MDHHS-Pub-2040 Privacy Notice for Medicaid and Other Medical Assistance Program.pdf

MDHHS-Pub-2040 (Rev. 10-24) 1

PRIVACY NOTICE

For Medicaid and Other Medical Assistant Programs Effective October 2024

This notice describes how personal and medical information about you may be used and disclosed and how you can get access to this information.

Please Review Carefully

For questions and/or problems, or help to translate, call the Beneficiary Help Line at 800-642-3195 or TTY 866-501-5656.

Spanish: Si usted, o alguien a quien usted está ayudando, tiene preguntas acerca de tiene derecho a obtener ayuda e información en su idioma sin costo alguno. Para hablar con un intérprete, llame al 800-642-3195 or TTY 866-501-5656.

Arabic: والمعلومات المساعدة على الحصول لك فیحق ، أسئلة تساعده شخص أي لدى أو لدیك كان إذا

800-642-3195 بالرقم اتصل ، مترجم مع للتحدث .تكلفة أي دون بلغتك اللازمة

BENEFICIARY HELP LINE 800-642-3195

Our Privacy Commitment to You. We care about your privacy. The information we collect about you is private.

We are required by law to give you notice of our privacy practices. Only people who have both the need and the legal right may see your information. We may disclose your information without your permission for purposes of treatment, payment, health care operations or when we are required by law to do so. For examples of some of the disclosures referenced below, go to www.michigan.gov/mdhhs, click on Assistance Programs, then Health Care Coverage, and look under Protected Health Information. MDHHS will follow these practices and notify affected individuals following a breach of unsecured protected health information.

Understanding the Type of Information We Have. When you enroll for assistance, MDHHS receives information about you. This information includes your date of birth, sex, ID number and other information. We also receive bills, reports, and other data from your doctor about your health care.

YOUR PRIVACY RIGHTS

You have the following rights regarding the health information that we have about you. Your requests must be made in writing to the Michigan Department of Health and Human Services at the address below. MDHHS has available forms to request your privacy rights, go to www.michigan.gov/mdhhs, click on Assistance Programs, then Health Care coverage, under Protected Health Information (HIPAA) a link will direct you to the forms related to your privacy rights. You can choose to use a MDHHS form or submit your own written request.

You have a right to:

Inspect and Copy In most cases, you have the right to look at or get copies of your records. You may be charged a fee for the cost of copying your records.

Amend You may ask us to change your records if you feel that there is a mistake. We can deny your request for certain reasons, but we must give you a written reason for our denial within 60 days.

List of Disclosures You have the right to ask for a list of disclosures made in the six years before the date of your request. Who we shared it with and why. This list will not include the times that information was disclosed for treatment, payment, or health care operations. The list will not include information provided directly to you or your family, or information that was sent with your permission.

Request Restrictions on Our Use or

You have the right to ask for limits on how your health information is used or disclosed. We are not required to agree to such requests unless (1) the disclosure is

MDHHS-Pub-2040 (Rev. 10-24) 2

Disclosure of Information for the purpose of carrying out payment or health care operations and is not otherwise required by law and (2) the protected health information pertains solely to a health care item or service for which you, or a person other than a health plan on your behalf, has paid us in full. We will notify you if we are unable to agree to a requested restriction.

Request Confidential Communications

You have the right to ask that we share information with you in a certain way or in a certain place. For example, you may ask us to send information to your work address instead of your home address. We may deny your request unless you clearly state your safety is at risk.

Revoke Authorization If you give us permission to use or disclose your health information, you have the right to change your mind and revoke it. This must be in writing. We cannot take back any uses or disclosures already made with your permission.

DISCLOSURES OF HEALTH INFORMATION

We may disclose your information without your permission for purposes of:

• Treatment. We may disclose health information about you to coordinate your health care.

• Payment. We may use and disclose information for proper billing and payment for the care you received.

• Health Care Operations. Information may be used and disclosed to operate the program.

• As Required by Law. We will release information when we are required by law to do so.

• Exceptions. For certain kinds of records, such as psychotherapy notes, your permission may be needed even for release for treatment, payment, and health care operations.

• With Your Permission. If you give us permission in writing, we may use and disclose your health information. If you give us permission, you have the right to change your mind and revoke it. This also must be in writing. We are unable to take back any uses or disclosures already made with your permission. With your consent, we may notify or release information about you to a friend or family member who is involved in your care.

• Substance Use Data. In addition to the above situations, MDHHS may be required to follow the use and disclosures guidelines under 42 CFR Part 2, which has different protections for sharing, storing, or using substance use data. While MDHHS is not a covered Part 2 program, there are times where the Part 2 protections apply.

ADDITIONAL EXAMPLES OF DISCLOSURES THAT MAY BE MADE WITHOUT YOUR PERMISSION

• Business Associates. There are some services, such as medical billing, provided in our organization through contracts with Business Associates They are required to appropriately safeguard and protect your health information.

• Research. If the research has been approved by an institutional review board or privacy board and the researchers, ensure the privacy of your information.

• Food and Drug Administration. We may disclose to the FDA, health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

• Worker Compensation. Health information may be disclosed to the extent authorized and required to comply with laws relating to compensation or other similar programs established by law.

MDHHS-Pub-2040 (Rev. 10-24) 3

• Public Health. Health information may be disclosed as authorized by law to public health and/or legal authorities charged with preventing or controlling disease, injury, or disability.

• Law Enforcement. Health information may be disclosed in response to a valid court order or required by law.

• Victims of Abuse, Neglect or Domestic Violence. Information about you may be disclosed as required by law, to a government authority, such as a social service or protective agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. If disclosure is allowed by law and we feel it is necessary to prevent serious harm to you or someone else.

• To Avert a Serious Threat to Health or Safety. Information about you may be disclosed if there is a compelling need to prevent a serious threat to your health and safety of the public or another person.

• Health Oversight. Health information may be disclosed to a health oversight agency for activities authorized by law.

• Inmates. If you are an inmate of a correctional institution or under custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official.

This release would be necessary for the institution to provide you with health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.

• Special Situations. Consistent with applicable law, we may disclose health information to funeral directors, coroners, medical examiners; as required by military command authorities; and for national activities. A mental health service recipients’ information will be disclosed only as allowed by Michigan law.

We will not use or disclose your information for any purpose not described in this notice without your permission.

For example, we will not sell, market, or use your information for fundraising purposes.

Reproductive Health Privacy Protections

A HIPAA covered health care provider, health plan, health care clearinghouse or their business associate, is not allowed to disclose reproductive health care information for the following reasons:

• To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.

• The identification of any person for the purpose of conducting such investigation or imposing such liability.

IF it has reasonably been determined by a HIPAA covered health care provider, health plan, health care clearinghouse or their business associate that one or more of the following conditions exist:

• The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.

• The reproductive health care is protected, required, or authorized by Federal law, including the U.S.

Constitution, regardless of the state in which such health care is provided.

• The reproductive health care was provided by a person other than the covered health care provider, health plan, or health care clearinghouse (or business associates) that receives the request for PHI and the presumption described below applies.

Covered health care providers, health plans, or health care clearinghouses (or business associates) are still allowed to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for the use or disclosure of PHI is not made to investigate or impose liability on any person for the simple act of seeking, obtaining, providing, or facilitating reproductive health care.

MDHHS-Pub-2040 (Rev. 10-24) 4

Attestation

To make sure that reproductive health information is shared correctly an attestation may be required. A health care provider, health plan, or health care clearinghouse (or business associate) may require the following areas provide an attestation before health information can be shared:

• Health oversight activities.

• Judicial and administrative proceedings.

• Law enforcement purposes.

• Disclosures to coroners and medical examiners.

Changes to this Notice

We reserve the right to revise this notice. A revised notice will be effective for health information we already have about you as well as any information we may receive in the future. We are required by law to comply with whatever notice is currently in effect. Any changes to our notice will be published on our website. Go to www.michigan.gov/mdhhs, click on Assistance Programs, then Health Care Coverage, and look under Protected Health Information. If the changes are material, a new notice will be mailed to you before it takes effect.

How to Use Your Rights Under this Notice

If you want to make a Privacy Rights request or file a complaint, your request or complaint must be in writing. If you are writing a complaint, tell us your name (and the name of the person affected, if you are filing the complaint for another person), identification number, what right you believe was violated, who you believe committed the violation, what you want done to correct the problem, and an address and telephone number where you can be contacted. You may get a complaint form by going to www.michigan.gov/mdhhs, click on Assistance Programs, then Health Care Coverage, click on Protected Health Information. Requests and complaints should be sent to:

Privacy Officer/Compliance Office Michigan Department of Health and Human Services 235 South Grand Avenue, 4th Floor Lansing, Michigan 48933

OR

Phone: 517-284-1018 Michigan Relay Center: 711 Email: mdhhsprivacysecurity@michigan.gov

You also have the right to file a complaint with the federal government. Written complaints should be sent to:

Centralized Case Management Operations U.S. Department of Health and Human Services 200 Independence Avenue, S.W.

Room 509F HHH Bldg.

Washington, D.C. 20201

OR

Phone: 800-368-1019

TDD: 800-537-7697

Email: OCRComplaint@hhs.gov

You will not be penalized or retaliated against for filing a complaint with either MDHHS or the federal government.

Copies of this Notice You have the right to receive an additional copy of this notice at any time. Call or write to request a copy.

The Michigan Department of Health and Human Services (MDHHS) does not discriminate against any individual or group on the basis of race, national origin, color, sex, disability, religion, age, height, weight, familial status, partisan considerations, or genetic information. Sex-based discrimination includes, but is not limited to, discrimination based on sexual orientation, gender identity, gender expression, sex characteristics, and pregnancy.

mailto:OCRComplaint@hhs.gov