This section of the notice explains how Agency uses and discloses your PHI as required or permitted by law. As explained below, in some instances we may request your written authorization to use or disclose PHI.
 

1. Required Disclosures. Use and disclosure of your PHI may be required by the Secretary of the Department of Health and Human Services to investigate and/or determine Agency's compliance with HIPAA's privacy regulations.

2. Uses and Disclosures Related to Treatment, Payment, and Health Care Operations. Agency and its business associates may use or disclose PHI for activities related to treatment, payment, and health care operations. As described in the next section entitled "Your Privacy Rights", you have the right to request a restriction on the use and disclosure of your PHI for treatment, payment, or health care operations purposes.

Since we are not a health care provider, we do not engage in the treatment of individuals and, accordingly, we will not share your information for such purposes. Examples of activities related to payment include payment of health care claims or collection of premiums. Examples of activities related to health care operations include quality assessment and improvement, underwriting, audit services, legal services, data

aggregation, business planning and development, administrative activities related to compliance, customer services, fraud, and abuse prevention and detection, and complaint resolution.

3. Other Uses and Disclosures of Your PHI. In addition to the uses and disclosures described above, Agency may use or disclose PHI for the following purposes: for public health activities (for example, to alert public health authorities of public health risks to prevent or control disease, injury or disability or handle situations where a child is abused or neglected or for example, to notify the FDA of problems with a product regulated by the FDA, to notify a person who has been exposed to a communicable disease or may be at risk of spreading or contracting a disease or condition, or providing information to an employer when the employer can have the information for work-related reasons); for health oversight activities (for example, to assist in investigations relating to insurance fraud); for judicial and administrative proceedings (for example, in response to a subpoena or discovery request); for certain law enforcement purposes (for example, required reporting to certain courts or victims, to report a crime, or identify a suspect); for protection against serious harm (for example, to protect victims of abuse, neglect or domestic violence); for specialized government functions (for example, to assist in national security, military and intelligence activities); for certain government-approved research purposes (if certain conditions are met); for workers' compensation purposes (for example, when required by workers' compensation laws); to a coroner, medical examiner, or funeral director (to permit them to carry out their legal duties); in order to facilitate organ donations and transplants; when necessary to prevent or lessen a serious and imminent threat to health or safety; or when required to do so by federal, state, or local law.

4. Use and Disclosure to Family Members or Other Personal Representatives. We may disclose PHI to a family member, guardian, executor, administrator, or other person identified by you and authorized by law to act on your behalf with respect to health care. When disclosing information to such a person, we will take appropriate steps to verify the identity of such person.

5. Use and Disclosures to Plan Sponsor (Employer). We may disclose PHI to an employer-sponsor of a group health plan, if applicable, provided that any such plan sponsor certifies: (a) that the information provided will be maintained in a confidential manner and shall not be used for employment-related decisions or for other employees benefit determinations or in any other manner not permitted by law; and (b) that the plan documents contain provisions concerning restrictions on how the plan sponsor may use or further disclose PHI.

​

6. Use and Disclosure to Contact You Regarding Health-Related Benefits and Services. Agency or its business associates may contact you regarding health-related benefits and services that may be of interest to you.

7. Uses and Disclosures to Business Associates. We may disclose PHI to our business associates, such as information systems consultants, production vendors, and actuarial consultants, who perform services on our behalf. When we disclose information to a business associate, we will require the business associate to protect the privacy of your PHI through a written agreement with Agency.

​

8. Uses and Disclosures That Require Your Written Authorization. Your prior written authorization would be required before we may disclose PHI for marketing purposes, disclose PHI if Agency receives remuneration for distribution of the communication, or disclose psychotherapy notes. Other uses and disclosure of your PHI not described in this Notice of Privacy Practices will be made only with your written authorization unless otherwise permitted or required by law as described in this notice. You may revoke such authorization at any time, except to the extent Agency or its business associates or other entities have relied on such disclosure. Revocation will not affect any uses or disclosures made with your permission before it was revoked. Also, if you gave us permission to disclose your information in order to obtain insurance coverage, you may not revoke it if another law allows the insurer to contest a claim under the policy or the policy itself.

9. Genetic Information. To the extent applicable, we will not disclose any genetic information in our possession for underwriting purposes.

10. Other Applicable Law. In the event applicable law, other than HIPAA, prohibits or materially limits our uses and disclosures of PHI, as described above, we will restrict our uses or disclosures of PHI in accordance with the more stringent standard.