University of California
UCnet
What are you looking for?

University of California Healthcare Plan Notice of Privacy Practices – Self-Funded Plans

Effective Jan. 1, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.


This Healthcare Notification of Privacy Practices applies to the University of California Self-Funded Plans, including UC Care, UC Health Savings, CORE, UC High Option Supplement to Medicare, UC Medicare PPO, UC Medicare PPO without Prescription Drugs and the Dental PPO. 

UC’S COMMITMENT

The University is committed to protecting the privacy of your protected health information or PHI. PHI refers to health information that a Self-Funded Plan creates or receives that relates to your physical or mental health, your healthcare, or payment for your healthcare. In most cases, your PHI is maintained by the business associate that serves as the third party administrator for the Self-Funded Plan in which you participate, but the University, as a group health plan sponsor, may also hold health-related information. Generally, the University-held information is limited to enrollment data, but in limited instances, it may include information you provide to designated UC staff to help with coordination of benefits, or resolving complaints.

The privacy protections described in this notice reflect the requirements of federal regulations issued under the Health Insurance Portability and Accountability Act (HIPAA). They require the Self-Funded Plans to:

  • Comply with HIPAA privacy standards and other federal laws;
  • Make sure that your PHI is protected;
  • Give you this notice of the Self-Funded Plans’ legal duties and privacy practices with respect to your PHI; and
  • Follow the legal duties and privacy practices described in this notice (“Notice”).

How We May Use and Disclose Your Health Information

We typically use and disclose your health information in the following ways.

– Treatment. A Self-Funded Plan may use and disclose your PHI to doctors, nurses, technicians, and other personnel who are involved in providing you with medical treatment or services. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. The doctor may then tell the dietitian if you have diabetes so the dietitian can meet any special menu needs. Different departments may share your PHI so they can coordinate services you need, such as lab work, x-rays, and prescriptions.

– Payment. A Self-Funded Plan may use and disclose your PHI in the course of activities that involve reimbursement for healthcare, such as determination of eligibility for coverage, claims processing, billing, obtaining, and payment of premium, utilization review, medical necessity determinations, and pre-certifications.

– Healthcare Operations for a Self-Funded Plan. Self-Funded Plans may use and disclose your PHI to carry out business operations and to assure that all enrollees receive quality care. For example, a Self-Funded Plan may disclose your PHI to a business associate who handles claims processing or administration, data analysis, utilization review, quality assurance, benefit management, practice management or referrals to specialists, or provides legal, actuarial, accounting, consulting, data aggregation, management, or financial services.

– Plan Sponsor. A Self-Funded Plan may disclose summary health information (that is claims data that is stripped of most individual identifiers) to the University in its role as plan sponsor in order to obtain bids for health insurance coverage or to facilitate, modifying, amending, or terminating a plan. A Self-Funded Plan may also provide the University with enrollment or disenrollment information. In addition, if you request help from the University in coordinating your benefits or resolving a complaint (i.e., benefits administration), a Self-Funded Plan may disclose your PHI to designated University staff, but no PHI may be disclosed to facilitate employment-related actions or decisions or for matters involving other benefits or benefit plan. The University may not further disclose any PHI that is disclosed to it in these limited instances.

– As Required By Law. A Self-Funded Plan will disclose your PHI if required to do so by federal, state, or local law, or regulation.

– To Avert a Serious Threat to Health or Safety. A Self-Funded Plan may disclose your PHI when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

– Disaster Relief Efforts. A Self-Funded Plan may share your health information to an entity assisting in a disaster relief effort so that others can be notified about your condition, status and location.

– Military and Veterans. If you are or were a member of the armed forces, a Self-Funded Plan may release your PHI to military command authorities as authorized or required by law. A Self-Funded Plan may also release medical information about foreign military personnel to the appropriate military authority as authorized or required by law.

– Research. In limited circumstances, a Self-Funded Plan may use and disclose PHI for research purposes, subject to the confidentiality provisions of state and federal law. Your PHI may be important to further research efforts and the development of new knowledge. All research projects conducted by the University of California must be approved through a special review process to protect member safety, welfare, and confidentiality.

– Workers’ Compensation. A Self-Funded Plan may release PHI for workers’ compensation or similar programs as permitted or required by law. These programs provide benefits for work-related injuries or illness.

– Health Oversight Activities. A Self-Funded Plan may disclose PHI to governmental, licensing, auditing, and accrediting agencies as authorized or required by law.

– Legal Proceedings. A Self-Funded Plan may disclose PHI to courts, attorneys, and court employees in the course of conservatorship and certain other judicial or administrative proceedings.

– Lawsuits and Disputes. If you are involved in a lawsuit or other legal proceeding, a Self-Funded Plan may disclose your PHI in response to a court or administrative order, or in response to a subpoena, discovery request, warrant, summons, or other lawful process.

– Law Enforcement. If authorized or required by law, a Self-Funded Plan may disclose your PHI under limited circumstances to a law enforcement official in response to a warrant or similar process, to identify or locate a suspect, or to provide information about the victim of a crime.

– Department of Health and Human Services. A Self-Funded Plan may be required to disclose your PHI to the Department of Health and Human Services if the Secretary is conducting a compliance audit.

– National Security and Intelligence Activities. If authorized or required by law, a Self-Funded Plan may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities.

– Protective Services for the United States President and Others. A Self-Funded Plan may disclose your PHI to authorized federal and state officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or conduct special investigations as authorized or required by law.

– Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, a Self-Funded Plan may release your PHI to the correctional institution or law enforcement official, as authorized or required by law. This release would be necessary for the institution to provide you with healthcare; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

– Marketing or Sale of Health information. Most uses and sharing of your health information for marketing purposes or any sale of your health Information are strictly limited and require your written authorization.

– Separation Between Covered Functions and Non-Covered Functions. To comply with the requirements of HIPAA, the University must maintain separation between covered functions (including the University’s Group Health Plans), and non-covered functions (such as employer-related functions not associated with the University’s Group Health Plans). The University prohibits the use or disclosure of member PHI for employment-related actions or decisions; nor may it be used or disclosed in connection with any other benefit or employee benefit plan of the University. Workforce members engaged in multiple roles, some part of which involves use and disclosure of PHI, must take special care to keep those roles separate. A disclosure of PHI from the SPHC to a non-covered function or unit may require written authorization.

– Disclosures to Subcontractors. A Self-Funded Plan shall ensure that any agents (including any subcontractor) to whom the Plan provides PHI agree to the same restrictions and conditions that apply to the Plan with respect to such information.

– Other Uses and Disclosures of Health Information. Other ways we share and use your health information not covered by this Notice will be made only with your written authorization. If you authorize us to use or disclose your health information, you may cancel that authorization, in writing, at any time. However, the cancellation will not apply to information we have already used and disclosed based on the earlier authorization.

Special laws apply to certain kinds of health information considered particularly private or sensitive to a patient. This sensitive information includes psychotherapy notes, sexually transmitted diseases, drug and alcohol abuse treatment records, mental health records, and HIV/AIDS information. When required by law, we will not share this type of information without your written permission. In certain circumstances, a minor’s health information may receive additional protections.

– Genetic Information is Protected Health Information. In accordance with the Genetic Information Nondiscrimination Act (GINA), a Self-Funded Plan will not use or disclose genetic information for underwriting purposes, which includes eligibility determinations, premium computations, applications of any pre-existing condition exclusions, and any other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

Your Rights

You have the following rights regarding the PHI that a Self-Funded Plan maintains about you:

– Right to Inspect and Copy. With certain exceptions you have the right to inspect and obtain a copy of your PHI that is maintained by or for a Self-Funded Plan. To inspect and obtain a copy of the PHI you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. You may be charged a fee for the costs of copying, mailing or other supplies associated with your request.

A Self-Funded Plan may deny your request to inspect and/or obtain a copy in certain limited circumstances. For example, HIPAA does not permit you to access or obtain copies of psychotherapy notes. If your request is denied, you will be informed in writing, and you may request that the denial be reviewed. The person conducting the review will not be the person who denied your request. The plan will comply with the outcome of the review.

– Right to Request an Amendment. If you believe that the PHI maintained by a Self-Funded Plan is incorrect or incomplete, you may request that the plan amend the information. You have the right to request an amendment for as long as the information is kept by or for the plan. A request for an amendment should be made in writing and submitted to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. In addition, you must provide a reason that supports your request.

A Self-Funded Plan may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, the plan may deny your request if you ask to amend information that was not created by the plan; is not part of the PHI maintained by or for the plan; is not part of the information that you would be permitted to inspect and copy under the law; or if the information is accurate and complete. If the request is granted, the plan will forward your request to other entities that you identify that you want to receive the corrected information. For example, if your PHI has been disclosed to the UC staff so that it may help to coordinate benefits or resolve a complaint, you may direct the plan to share the correction with the designated staff members.

– Right to an Accounting of Disclosures. You have the right to receive an “accounting of disclosures,” which is a list of disclosures such as those that were made of PHI about you, with the exception of certain documents, including those relating to treatment, payment, and healthcare operations and disclosures made to you or consistent with your authorization. To request an accounting of disclosures, you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer.

Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003.

Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists, the plan may charge you for the costs of providing the list. You will be notified of any costs involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

– Right to Request Restrictions. You have the right to request a restriction or limitation on the use and disclosure of your PHI for treatment, payment or healthcare operations, or to request a restriction on the PHI that the plan may disclose about you to someone who is involved in your care, or the payment for your care such as a family member or friend. The plan is not required to agree to your request. If the plan agrees to your request, it will comply with the requested restriction unless the information is needed to provide you emergency treatment or to assist in disaster relief efforts.

To request a restriction you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. Your request should state the information you want to limit; whether you want to limit the plan’s use or disclosure or both; and to whom you want the limits to apply for example disclosures to your spouse.

– Right to Request Confidential Communications. You have the right to request that a Self-Funded Plan communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that the plan only contact you at work or by mail to a specific address. To request confidential communications, you must submit your request in writing to the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer. The plan will accommodate all reasonable requests and will not ask you the reason for your request. Your request must specify how or where you wish to be contacted.

– Right to a Paper Copy of This Notice. You may ask the University to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, contact the UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94607, Attention: Privacy Officer.

– Breach. You have the right to be notified, and your Self-Funded Plan has the duty to notify you, of the discovery of a breach of unsecured PHI.

– Right to Choose Someone to Act for You.  If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. The plan will make sure the person has this authority and can act for you before the plan takes any action.

Changes to this Notice

The Self-Funded Plans are required to abide by the terms of the Notice of Privacy Practices currently in effect. However, the Self-Funded Plans reserve the right to change this notice and to make the revised or changed notice effective for PHI your plan already maintains on you as well as any information the plan receives or creates in the future.

A copy of the current notice will be posted at the UC website at  https://ucnet.universityofcalifornia.edu/forms/pdf/uc-healthcare-plan-notice-of-privacy-practices-self-funded-plans.pdf. The notice will contain the effective date on the first page in the top right-hand corner. In addition, a copy of the notice that is currently in effect will be given to new health plan members and thereafter, available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

  • the Secretary of the Department of Health and Human Services for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, 
  • UC Healthcare Plan Privacy Office, 1111 Franklin Street, Oakland, CA 94612, Attention: Privacy Officer. Email will not be accepted; all complaints must be submitted in writing.

You will not be retaliated against for filing a complaint.

Questions

If you have questions or for further information regarding this privacy notice, contact the UC Healthcare Plan Privacy Officer at 1-800-888-8267, press 1.