1. a) The Department shall provide an annual notice of privacy practices outlining the legal duties and privacy practices concerning the PHI of Members and Dependents.

2. b) PHI may be disclosed:

   1. 1) to health care providers who take care of Members and Dependents;
   2. 2) to process claims and make payments for covered services;
   3. 3) for healthcare operations;
   4. 4) to remind Members or Dependents of an upcoming appointment; and
   5. 5) as required or authorized by law.

3. c) Members and Dependents have the right to:

   1. 1) request restrictions on how their PHI is used for purposes of treatment, payment and healthcare operations;
   2. 2) receive confidential communications about their PHI;
   3. 3) request to inspect information used to make decisions about them;
   4. 4) request an amendment to their PHI;

   5. 5) receive an accounting of disclosures that have been made of their PHI;

      1. 6) obtain a paper copy of the annual notice of privacy practices provided by the Department; and
   6. 7) file a complaint if they feel that their privacy rights have been violated.

4. d) PHI may not be disclosed:

   1. 1) for any purpose other than administration of the benefit plan;
   2. 2) for any fundraising activity;
   3. 3) for the marketing of any products or services.

The State shall comply with the uses and disclosures of Protected Health Information (PHI), permitted by HIPAA and 45 CFR 160-164, where applicable, in Plan documents.

(Source: Added at 32 Ill. Reg. 15994, effective September 11, 2008)