• For Treatment: The Airports Authority may disclose your PHI to a health care provider who renders treatment on your behalf. For example, if you are injured due to an accident and are unable to provide your medical history to the medical provider, the Airports Authority may advise an emergency room physician about the types of prescription drugs you currently take.
• For Payment: The Airports Authority may use and disclose PHI so that we or others may bill or receive payment from you, an insurance company or a third party for the treatment and services you received.
For example, we may use and disclose PHI to assist employees with denied claims.
• For Health Care Operations: The Airports Authority may use and disclose PHI for health care operations purposes. These uses and disclosures are necessary for our operation and management purposes. For example, we may use PHI for purposes of assessing health care plan service, quality or performance or for analyzing associated costs. We may also use PHI for plan enrollment / eligibility purposes on behalf of an employee, or for assisting an employee with correcting benefits problems and understanding plan coverage / terminology.
• Health-Related Benefits and Services: For assessment and referral purposes, the Airports Authority may use PHI to manage the Employee Assistance Program.
• As Required by Law: The Airports Authority will disclose PHI when required to do so by federal, state or local law.
• Lawsuits and Disputes: If you are involved in a lawsuit or dispute, the Airports Authority may disclose PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request or other lawful process.
• Law Enforcement / National Security and Intelligence Activities: The Airports Authority may release PHI if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons or similar process. We may also disclose PHI to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
• To a Business Associate: Certain services are provided to the Airports Authority by third-party administrators known as“ business associates.” The Plan requires its business associates, through contract, to appropriately safeguard your health information.
• Military and Veterans: If you are or become a member of the U. S. Armed Forces, the Airports Authority may release medical information about you as deemed necessary by military command authorities.
• To Avert Serious Threat to Health or Safety: The Airports Authority may use and disclose your PHI, when necessary, to prevent serious threat to your health and safety or the health and safety of the public or another person.
INDIVIDUAL RIGHTS You have the following rights regarding PHI that the Airports Authority maintains about you:
• Breach of Unsecured PHI: You must be notified in the event of a breach of unsecured PHI. A“ breach” is the acquisition, access, use or disclosure of PHI in a manner that compromises the security or privacy of the PHI. PHI is considered compromised when the breach poses a significant risk of financial harm, damage to your reputation, or other harm to you. This does not include good faith or inadvertent disclosures or when there is no reasonable way to retain the information. You must receive a notice of the breach as soon as possible and no later than 60 days after the discovery of the breach.
• Right to Inspect and Copy: You have the right to inspect and copy PHI that may be used to make decisions about your care, payment for your care or for your health care operation including your PHI maintained in an electronic format. If your PHI is available in an electronic format, you may request access electronically and that this be transmitted directly to someone you designate. To inspect and copy this PHI, you must make your request in writing to the Privacy Officer.
• Right to an Accounting of Disclosures: You have the right to request an“ accounting of disclosures,” including a disclosure involving an electronic health record. This is a list of the disclosures we made of your PHI that is not one of the uses and disclosures described earlier.( Note: If a disclosure involved an electronic health record, then you have the right to request an accounting even if the disclosure was one of the uses and disclosures described earlier.) To request this list, you must submit your request, in writing, to the Privacy Officer.
• Right to Amend: If you feel that PHI the Airports Authority has is incorrect or incomplete, you may ask the Airports Authority to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Airports Authority. To request an amendment, you must make your request, in writing, to the Privacy Officer. We may deny the request if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you request amendment of information that:
– Was not created by the Airports Authority, unless the person or entity that created the information is no longer available to make the amendment;
– Is not part of the PHI kept by the Airports Authority;
– Is not part of the information that you are permitted to inspect and copy;
– Is without question accurate and complete.
• Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment or health care operations. In addition, you have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment of your care, like a family member or friend. For example, you could ask that we not disclose your PHI to your spouse. To request a restriction, you must make your request, in writing, to the Privacy Officer. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to disclose the information in certain emergency treatment situations. In addition to the above, you have the right to restrict disclosure of your PHI to the Airports Authority’ s group health plans for payment or health care operations( but not for carrying out treatment) in situations where you have paid the health care provider out-of- pocket in full. In this case, we are required to implement the restrictions that you request.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at certain locations. For example, you can ask that you be contacted only at work or by mail. To request confidential communications, you must make your request, in writing, to the Privacy Officer. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.
• Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice. You may ask for a paper copy of this notice, as well as the full Privacy Policy and Procedures, at any time. To obtain a paper copy of this notice and / or the full Privacy Policy and Procedures, please contact the Privacy Officer.
PRIVACY OFFICER Questions, concerns or complaints about the privacy of PHI should be directed to the following:
Metropolitan Washington Airports Authority Privacy Officer 1 Aviation Circle Washington, DC 20001-6000 703-417-8357 privacy. officer @ mwaa. com
COMPLAINTS If you believe your privacy rights have been violated, you may file a complaint with the Airports Authority’ s Privacy Officer or with the Secretary of the Department of Health and Human Services. To file a complaint with the Airports Authority’ s Privacy Officer, please direct correspondence to:
12 | METROPOLITAN WASHINGTON AIRPORTS AUTHORITY