HIPAA

“Protected health information” and “sensitive personal information” (PHI/SPI) is information that identifies a person or patient. This data can be your age, address, e-mail address, and medical facts. It can be about your past, present, or future physical or mental health conditions. It also can be about sensitive health care services and other personal facts.

By law, we, El Paso Health must:

Here are some examples of allowed uses and disclosures of your PHI/SPI. These are not the only ones.

Treatment
We will use and share your PHI/SPI to provide, coordinate, or manage your health care and other services. We might share it with doctors or others who help with your care. In emergencies, we will use and share it to get you the care you need. We will only share what is needed.

Payment
We can use and share your PHI/SPI to get paid for the health care services that you received.

Health Care Operations
We can use or share your PHI/SPI in our daily activities. For example:

Business Associates
We can share your PHI/SPI with our Business Associates. They must also protect it. They must follow HIPAA privacy and security rules, HITECH rules and Texas Privacy Laws. They can face fines and penalties. They have to report any breaches of unencrypted PHI/SPI.
‍

By law, sometimes we must use or share your PHI/SPI. Here are some examples:

Public Health Authorities

Communicable Diseases
We can share your PHI/SPI to tell a person they might have been exposed to a disease. We can tell a person they might be at risk for getting or spreading a disease or condition.
‍
Health Oversight Agencies & U.S. Food and Drug Administration
We will share your PHI/SPI when health oversight agencies ask for it.

Legal Proceedings
We will share your PHI/SPI for legal matters. We must receive a legal order or other lawful process.

Law Enforcement, Criminal Activity, and National Security
We will share your PHI/SPI if we believe it helps solve a crime. We will share it to stop or reduce a serious threat. We can also share it to help law enforcement officers find or arrest a person.

Coroners, Funeral Directors, and Organ Donations
We share PHI/SPI with coroners, medical examiners, and funeral directors. We can also share it to help manage organ, eye, or tissue donations.

Research
If El Paso Health agrees to be part of an approved research study, we will make sure that your PHI/SPI is kept private.

Military Activity
We can share PHI/SPI of Armed Forces personnel with the government.

Workers’ Compensation
We will share your PHI/SPI to follow workers’ compensation laws and similar programs.

Inmates
We can use or share your PHI/SPI if you are a correctional facility inmate and we created or received your PHI/SPI while providing your care.

Disclosures by the Health Plan
We will share your PHI/SPI to get proof that you are able to get health care. We will work with other health insurance plans and other government programs. If applicable, we may share your information with your plan sponsor.

Parental Access
We follow Texas laws about treating minors. We follow the law about giving their PHI/SPI to parents, guardians, or other person with legal responsibility for them.

For People Involved in Your Care or Payment for Your Care
We will share your PHI/SPI with your family or other people you want to know about your care. You can tell us who is allowed or not allowed to know about your care. You must fill out a form that will be part of your medical record.

Restrictions on Marketing
The HITECH Act does not let El Paso Health receive any money for marketing communications.

Other Laws that Protect Health Information
Other laws protect PHI/SPI about mental health, alcohol and drug abuse treatment, genetic testing and HIV/AIDS testing or treatment. You must agree in writing to share this kind of PHI/SPI.
‍

Your reproductive healthcare PHI and records may be used by and disclosed only for
the following specific purposes:

To Defend El Paso Health or a Healthcare Provider:
Your reproductive healthcare PHI and records may be disclosed to defend El Paso
Health or a covered healthcare provider in an investigation or legal proceeding related
to professional misconduct or negligence where the alleged misconduct or negligence
involved the provision of reproductive healthcare.

To Defend You or Others in Legal Proceedings:
Your reproductive healthcare PHI and records may be disclosed to defend you or any
other person in a criminal, civil, or administrative proceeding where liability could be
imposed on you or that person for providing reproductive healthcare.

Health Oversight Audits:
Your reproductive healthcare PHI and records may be disclosed where an audit is
conducted by the Inspector General for health oversight purposes.

Required Attestation:
We may disclose your reproductive healthcare PHI and records where we have
received the required attestation to release these records, certifying that the use or
disclosure is not for a prohibited purpose.
‍

Right to Inspect and Copy Your Health Information
This means you may inspect and obtain a copy of protected health information about you that is contained in a designated record set for as long as we maintain the protected health information. A “designated record set” contains medical and billing records and any other records that your physician and the practice uses for making decisions about you. Under federal law, however, you may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and protected health information that is subject to law that prohibits access to protected health information.

Depending on the circumstances, a decision to deny access may be reviewable. In some circumstances, you may have a right to have this decision reviewed. Please contact the Compliance Officer if you have questions about access to your medical records.

Right to Amend Your Health Information
You can ask El Paso Health to change facts if you think they are wrong or not complete. You must do this in writing. We do not have to make the changes.

Right to an Accounting of Disclosures
You can ask for a list of certain disclosures of your PHI/SPI. The list will not include PHI/SPI shared before April 14, 2003. You cannot ask for more than six years. The list can only go back three years for electronic PHI/SPI. There are other limits that apply to this list. You might have to pay for more than one list a year.

Right to Ask For Restrictions
You can ask us to not use or share part of your PHI/SPI for treatment, payment, or health care operations. You must ask in writing. You must tell us (1) PHI/SPI you want restricted; (2) if you want to change our use and/or disclosure; (3) who it applies to (e.g., to your spouse); and (4) expiration date.

If we think it is not best for those involved, or cannot limit the records, we do not have to agree. If we agree, we will only share that PHI/SPI in an emergency. You can take this back in writing at any time.

If you pay in full for an item or service you can ask a provider to not share PHI/SPI with El Paso Health for payment or operations purposes. These are the main reasons we would need it. This does not apply if we need the PHI/SPI for treatment purposes.

Right to Receive Confidential Communications
You can tell us where and how to give you your PHI/SPI. You can ask us to only call at a certain number. You can also give us another address if you think sending mail to your usual address will put you in danger. You must be specific and put this in writing.

Right to a Copy of this Notice
You can ask for and get a copy of this Notice from at any time, even if you have received this Notice previously or agreed to receive this Notice electronically.

Right to Withdraw an Authorization for Disclosure
If you have let us use or share your PHI/SPI, you can change your mind at any time. You must tell us in writing. In some cases, we might have already used or shared it.

Right to be Notified of Breach
You will be told if we find a breach of unsecured PHI/SPI. The breach could be from either El Paso Health or a Business Associate of El Paso Health.
‍

These uses and disclosures will be made only with your written agreement:

If we want to use or share your PHI/SPI for fundraising we will tell you how you can opt-out at any time. By law, we cannot use your genetic information for underwriting. The HITECH Act makes El Paso Health limit uses, disclosures, and requests of your PHI/SPI. We cannot ask for or share more than is needed.

You can change your mind about letting us use or share your PHI/SPI at any time. You must tell us in writing.
‍

This Notice of Privacy Practices is given to you as part of HIPAA. There are other privacy laws that also apply. Those include the Freedom of Information Act; Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act; the Health Information Technology for Economic and Clinical Health Act (HITECH) and the Texas Privacy Law (HB 300).
‍

You can file a complaint if you believe your privacy rights have been violated. You can call El Paso Health’s Privacy Officer at 915-532-3778 Ext 1032 or toll free at 1-877-532-3778. You can also file a complaint with the Department of Health and Human Services. We urge you to tell us about any privacy concerns. You will not be retaliated against in any way for filing a complaint.
‍

This Notice took effect on April 1, 2027, and stays in effect until it is replaced by another Notice.
‍

If you have any questions or complaints:

El Paso Health Plans, Inc.
Attn: Privacy Officer/Director of Compliance
P.O. Box 971100
El Paso, Texas 79997-1100

Phone: 1-888-310-3434
FAX: 915-532-2877
‍