Back

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Overview
       
Certificates of Creditable Coverage
       
Disclosure of Protected Information
       
Adding New Dependents
       
Continuing Coverage through COBRA
       
Privacy Notice



Overview

The Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation that focuses on the portability, privacy and security of the participant and participant's dependent's health information. HIPAA protects the participant and participant's dependents by:

  • Limiting exclusions for pre-existing medical conditions;
  • Providing credit against maximum pre-existing condition exclusion periods for prior health coverage and a process for providing certificates showing periods of prior coverage to a new group health plan or health insurance issuer;
  • Providing new rights that allow individuals to enroll for health coverage when they lose other health coverage, get married, or add a new dependent;
  • Prohibiting discrimination in enrollment and in premiums charged to employees and their dependents based on health status-related factors; and
  • Ensuring the privacy of the participant's protected health information


Certificates of Creditable Coverage

The participant will receive, free of charge, a certificate of creditable coverage when the participant and his or her dependents lose health care coverage, become eligible for COBRA continuation coverage or exhaust COBRA continuation coverage. A certificate must also be provided free of charge upon request while the participant has health coverage or anytime within 24 months after coverage ends.

Certificates of creditable coverage should contain information about the length of time the participant and his or her dependents had coverage as well as the length of any waiting period for coverage that applied to the participant and his or her dependents.

If a certificate is not received, or if the information on the certificate is wrong, the participant should contact the prior plan or issuer. The participant has a right to show prior creditable coverage with other evidence — such as pay stubs, explanations of benefits, letters from a doctor — if the participant cannot get a certificate.



Disclosure of Protected Information

The confidentiality of the participant's health information is important. Leidos is required to maintain the confidentiality of the participant's information and has policies and procedures and other safeguards to help protect the participant's information from improper use and disclosure.

Leidos is allowed by law to use and disclose certain information without the participant's written permission. For example, Leidos may share information with the participant's health care provider to determine whether he or she is enrolled in the plan or whether premiums have been paid on the participant's behalf. Leidos may also share the participant's information when legally required to do so — for example, in response to a subpoena or if the participant's medical safety may be at risk.

When the participant's authorization is required and the participant authorizes Leidos to use or disclose personal information for some purpose, the participant may revoke that authorization by notifying Leidos in writing at any time.

The participant's health care provider must have a Notice of Privacy Practices and provide the participant with a copy. For more information, contact Aetna Member Services.



Adding New Dependents

Under HIPAA, the participant has 31 days following marriage or the birth, adoption, or placement for adoption of a child to enroll a dependent in the health plans. The participant does not have to provide any medical or health information to enroll a dependent.



Continuing Coverage through COBRA

A federal law called the Consolidated Omnibus Budget Reconciliation Act (COBRA) enables a participant and the participant's covered dependents to continue health insurance if coverage ceases due to a reduction of work hours or termination of employment (other than for gross misconduct). Federal law also enables a participant's dependents to continue health insurance if their coverage stops due to the participant's death or entitlement to Medicare; divorce; legal separation; or when the child no longer qualifies as an eligible dependent. The participant must elect coverage according to the rules of the Leidos health care plans. Continuation is subject to federal law, regulations, and interpretations.

In accordance with COBRA, a participant and his or her family have some important rights concerning the continuation of group health care benefits if that coverage ceases.

Leidos maintains six types of plans that are subject to federal COBRA requirements:

  • Medical
  • Dental
  • Vision
  • Employee Assistance and Work/Life Program (EAP)
  • Health Care Flexible Spending Accounts
  • Mission for Life Wellness Program

Some state laws may offer additional COBRA benefits. For more information, review the insured plan's Evidence of Coverage booklet.

Who Is Eligible for COBRA

  • A covered participant who loses coverage due to termination (other than termination for gross misconduct) or reduction in work hours. Termination includes voluntarily quitting, layoff, and lack of work due to a work location closure.
  • The spouse, domestic partner and/or dependent children of a covered participant who are covered under the plan and who lose coverage as a result of any of the following qualifying events**:
    • The death of a covered employee;
    • The termination of a covered employee (excluding termination due to gross misconduct);
    • The divorce, legal separation, or dissolution of domestic partnership of the covered employee from his or her spouse or domestic partner;
    • A dependent's ceasing to qualify as a "dependent child" under the terms of the plan; or
    • The covered employee's becoming entitled to Medicare benefits.

**To continue coverage for a spouse/domestic partner and/or dependent child(ren), it is the participant's (or a family member's) responsibility to notify the Benefits POC within 31 days of a divorce, legal separation, dissolution of domestic partnership or child's losing dependent status.

How Long COBRA Coverage May Last

The coverage period begins on the date of the qualifying event and ends upon the earliest of the following:

  • 18 months in the case of termination of employment, layoff, or work force reduction;
  • 24 months in the case of military leave of absence;
  • 29 months in the event of a disability, according to Social Security;
  • 36 months in the event of legal separation, divorce, dissolution of domestic partnership or death of the employee;
  • 36 months in the event of all other qualifying events;
  • Failure to pay any required premium when due;
  • The date a covered participant, under the continuation program, becomes covered under another group plan or Medicare — one that does not impose any pre-existing condition limitations on the coverage; or
  • The date that Leidos no longer provides a group medical plan to any of its employees.

The participant must apply for this coverage continuation within 60 days from the date the participant's Leidos medical coverage terminates or the date of notification, whichever is later. The participant then has 45 days from the date he or she elected continued coverage to pay all of the premiums back to the date he or she would have lost plan coverage. The participant will be charged the plan's full cost of providing a continued coverage, plus an additional 2% administrative fee (102% of the premium). If the participant wants to continue coverage through COBRA, please contact the number indicated on the notification letter, or, if eligible due to divorce, legal separation, dissolution of domestic partnership or loss of dependent status, contact the Benefits POC for information and forms.

To be eligible for the additional 11 months coverage due to disability, the participant must provide the Plan Administrator with: a Social Security Disability Award (SSDI) during the first 18 months of COBRA indicating the onset of the disability was within 60 days of losing coverage; and the Plan Administrator is informed of that within 60 days of receipt of the Notice of Award letter from Social Security by receiving a copy of that letter. A participant who qualifies for the disability extension will be charged the plan's full cost of providing a continued coverage, plus an additional 50% administrative fee (150% of the premium).

Participants must apply for continuation of coverage under COBRA within 60 days after receiving COBRA notification and enrollment information.

The following table summarizes COBRA benefits under the Leidos health care plans:

THE SITUATION OBTAINING INFORMATION WHO CAN BE COVERED HOW LONG COVERAGE CAN LAST

The participant's employment with Leidos is terminated for reasons other than gross misconduct

It will be sent to the participant automatically by Leidos' COBRA administrator

The participant and the participant's dependents

18 months

There is a reduction in the participant's work hours to the point where the participant no longer qualifies for benefits coverage

It will be sent to the participant automatically by Leidos' COBRA administrator

The participant and the participant's dependents

18 months

The participant begins a military leave of absence

The participant must notify the group Human Resources/Benefits POC; forms sent upon notice of ineligibility

The participant and the participant's dependents

24 months

The participant is disabled according to Social Security

The participant must notify Leidos' COBRA administrator

The participant and the participant's dependents

29 months

The participant dies

It will be sent to the covered dependents automatically by Leidos' COBRA administrator

The participant's currently covered dependents

36 months

The participant becomes divorced, legally separated or dissolves a domestic partnership

The participant must notify the group Human Resources/Benefits POC; forms sent upon notice of ineligibility by Leidos' COBRA administrator

The participant's former spouse or domestic partner

36 months

The participant's dependent reaches age 26

The participant must notify the group Human Resources/Benefits POC; forms sent upon notice of ineligibility

The participant's dependent

36 months

Participants that lose health coverage as a result of an Open Enrollment action will not receive COBRA information.



Privacy Notice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) imposes numerous requirements on employer health plans concerning the use and disclosure of individual health information. This information, known as protected health information, includes virtually all individually identifiable health information held by the Leidos Health & Welfare Benefits Plan ("Plan") — whether received in writing, in an electronic medium, or as an oral communication. This notice describes the privacy practices of the following plans:

  • Healthy Focus Essential Plan
  • Healthy Focus Advantage Plan
  • Leidos Dental PPO

The plans are administered by Aetna, Anthem Blue Cross and CIGNA Behavioral Health. The plans covered by this notice may share health information with each other to carry out treatment, payment, or health care operations. These plans are collectively referred to as the Plan in this notice, unless specified otherwise.

The Plan's Duties With Respect to Health Information About You

The Plan is required by law to maintain the privacy of your health information and to provide you with this notice of the Plan's legal duties and privacy practices with respect to your health information. If you participate in a fully insured plan option (such as an HMO plan) you will receive a notice directly from the Insurer. It's important to note that these rules apply to the Plan, not Leidos as an employer — that's the way the HIPAA rules work. Different policies may apply to other Leidos programs or to data unrelated to the health plan.

How the Plan May Use or Disclose Your Health Information

The privacy rules generally allow the use and disclosure of your health information without your permission (known as an authorization) for purposes of health care treatment, payment activities, and health care operations. Here are some examples of what that might entail:

  • Treatment includes providing, coordinating, or managing health care by one or more health care providers or doctors. Treatment can also include coordination or management of care between a provider and a third party, and consultation and referrals between providers. For example, the Plan may share health information about you with physicians who are treating you.
  • Payment includes activities by this Plan and its administrators, AETNA and ANTHEM BLUE CROSS, other plans, or providers to obtain premiums, make coverage determinations and provide reimbursement for health care. This can include eligibility determinations, reviewing services for medical necessity or appropriateness, utilization management activities, claims management, and billing; as well as "behind the scenes" plan functions such as risk adjustment, collection, or reinsurance. For example, the Plan may share information about your coverage or the expenses you have incurred with another health plan in order to coordinate payment of benefits.
  • Health care operations include activities by this Plan (and in limited circumstances other plans or providers) such as wellness and risk assessment programs, quality assessment and improvement activities, customer service, and internal grievance resolution. Health care operations also include vendor evaluations, credentialing, training, accreditation activities, underwriting, premium rating, arranging for medical review and audit activities, and business planning and development. For example, the Plan may use information about your claims to review the effectiveness of wellness programs.

The amount of health information used or disclosed will be limited to the "minimum necessary" for these purposes, as defined under the HIPAA rules. The Plan, or its administrators, may also contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.

How the Plan May Share Your Health Information with Leidos

For plan administration purposes, the Plan, may disclose your health information without your written authorization to Leidos. Leidos may need your health information to administer benefits under the Plan. Leidos agrees not to use or disclose your health information other than as permitted or required by the Plan documents and by law. Benefits, Finance, and Human Resources staff are the only Leidos employees who will have access to your health information for plan administration functions.

Here's how additional information may be shared between the Plan and Leidos, as allowed under the HIPAA rules:

  • The Plan, or its administrators, may disclose "summary health information" to Leidos if requested, for purposes of obtaining premium bids to provide coverage under the Plan, or for modifying, amending, or terminating the Plan. Summary health information is information that summarizes participants' claims information, but from which names and other identifying information has been removed.
  • The Plan, or its administrators, may disclose to Leidos information on whether an individual is eligible and/or participating in the Plan. This eligibility and/or participation disclosure is limited to Benefits, other Human Resources groups as required. No individual private health information is required for these purposes.

In addition, you should know that Leidos cannot and will not use health information obtained from the Plan for any employment-related actions. However, health information collected by Leidos from other sources, for example under the Family and Medical Leave Act, Americans with Disabilities Act, or workers' compensation is not protected under HIPAA (although this type of information may be protected under other federal or state laws).

Other Allowable Uses or Disclosures of Your Health Information

In certain cases, your personal health information may be disclosed without authorization to a family member, close friend, or other person you identify who is involved in your care or payment for your care. Information describing your location, general condition, or death may be provided to a similar person (or to a public or private entity authorized to assist in disaster relief efforts). You'll generally be given the chance to agree or object to these disclosures (although exceptions may be made if you are not present or if you are incapacitated).

The Plan may also use or disclose your personal health information without your written authorization for the following activities:

Activity Description

Workers' compensation

Disclosures to workers' compensation or similar legal programs that provide benefits for work-related injuries or illness without regard to fault, as authorized by and necessary to comply with such laws.

Necessary to prevent serious threat to health or safety

Disclosures made in the good-faith belief that releasing your health information is necessary to prevent or lessen a serious and imminent threat to public or personal health or safety, if made to someone reasonably able to prevent or lessen the threat (including disclosures to the target of the threat); includes disclosures to assist law enforcement officials in identifying or apprehending an individual because the individual has made a statement admitting participation in a violent crime that the Plan reasonably believes may have caused serious physical harm to a victim, or where it appears the individual has escaped from prison or from lawful custody.

Public health activities

Disclosures authorized by law to persons who may be at risk of contracting or spreading a disease or condition; disclosures to public health authorities to prevent or control disease or report child abuse or neglect; and disclosures to the Food and Drug Administration to collect or report adverse events or product defects.

Judicial and Judicial and administrative proceedings

Disclosures in response to a court or administrative order, subpoena, discovery request, or other lawful process. The Plan may be required to notify you of the request, or receive satisfactory assurance from the party seeking your health information that efforts were made to notify you or to obtain a qualified protective order concerning the information.

Law enforcement purposes

Disclosures to law enforcement officials required by law or pursuant to legal process, or to identify a suspect, fugitive, witness, or missing person; disclosures about a crime victim if you agree or if disclosure is necessary for immediate law enforcement activity; disclosure about a death that may have resulted from criminal conduct; and disclosure to provide evidence of criminal conduct on the Plan premises.

Research purposes

Disclosures subject to approval by institutional or private privacy review boards, and subject to certain assurances and representations by researchers regarding necessity of using your health information and treatment of the information during a research project.

Health oversight activities

Disclosures to health agencies for activities authorized by law (audits, inspections, investigations, or licensing actions) for oversight of the health care system, government benefits programs for which health information is relevant to beneficiary eligibility, and compliance with regulatory programs or civil rights laws.

Specialized government functions

Disclosures about individuals who are Armed Forces personnel or foreign military personnel under appropriate military command; disclosures to authorized federal officials for national security or intelligence activities; and disclosures to correctional facilities or custodial law enforcement officials about inmates.

HHS investigations

Disclosures of your health information to the Department of Health and Human Services (HHS) to investigate or determine the Plan's compliance with the HIPAA privacy rule.

Except as described in this notice, other uses and disclosures will be made only with your written authorization. You may revoke your authorization as allowed under the HIPAA rules. However, you can't revoke your authorization with respect to disclosures the Plan has already made.

Your Individual Rights

You have the following rights with respect to your health information the Plan maintains. These rights are subject to certain limitations, as discussed below. This section of the notice describes how you may exercise each individual right. See the table at the end of this notice for information on how to submit requests.

Right to Request Restrictions on Certain Uses and Disclosures of Your Health Information and the Plan's Right to Refuse

You have the right to ask the Plan to restrict the use and disclosure of your health information for Treatment, Payment, or Health Care Operations, except for uses or disclosures required by law. You have the right to ask the Plan to restrict the use and disclosure of your health information to family members, close friends, or other persons you identify as being involved in your care or payment for your care. You also have the right to ask the Plan to restrict use and disclosure of health information to notify those persons of your location, general condition, or death - or to coordinate those efforts with entities assisting in disaster relief efforts. If you want to exercise this right, your request to the Plan must be in writing.

The Plan is not required to agree to a requested restriction. And if the Plan does agree, a restriction may later be terminated by your written request, by agreement between you and the Plan (including an oral agreement), or unilaterally by the Plan for health information created or received after you're notified that the Plan has removed the restrictions. The Plan may also disclose health information about you if you need emergency treatment, even if the Plan has agreed to a restriction.

Right to Receive Confidential Communications of Your Health Information

If you think that disclosure of your health information by the usual means could endanger you in some way, the Plan will accommodate reasonable requests to receive communications of health information from the Plan by alternative means or at alternative locations.

If you want to exercise this right, your request to the Plan must be in writing and you must include a statement that disclosure of all or part of the information could endanger you.

Right to Inspect and Copy Your Health Information

With certain exceptions, you have the right to inspect or obtain a copy of your health information in a "Designated Record Set." This may include medical and billing records maintained for a health care provider; enrollment, payment, claims adjudication, and case or medical management record systems maintained by a plan; or a group of records the Plan uses to make decisions about individuals. However, you do not have a right to inspect or obtain copies of psychotherapy notes or information compiled for civil, criminal, or administrative proceedings. In addition, the Plan may deny your right to access, although in certain circumstances you may request a review of the denial.

If you want to exercise this right, your request to the Plan must be in writing Within 30 days of receipt of your request (60 days if the health information is not accessible onsite), the Plan will provide you with:

  • The access or copies you requested;
  • A written denial that explains why your request was denied and any rights you may have to have the denial reviewed or file a complaint; or
  • A written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

The Plan may provide you with a summary or explanation of the information instead of access to or copies of your health information, if you agree in advance and pay any applicable fees. The Plan may also charge reasonable fees for copies or postage.

If the Plan doesn't maintain the health information but knows where it is maintained, you will be informed of where to direct your request.

Right to Amend Your Health Information that Is Inaccurate or Incomplete

With certain exceptions, you have a right to request that the Plan amend your health information in a Designated Record Set. The Plan may deny your request for a number of reasons. For example, your request may be denied if the health information is accurate and complete, was not created by the Plan (unless the person or entity that created the information is no longer available), is not part of the Designated Record Set, or is not available for inspection (e.g., psychotherapy notes or information compiled for civil, criminal, or administrative proceedings).

If you want to exercise this right, your request to the Plan must be in writing, and you must include a statement to support the requested amendment. Within 60 days of receipt of your request, the Plan will:

  • Make the amendment as requested;
  • Provide a written denial that explains why your request was denied and any rights you may have to disagree or file a complaint; or
  • Provide a written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

Right to Receive an Accounting of Disclosures of Your Health Information

You have the right to a list of certain disclosures the Plan has made of your health information. This is often referred to as an "accounting of disclosures." You generally may receive an accounting of disclosures if the disclosure is required by law, in connection with public health activities, or in similar situations listed in the table earlier in this notice, unless otherwise indicated below.

You may receive information on disclosures of your health information going back for six (6) years from the date of your request, but not earlier than April 14, 2003 (the general date that the HIPAA privacy rules are effective). You do not have a right to receive an accounting of any disclosures made:

  • For treatment, payment, or health care operations;
  • To you about your own health information;
  • Incidental to other permitted or required disclosures;
  • Where authorization was provided;
  • To family members or friends involved in your care (where disclosure is permitted without authorization);
  • For national security or intelligence purposes or to correctional institutions or law enforcement officials in certain circumstances; or
  • As part of a "limited data set" (health information that excludes certain identifying information)

In addition, your right to an accounting of disclosures to a health oversight agency or law enforcement official may be suspended at the request of the agency or official. If you want to exercise this right, your request to the Plan must be in writing. Within 60 days of the request, the Plan will provide you with the list of disclosures or a written statement that the time period for providing this list will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request. You may make one (1) request in any 12-month period at no cost to you, but the Plan may charge a fee for subsequent requests. You'll be notified of the fee in advance and have the opportunity to change or revoke your request.

Right to Obtain a Paper Copy of This Notice from the Plan Upon Request

You have the right to obtain a paper copy of this Privacy Notice upon request. Even individuals who agreed to receive this notice electronically may request a paper copy at any time.

Changes to the Information in this Notice

The Plan must abide by the terms of the Privacy Notice currently in effect. This notice takes effect on April 14, 2003. However, the Plan reserves the right to change the terms of its privacy policies as described in this notice at any time, and to make new provisions effective for all health information that the Plan maintains. This includes health information that was previously created or received, not just health information created or received after the policy is changed. If changes are made to the Plan's privacy policies described in this notice, you will be notified of the changes by electronic or U.S. Postal Service.

Complaints

If you believe your privacy rights have been violated, you may complain to the Plan and to the Secretary of Health and Human Services. You won't be retaliated against for filing a complaint. To file a complaint, submit a written request to:

Leidos
Corporate Benefits Department
Attn: HIPAA Compliancy Department
11955 Freedom Drive
Reston, VA 20190