Notice of privacy practices

This notice describes how health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

At Providence Health Plan (PHP), we are required by federal and state law to protect the privacy of your protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA). PHP must provide you with this notice and abide by the terms of this notice. This notice explains how PHP may use and share information about you to administer your benefits and informs you about your rights as a valued member. It also explains how you can exercise these rights. PHI, also called your health information, refers to information about your health or healthcare services that can be used to identify you as an individual. This includes:

• Details about your past, present, or future physical or mental health or condition
• Information related to the provision of health care to you
• Payment information related to your health care services

In addition to PHI, PHP also protects your Personally Identifiable Information (PII), which includes data that can be used to identify you individually such as your name, address, date of birth, or Social Security number. PHP understands the sensitivity of this information and has policies in place to safeguard it from unauthorized access, use, or disclosure. PHP collects PII as part of business operations to verify your identity, manage member accounts, and support the delivery of health plan services. Protecting your PII is an essential part of earning and maintaining your trust as a valued member.

How PHP Uses and Discloses Your PHI Without Your Written Authorization

PHP may use and disclose your protected health information for different purposes. PHP will use PHI and may share it with others while providing health benefits. The examples below are provided to illustrate the types of uses and disclosures PHP may make without your authorization for treatment, payment, and health care operations.

Treatment:

• PHP does not provide treatment. This is the role of your healthcare provider, such as your doctor or a hospital.
• PHP may use and disclose your health information as needed to coordinate, manage or support your care with your healthcare providers.

Payment:

• PHP may use and share your health information to process and pay claims submitted by your healthcare providers.
• PHP may share an Explanation of Benefits (EOB) with the subscriber of your plan to help with payment of claims.
• PHP may use and disclose your health information to collect premiums and calculate cost-sharing amounts.

Healthcare Operations:

• PHP may use or disclose your health information to assist you with benefit, claim or coverage questions.
• PHP may use your health information to review the quality of care and services you receive.
• PHP may use your health information to coordinate and improve preventive services and chronic condition management programs (such as immunizations, cancer screenings, or programs for asthma, diabetes, or high blood pressure).
• PHP may use or disclose your health information for subrogation or third-party liability activities to recover costs of care.
• PHP may use or disclose your health information to an independent review organization (IRO) if you request an external review of a coverage decision.
• PHP may use or disclose your health information with accreditation and credentialing organizations to maintain PHP’s licenses and certifications.
• PHP may use the minimum necessary health information from your electronic medical record such as hospital discharge notes or treatment summaries to help coordinate your care or connect you with follow-up services.

Plan Sponsor/Administrator

If you receive health plan benefits through your employment, PHP may share limited information with your employer’s health plan administrator.

• We may share your health information with your plan sponsor (your employer or group health plan) only when needed to obtain bids, manage, or administer the plan.
• If your employer helps pay your premium but does not pay your medical claims, your employer:
• May not access your health information except as needed to obtain bids, manage, or end the plan.
• Must agree in writing to protect your information and use it only as permitted by law.

Sharing Your Health Information with Those Involved in Your Care

PHP may share your health information in some cases with family members, friends, or others who are involved in your care or payment for your care.

• PHP may share information when you give us your verbal or written permission.
• If there is an emergency and you are unable to communicate, PHP may share information if PHP believes it is in your best interest.
• PHP may also share information to help protect your health and safety or the health and safety of others.

Other Ways PHP May Use and Share Your Health Information Without Authorization

For Legal and Law Enforcement Purposes

• When required by law.
• In response to a court order, subpoena, or other legal request.
• To law enforcement officials when required by law, such as to locate a suspect or report a crime.
• To government agencies involved in national security, military, or protective services.

For Oversight and Compliance

• To government agencies that oversee health care, such as licensing boards, auditors, or regulators.
• To the Secretary of the U.S. Department of Health and Human Services to oversee our compliance with HIPAA.

For Research

• For research purposes when permitted by law and subject to required protections.

For Organ Donation and Decedents

• To help identify a deceased person, determine the cause of death, or facilitate organ or tissue donation.

With Business Associates

• To vendors or contractors (called “business associates”) who help PHP operate and deliver services. These partners are required by law to protect your information.

Disclosures Requiring Your Written Authorization

PHP is required to obtain your written authorization to use or disclose your protected health information, with limited exceptions, for the following reasons:

• Marketing. PHP will request your written authorization to use or disclose your protected health information for marketing purposes with limited exceptions, such as when we have face-to-face marketing communications with you or provide promotional gifts of nominal value.
• Sale of Protected Health Information. PHP does not sell PHI or PII and must request your written authorization before making any disclosure that is considered a sale of your protected health information.
• Other Uses or Disclosures. Any other uses or disclosures of your protected health information not described in this Notice will be made only with your written authorization, unless otherwise permitted or required by law.

Additional Privacy Protections for Sensitive Health Information

Federal and state laws may require enhanced privacy protections for certain types of health information. These may include:

• Alcohol, drug and substance use (diagnosis, treatment and referral information)
• Gender-affirming care
• Genetic information (services or tests)
• HIV (testing and treatment)
• Psychotherapy or counseling notes
• Reproductive health care

If PHP receives substance use disorder information from a federally assisted program covered by 42 CFR Part 2, PHP is required to implement additional safeguards to protect your SUD information.

• If you provide a general consent to the Part 2 program permitting your information to be used or disclosed for treatment, payment, or health care operations, PHP may use and disclose that information as permitted under HIPAA.
• If you give specific consent directly to PHP or another party, PHP will use and disclose your Part 2 information only as expressly permitted in that consent.
• PHP may use or disclose this information for treatment, payment, or health care operations.
• PHP will not use or disclose your Part 2 records, or any related testimony, in civil, criminal, administrative, or legislative proceedings without your consent or a court order that provides you notice before release.

   

If your PHI is subject to enhanced protection, PHP may only disclose it with your prior written authorization unless otherwise permitted or required by law.

Revocation of an Authorization

• You may cancel your authorization in writing at any time before it expires.
• If your information was shared based on your permission, it may be re-disclosed by others and may no longer be protected under state or federal privacy laws.
• Some laws may limit the re-disclosure of certain types of sensitive health information, such as mental health information, genetic information or substance use disorder information (diagnosis, treatment or referral).

Privacy Rights Regarding Your Health Information

Right to Access your Health Information:

• You have the right under HIPAA to request a copy of your health information that is maintained by PHP.
• You may request your health information in a paper copy or in an electronic format. PHP will provide it in the format you request if it is available. If not, we will provide it in a readable format.
• PHP requires that your request for your health information be made in writing.
• If PHP denies your request for your health information, PHP will notify you in writing and explain the reason and how you can appeal or respond.
• You also have the right to request a copy of your medical records from your doctor or another health care provider.

Right to an Accounting of Disclosures of Your Health Information:

• You have the right under HIPAA to receive a list of disclosures PHP has made of your health information, except for those made for treatment, payment, or health care operations, or disclosures made with your authorization.
• This list may include disclosures made for public health reporting, law enforcement or other legal requirements.
• PHP requires that your request for an accounting of disclosures be made in writing and includes the time period you are requesting.
• The time period may not be longer than six years from the date of your request.

Right to Amend Your Health Information:

• You have the right under HIPAA to request a change to your health information that is maintained by PHP, if you believe it is inaccurate or incomplete.
• PHP requires that your request to amend your health information be made in writing.
• If PHP approves your request, the amendment will be added to your record, and PHP will inform others who received the original information, if they need to know about the change.
• If PHP denies your request for amendment of your health information, PHP will notify you in writing and explain the reason and how you can appeal or respond.

Right to Confidential Communications:

• You have the right under HIPAA to request that PHP communicate with you using a specific method or at an alternative location if you believe the disclosure of your health information could endanger you. For example, you may ask PHP to send your health information only by U.S. mail or to an address other than your home. PHP will accommodate reasonable requests.
• All PHP members have the right to request their health information be sent to a different address if sending to your current address may put you in danger. PHP will accommodate reasonable requests of this kind. PHP will not require you to explain why you believe you are in danger to process your request. You may make this request either in writing or verbally.
• Some state laws provide additional privacy protections for which members have the right to request their plan information containing health or personal information be sent to another address, or that PHP may not disclose your information to the policyholder/subscriber. These state-specific requests must be made in writing.

Right to Request Restrictions on the Use and Disclosure of Your Health Information

• You have the right under HIPAA to request that we restrict or limit how we use or disclose your health information for treatment, payment or health care operations.
• If we agree, we will comply with your request unless the information is needed in an emergency. While we will consider your request for a restriction, by law we are not required to agree, as some requests may not be possible based on our operations or legal obligations.
• PHP requires that your request to restrict your information must be made in writing.

Right to a Notice in the Event of a Breach of Your Health Information

• You have the right under HIPAA to receive a notice if PHP determines that your health information was involved in a breach.
• PHP will provide this notice without unreasonable delay and no later than 60 days after discovering the breach. The notice will include a description of what happened, the type of information involved, the actions PHP has taken to investigate and prevent further disclosures, the steps you can take to protect yourself from potential harm and how to contact PHP for more information.

How PHP Protects and Secures Your Information

All caregivers are required to comply with the HIPAA security and privacy policies. PHP has policies and procedures in place to ensure the confidentiality of your health information. PHP keeps your verbal, written, and electronic health information safe using administrative (policies), technical (encryption), and physical (locked storage) safeguards that follow federal and state laws. Some of the ways we protect your information include:

• Our caregivers are required to:
• Sign the Acceptable Use Agreement, Confidentiality and Nondisclosure statement.
• Complete privacy and security training when hired and on an annual basis.
• Only access your health information when needed to perform job duties.
• Securely dispose of written health information.
• Report any privacy or security violations.
• Use secure logins and passwords to access PHP systems.
• Work in systems protected by firewalls, encryption, and data back-up protocols.
• Wear ID badges when entering PHP buildings.


• PHP agreements with providers include confidentiality provisions that require them to protect your health information in accordance with HIPAA and other applicable privacy laws.
• PHP monitors its systems to detect and prevent unauthorized access to your health information.
• PHP limits the amount of health information it uses or shares to only what is necessary for the intended purpose.
• PHP requires vendors and contractors who handle your information to meet privacy and security standards.

How to Use Your HIPAA Rights:

You may also find the Member Authorization and Privacy forms on our website at:
https://healthplans.providence.org/members/understanding-plans-benefits/benefit-basics/forms/

You can also use our secure online portal to ask privacy-related questions. You will need to log in to your MyProvidence account, or register for one if you don’t have an account yet:
www.myprovidence.com

You can use your HIPAA rights by contacting Customer Service.

• If you have any questions about your health information or if you believe that your privacy rights have been violated, please contact Customer Service at: 503-574-7500 or 1-800-878-4445.
• If you are hearing impaired and use a Teletype (TTY) Device, please call our TTY line at 711. Customer Service Representatives can be reached Monday through Friday, between 8 a.m. and 5 p.m.

You may file a complaint with PHP in writing at:

Providence Health Plan
Attn: Appeals and Grievance Dept.
P.O. Box 4327
Portland, OR 97208-4327

If you have questions or concerns about PHP’s privacy practices or your privacy rights, please contact our HIPAA Privacy Rights Hotline at (503) 574-7770.

You have the right to file a complaint with the Office for Civil Rights (U.S. Department of Health and Human Services) if you believe your privacy rights have been violated. PHP will not retaliate against you for filing a complaint. You may contact the Office for Civil Rights at:

Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201

OCR Hotlines-Voice: 1-800-368-1019
E-mail: OCRComplaint@hhs.gov
Website: Office for Civil Rights https://www.hhs.gov/ocr/index.html

Your Rights to Receive This Notice

• You have the right to request a copy of this notice at any time, including a paper copy, even if you agreed to receive it electronically.
• PHP may change the terms of this notice at any time. If that happens, the updated notice will apply to all health information PHP maintains.
• PHP will post the revised notice on its website by the effective date of the change.
• PHP will also include the revised notice in the next annual mailing to members.

The most current version will always be available online at: https://healthplans.providence.org/about-us/privacy-notices-policies/notice-of-privacy-practices/

Effective date of this notice

The original effective date of this Notice was April 14, 2003. The most recent revision date is Feb. 1, 2026.