Our Right to Receive and Release Information About You We are committed to maintaining the confidentiality of your healthcare information. However, in order for us to make available quality, cost-effective healthcare coverage to you, we may release and receive information about your health, treatment, and condition to or from authorized providers and insurance companies, among others. We may give or get this information, as permitted by law, for certain purposes, including, but not limited to: • adjudicating health insurance claims; • administration of claim payments; • healthcare operations; • case management and utilization review; • coordination of healthcare coverage; and • health oversight activities. Our release of information about you is regulated by law. Please see the Rhode Island Confidentiality of HealthCare Communications and Information Act, R.I. Gen. Laws §§ 5-37.3-1 et seq. the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and implementing regulations, 45 C.F.R. §§ 160.101 et seq. (collectively “HIPAA”), the Xxxxx-Xxxxx-Xxxxxx Financial Modernization Act, 15 U.S.C. §§ 6801-6908, the Rhode Island Office of the Health Insurance Commissioner (OHIC) Regulation 100.
Retention of Records, Right to Monitor and Audit (a) CONTRACTOR shall maintain all required records for three (3) years after the COUNTY makes final payment and all other pending matters are closed, and shall be subject to the examination and/or audit of the County, a Federal grantor agency, and the State of California.
Handling Sensitive Personal Information and Breach Notification A. As part of its contract with HHSC Contractor may receive or create sensitive personal information, as section 521.002 of the Business and Commerce Code defines that phrase. Contractor must use appropriate safeguards to protect this sensitive personal information. These safeguards must include maintaining the sensitive personal information in a form that is unusable, unreadable, or indecipherable to unauthorized persons. Contractor may consult the “Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals” issued by the U.S. Department of Health and Human Services to determine ways to meet this standard.
B. Contractor must notify HHSC of any confirmed or suspected unauthorized acquisition, access, use or disclosure of sensitive personal information related to this Contract, including any breach of system security, as section 521.053 of the Business and Commerce Code defines that phrase. Contractor must submit a written report to HHSC as soon as possible but no later than 10 business days after discovering the unauthorized acquisition, access, use or disclosure. The written report must identify everyone whose sensitive personal information has been or is reasonably believed to have been compromised.
C. Contractor must either disclose the unauthorized acquisition, access, use or disclosure to everyone whose sensitive personal information has been or is reasonably believed to have been compromised or pay the expenses associated with HHSC doing the disclosure if:
1. Contractor experiences a breach of system security involving information owned by HHSC for which disclosure or notification is required under section 521.053 of the Business and Commerce Code; or
2. Contractor experiences a breach of unsecured protected health information, as 45 C.F.R. §164.402 defines that phrase, and HHSC becomes responsible for doing the notification required by 45 C.F.R. §164.404. HHSC may, at its discretion, waive Contractor's payment of expenses associated with HHSC doing the disclosure.
What To Do If You Find A Mistake On Your Statement If you think there is an error on your statement, write to us at the address(es) listed on your statement. In your letter, give us the following information:
