request, or other lawful process.
• With law enforcement officials in limited circumstances. For example, disclosures may be made to report a crime on Group Health property.
• With armed forces personnel for military activities and to authorized federal officials for national security activities and intelligence purposes.
• With funeral directors and organ donation organizations, as authorized by law, to assist with their responsibilities.
• To county coroners for the investigation of deaths, as authorized by law.
• To a correctional facility if you are an inmate. We may share your personal information, as allowed by law, for your health and the health and safety of others.
• We may also use and share your health information to avert a threat to the health and safety of a person or the public.

We may also use or share your personal medical information without your authorization in the following circumstances:

Family, domestic partner, or friend: To a family member, domestic partner, friend, or a person you identify when you are present and agree, or when you are not present or are incapacitated and in our professional judgment it is in your best interest to disclose information about your care.

Facility directory information: If you are a patient, in some cases we may use and share your name, the location where you are receiving care, your general condition, and your religious affiliation in our facility directory. You will be given the opportunity to decline.

Appointment reminders: If you are a patient, to remind you by mail or phone that you have a health care appointment with us.

Plan description: To communicate with you about our networks, health plans, and providers.

Preventive health services and treatment alternatives: To remind you about preventive health services or to let you know about treatment alternatives, providers, settings of care, or health and wellness products or services that are available for you as an enrollee of Group Health.

Fundraising: We may contact you to raise funds for the Group Health Foundation, a nonprofit charitable organization supporting Group Health and the community. We only use information such as your name, address, phone number, and dates that you received treatment or service from us. You will be given the opportunity to direct us not to contact you for this purpose.

Research: For medical research conducted by the Group Health Research Institute or other research teams, provided that certain steps are taken to protect your privacy. Generally, an institutional research review board evaluates each research project to ensure that researchers follow processes that will protect your privacy before your personal medical information is shared with researchers or used in a research study.

Other Uses of Your Medical Information

Except in the situations described above, we will use and share your personal information only with your written permission or authorization. In some situations, federal and state laws provide special protections for specific kinds of personal medical information and require authorization from you before we can share that specially protected medical information. For example, information about treatment for alcohol or drug abuse, sexually transmitted disease, and mental health is specially protected. In these situations and for any other purpose, we will contact you for the necessary authorization. If you sign an authorization to release your health care information, you may withdraw it at any time by letting us know in writing.

Questions and Complaints

If you have questions about this notice or want to file a complaint about our privacy practices, including our process for breach notification, write to:

Group Health Privacy Officer
Group Health Cooperative
320 Westlake Ave. N., Suite 100
Seattle, WA 98109-5233

For more information on how to file a written complaint, call the Privacy Office at 206-448-2422. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you if you file a complaint about our privacy practices with us or with the Department of Health and Human Services.

Changes to Privacy Practices

We may change the terms of this notice at any time. If we change any of the privacy practices described in this notice, we will post the revised notice on our Web site, at www.ghc.org and in Group Health medical facilities. We may also give you additional information about our privacy practices in other notices we provide.