THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ CAREFULLY.

This Notice describes the legal duties privacy practices of the group health plans sponsored by Duval County Public Schools as required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). It specifically describes how the Duval County Public Schools Employee Benefit Plan and the Duval County Public Schools Cafeteria Plan (the “Plans”) may use or disclose your protected health information to carry out treatment, payment, or health care operations, or for any other purposes permitted or required by law. You are receiving this Notice because you participate in either one or both of the Plans as an employee of Duval County Public Schools (“DCPS”). This Notice refers the School Board as the “Plan Sponsor.”

HIPAA protects only certain medical information known as “protected health information.” Generally, protected health information is information collected by a health care provider, health care clearinghouse or group health plan that identifies you and relates to your past, present or future physical or mental health or condition; the provision of health care to you; or the past present or future payment for health care furnished to you.

It’s important to note that HIPAA’s privacy rules apply to the Plans listed above, not the Plan Sponsors as employers—that is the way HIPAA works. The terms “we” and “our” in this Notice refer to the Plans.

If you have any questions about this Notice or the Plans’ privacy practices, please contact DCPS Employee Benefits Department at (904) 390-2351.

Our Responsibilities

The Plans are required by law to:

• maintain the privacy of your protected health information;
• provide you with certain rights with respect to your protected health information;
• give you a copy of this Notice; and
• follow the terms of the Notice that is currently in effect.

This Notice and the Plans’ privacy practices may change, as allowed or required by law. If this Notice changes significantly, the Plans will provide you with a copy of the revised Notice of Privacy Practices by posting a copy of the current notice on the Plan Sponsors’ websites, duvalschoolsorg.sharepoint.com/teams/HR/SitePages/Employee-Benefits.aspx.

How the Plans are Operated

The Plans themselves do not have employees. Therefore either DCPS and/or a third party administrator administer the Plans. Currently, for example, Florida Blue administers our major medical plan. Third party administrators administer the Plans in a way similar to the way a commercial health insurance company would administer an insured health plan. We have provisions in our contracts with the third party administrators requiring them to keep your protected health information confidential. When DCPS employees conduct plan administration functions on behalf of the Plans, they are acting as an administrator of the Plans. These Plan administrators keep your protected health information separate and do not share it with other departments of the Plan Sponsors except in very limited cases described in this Notice.

Because the Plans are all sponsored by the Plan Sponsors, they are part of an organized health care arrangement. This means the Plans may share your protected health information with each other as needed for the purposes of treatment, payment and health care operations, as described below.

How We May Use and Disclose Your Protected Medical Health Information

The law allows the Plans to use or disclose your protected health information in some cases without your permission. The following categories describe the different ways that we may use and disclose your protected health information. For each category of uses or disclosures we will explain what we mean and present some examples. Not every use or disclosure in a category is listed. However, all of the ways we are allowed to use and disclose information will fall within one of the categories.

For Treatment. We may use or disclose protected health information to assist health care providers, such as a hospital or physician, in treating you. We do not plan to make disclosures “for treatment” purposes. However, if necessary, the Plans may make such disclosures without your authorization.

For Payment. Our third party administrators (like Florida Blue) will use your protected health information to pay claims from providers for any treatment and services provided to you that are covered by the Plans or to process payments from your health care reimbursement benefit. Payment also includes using or disclosing information to make determinations on disputed claims, to determine eligibility for benefits, and to coordinate benefits.

• For example, we may tell your health care provider about your medical history to determine whether a particular treatment is experimental, investigational, or medically necessary, or to determine whether the Plans will cover the treatment.

Payment also includes making decisions regarding cost sharing and responsibility for paying a claim or obtaining reimbursement, examining medical necessity, obtaining payment under stop loss insurance, and conducting utilization review.

• For example, you may have a question regarding payment of a claim. We may need to access your claim information to assist in answering questions necessary to ensure the payment of the claim.

The “we” we are talking about is our third party administrators or selected employees in the DCPS Employee Benefits Department.

For Health Care Operations. We may use and disclose your protected health information for other Plan operations. These uses and disclosures are necessary to run the Plans. For example, we may use protected health information in connection with quality assessment and improvement activities; underwriting, premium rating, and other activities relating to Plan coverage; submitting claims for stop loss coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; and business management and general Plan administrative activities.

To Business Associates. We may hire third parties such as third party administrators, auditors, attorneys, and consultants to help administer the Plans. These third parties are known as Business Associates. We may disclose protected health information to Business Associates once they have agreed in writing to safeguard the protected health information. For example, we may disclose your protected health information to Florida Blue, as a third party administrator, to administer claims or to provide support services, such as utilization management.

As Required by Law. We will disclose your protected health information when required to do so by federal, state or local law. For example, we may disclose your protected health information when required by national security laws or public health disclosure laws.

To Avert a Serious Threat to Health or Safety. We may use and disclose your protected health information when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. For example, we may disclose your protected health information in a proceeding regarding the licensure of a physician.

To the Plan Sponsors. We may disclose protected health information to certain employees of the Plan Sponsors for purposes of administering the Plans. However, those employees will only use or disclose that information as necessary to perform plan administration functions or as otherwise required by HIPAA, unless you have authorized further disclosures. For example, we may disclose to certain DCPS employees that you are enrolled in, or disenrolled from, one of the Plans. Your protected health information cannot be used for employment purposes without your specific permission.

Special Situations

In addition to the above, the following categories describe other possible ways that we may use and disclose your protected health information. For each category of uses or disclosures, we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Organ and Tissue Donation. If you are an organ donor, we may release your protected health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans. If you are a member of the armed forces, we may release your protected health information as required by military command authorities. We may also release protected health information about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation. We may release your protected health information for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose your protected health information for public health actions. These actions generally include the following:

• to prevent or control disease, injury, or disability;
• to report births and deaths;
• to report child abuse or neglect;
• to report reactions to medications or problems with products;
• to notify people of recalls of products they may be using;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
• to notify the appropriate government authority if we believe that a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree, or when required or authorized by law.

Health Oversight Activities. We may disclose your protected health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your protected health information in response to a court or administrative order. We may also disclose your protected health information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may disclose your protected health information if asked to do so by a law enforcement official

• in response to a court order, subpoena, warrant, summons or similar process;
• to identify or locate a suspect, fugitive, material witness, or missing person;
• about the victim of a crime if, under certain limited circumstances, we are unable to obtain the victim’s agreement;
• about a death that we believe may be the result of criminal conduct;
• about criminal conduct; and
• in emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors. We may release protected health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information about patients to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. We may release your protected health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates. If you are an inmate of a correctional institution or are in the custody of a law enforcement official, we may disclose your protected health information to the correctional institution or law enforcement official if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Research. We may disclose your protected health information to researchers when: (1) the individual identifiers have been removed; or (2) when an institutional review board or privacy board has (a) reviewed the research proposal; and (b) established protocols to ensure the privacy of the requested information, and approves the research.

Required Disclosures. The following is a description of disclosures of your protected health information we are required to make.

Government Audits. We are required to disclose your protected health information to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule.

Disclosures to You. When you request, we are required to disclose to you the portion of your protected health information that contains medical records, billing records, and any other records used to make decisions regarding your health care benefits. We are also required, when requested, to provide you with an accounting of most disclosures of your protected health information if the disclosure was for reasons other than for treatment, payment or health care operations, and if the protected health information was not disclosed pursuant to your individual authorization.

Other Disclosures

Personal Representatives. We will disclose your protected health information to individuals authorized by you, or to an individual designated as your personal representative, attorney- in-fact, etc., so long as you provide us with a written notice/ authorization and any supporting documents (i.e., power of attorney). Note: Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief that:

(1) you have been, or may be, subjected to domestic violence, abuse or neglect by such person;

(2) treating such person as your personal representative could endanger you; or

(3) in the exercise or professional judgment, it is not in your best interest to treat the person as your personal representative.

Spouses and Other Family Members. With only limited exceptions, we will send all mail to the employee. This includes mail relating to the employee’s spouse and other family members who are covered under the Plans, and includes mail with information on the use of Plan benefits by the employee’s spouse and other family members and information on the denial of any Plan benefits to the employee’s spouse and other family members. If a person covered under the Plans has requested Restrictions or Confidential Communications (see below under “Your Rights”), and if we have agreed to the request, we will send mail as provided by the request for Restrictions or Confidential Communications.

Authorizations. Other uses or disclosures of your protected health information not described above will only be made with your written authorization. You may revoke written authorization at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

Your Rights

You have the following rights with respect to your protected health information:

Right to Inspect and Copy. You have the right to inspect and copy certain protected health information that may be used to make decisions about your health care benefits. To inspect and copy your protected health information, you must submit your request in writing. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed by submitting a written request.

Right to Amend. If you feel that the protected health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plans.

To request an amendment, your request must be made in writing. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• is not part of the medical information kept by or for the Plans;
• was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• is not part of the information that you would be permitted to inspect and copy; or
• is already accurate and complete.

If we deny your request, you have the right to file a statement of disagreement with us and any future disclosures of the disputed information will include your statement.

Right to an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your protected health information. The accounting will not include (1) disclosures for purposes of treatment, payment or health care operations; (2) disclosures made to you; (3) disclosures made pursuant to your authorization; (4) disclosures made to friends or family in your presence or because of an emergency; (5) disclosures for national security purposes; and (6) disclosures incidental to otherwise permissible disclosures.To request this list or accounting of disclosures, you must submit your request in writing. Your request must state a time period of not longer than six years and may not include dates before April 14, 2004. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on your protected health information that we use or disclose for treatment, payment, or health care operations. You may also have the right to request a limit on your protected health information that we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a surgery that you had.

We are not required to agree to your request in most cases. We will comply with any restriction request if the disclosure is to a health plan for purposes of payment or health care operations (not for treatment) and the protected health information pertains solely to a health care item or service that has been paid for out-of-pocket and in full. If we agree or must comply with your request, we will honor the restriction until you revoke it or we notify you.

To request restrictions, you must make your request in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply—for example, disclosures to your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests if you clearly provide information that the disclosure of all or part of your protected information could endanger you.

Right to be Notified of a Breach. You have the right to be notified in the event that we (or a Business Associate) discover a breach of your unsecured protected health information.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

You may obtain a copy of this notice at our websites, www.duvalschools.org.

To obtain a paper copy of this notice contact:

Duval County Public Schools
Employee Benefits Department
1701 Prudential Drive
Jacksonville, Florida 32207, 904-390- 2351.

Complaints

If you believe that your privacy rights have been violated, you may file a complaint with the Plans or with the Office for Civil Rights of the United States Department of Health and Human Services. You will not be penalized, or in any other way retaliated against, for filing a complaint. All complaints made to us must be in writing and sent to Duval County Public Schools, Employee Benefits Department, 1701 Prudential Drive, Jacksonville, Florida 32207, 904-390-2351.