|
Effective: July 1, 2007
Revision Date: July 6, 2010
This Privacy Policy describes how CareEntrust treats personal information received through the use of the CareEntrust website and/or other data received as a result of participating in CareEntrust. This policy governs the manner in which CareEntrust, a non-profit corporation organized and existing under the laws of the State of Delaware, USA (“[CareEntrust]”), collects, uses, maintains and discloses information collected from users (each, a “User”) of its www.CareEntrust.org web site (“Web Site”). The Web Site is not directed at children under 14 years of age.
As a business associate of many health care entities within the Kansas City metropolitan area, we are committed to maintaining a high level of confidentiality, privacy and security with the information that CareEntrust receives from our trading partners, sponsors and participating entities. CareEntrust wants to make sure that the community users understand the importance of privacy and security and how CareEntrust addresses those concerns both within the CareEntrust application and on the CareEntrust website.
As a part of our service to provide each consumer member with a CareEntrust Health Record, we receive and maintain health information about our consumer members. There are different types of individuals involved in this initiative. In order to assist you in understanding the different types of involvement, included below are some important definitions:
Business Associate means any organization that may be working on behalf of a covered entity such as health plan and/or healthcare provider.
Consumer Member means an individual who has their own health record within the CareEntrust system has the ability to share their information with their healthcare providers.
Contributor Source means an organization providing data to CareEntrust.
Covered Entity means for our purposes a healthcare provider and/or plan that is required to meet the HIPAA privacy and security laws.
Participating Entity means a natural person, corporation, Limited Liability Company, partnership, association, or other entity whose workforce may have access to the CareEntrust system and agrees to the terms of the Entity Agreement. More specifically, a participating entity is a healthcare provider who has been trained on the CareEntrust Health Record.
Sponsor means any organization that aggregates and pays for their health plan participants (consumer members) to be included in the CareEntrust Health Record initiative. Sponsors are likely to be employers, governments, unions and other providers of health benefit coverage, but an individual may also be able to sponsor themselves.
User means a person with authorized access.
The information that we may receive may include information that you as a consumer enter directly into our system or on our website. It may also include information that may be sent from a health care payer, sponsor or information sent or entered directly from your health care provider as a result of participating in CareEntrust.
Finally, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and accompanying federal regulations, consumer members have privacy rights over their protected health information such as the right to access their health information, the right to request restrictions on the use of their health information, the right to request amendments to their health information, the right to an accounting of disclosures of their health information and the right to request confidential communications. If you have any concerns related to the information contained within the CareEntrust system, please contact CareEntrust at privacy@CareEntrust.org . As a business associate of many covered entities, we will assist you on identifying the approach to exercise your rights regarding any information contained within the CareEntrust system.
CareEntrust may collect individually identifiable information from Consumer Members or Users in a variety of ways including to verify access or usage within the CareEntrust system or website (through the collection of “cookies”). Personally identifiable information may include (i) contact data (such as a User’s name, mailing and e-mail addresses); and (ii) demographic data (such as a User’s zip code, date of birth and member number). CareEntrust may also collect information about how individuals may use our Web Site, for example, by tracking the number of unique views received by the pages of the Web Site. While not all of the information that we collect from individuals is personally identifiable, it may be associated with personally identifiable information that individuals provide us through our Web Site. If you communicate with CareEntrust by e-mail, or otherwise complete online forms or surveys, any information provided in such communication may be collected by CareEntrust.
Uses and Disclosures of Protected Health Information
CareEntrust may use personally identifiable health information collected through our Web Site and/or the CareEntrust system to contact Consumer Members or Users regarding existing services offered by CareEntrust, and otherwise to enhance Users' and/or consumer members’ experience with CareEntrust. All disclosures are logged within the CareEntrust system are available for review at any time by the consumer members within their CareEntrust health record.
Personally Controlled Health Record
Included below are examples of the types of disclosures that may occur as a result of participating in the CareEntrust and maintaining a CareEntrust record.
Disclosures to Consumers: Information that is disclosed back to the consumer is their own healthcare information received through enrollment in this benefit.
Disclosures to Healthcare Providers: Each healthcare provider that has access to the CareEntrust system will go through the registration and training process offered by CareEntrust. This process will assist in ensuring that each individual provider has the appropriate access and permission within the CareEntrust system based on their role within a Participating Entity. Safeguards implemented to assist in providing appropriate access include:
- A unique username and password is assigned to each member (consumers and providers)
- Role based security levels are assigned based on a User’s role within a Participating Entity.
- A Terms of Use Agreement must be agreed to by each participant prior to accessing CareEntrust. In addition, each participating entity must identify a site administrator from the Participating Entity responsible for monitoring the use of the CareEntrust application.
- CareEntrust provides an audit trail of all access to each record to assist a consumer in monitoring access to his/her CareEntrust Health Record.
- The capability for the consumer member to make their information viewable to healthcare providers is available within his/her own record.
- Sensitive information as defined by both Kansas and Missouri state laws are currently hidden from view. You may also see the Information Availability tab located within the application to see an overview of what information is classified as “sensitive” by state and federal laws.
Disclosures to Third Parties: As a business associate for participating entities and/or sponsors, we may disclose your personal information to our business associates and/or subcontractors who work with CareEntrust in order to provide you with your CareEntrust Health Record. These agents and subcontractors are responsible for meeting federal and state laws (including HIPAA). CareEntrust will not sell or license that information outside of CareEntrust for any reason, unless you authorize us to do so.
Disclosure of Aggregate information: CareEntrust may disclose aggregate data to third parties. This information is not associated with any individual member. An example of the aggregate data would be the monitoring of the usage of the website.
Disclosures Required by Law: We may also be required to disclose health information about you when in certain limited situations we are Required By Law to do so such as in the case of a court order or search warrant or when federal, state or local law requires us to disclosure the information, when Law Enforcement makes a lawful demand for the information, to report certain information in a Public Health Emergency, and to report information to avert a serious threat to health or safety of yourself or others.
Finally, as allowed by law, we may transfer information collected from Users in connection with any sale, merger or reorganization of CareEntrust.
Website
CareEntrust may also use information collected through our Web Site to: (i) verify that Users meet the criteria required to process their requests, or (ii) for research regarding the effectiveness of the Web Site.
There are two different types of Users of the CareEntrust system: Consumer Members and Healthcare Providers. Both Consumer Members and Healthcare Providers agree to the Terms of Use Agreement and/or Entity Agreement prior to accessing the CareEntrust system. By utilizing the CareEntrust website and/or system, you accept the terms of CareEntrust’s Privacy Policy. Each type of user has a different method for enrolling in CareEntrust.
Consumer Member Enrollment
Consumer Members are enrolled in CareEntrust during the Benefit enrollment process offered by their participating Employer. Each consumer member will receive membership information that is called a “membership ticket” in order to log into the application during the enrollment process. This information as well as other personal information will be used to authenticate the user with their own unique account. Consumer members will be responsible for the creation of their own username and password once they have received the “membership ticket” information. Consumer members will have access to open the Consumer application and view their own health information. For those individuals that are under the age of 14, the subscriber of the health plan will receive the “membership ticket” information for minor (s) under the age of 14. For those individuals between the ages of 14 and 18, these individuals will receive their own “membership ticket” information via U.S. mail.
Note: All consumer member accounts will continue to remain active even if an employee leaves an employer and joins another employer. The information included in the account will only populate additional information if the new employer participates in CareEntrust.
If you are not interested in participating in CareEntrust at this time, please contract CareEntrust Support at 816-221-7710 ext 200 to opt out of this program.
Healthcare Providers Enrollment
In order for healthcare providers to use and access CareEntrust health records, each healthcare provider will need to agree to our Terms of Use Agreement, and Participating Entities may be asked to sign an Entity Agreement. In addition, each healthcare provider user will only be provided the appropriate access to the system based on their role within their affiliated Participating Entity. Each user of the system will receive training from the CareEntrust staff, and Participating Entities will also identify a site administrator to work with CareEntrust. The CareEntrust workforce will be continually engaged in communications with the healthcare providers utilizing the system.
CareEntrust allows the ability for each consumer member to make their health information viewable among healthcare providers participating in CareEntrust. Consumer members may, at any time, change their preference in their CareEntrust record to allow access among healthcare providers and will also be able to monitor all accesses to their information. If a consumer member is unsure as to how to make the change to their preference, then a consumer member can call the CareEntrust Support at 1-816-221-7710 ext 200 or e-mail support@CareEntrust.org.
If a Consumer Member or User’s personally identifiable information changes (such as your address), or if a Consumer Member or User no longer desires to receive information from us, we will endeavor to provide a way to correct, update and/or remove that Consumer Member’s or User’s personal data provided to us. This can be done by emailing a request to us at support@CareEntrust.org. However, if your information was sent to us from a healthcare provider or health plan, your personal information must be updated at the primary source (by health provider or health plan) in order to correct the information. If you have any questions, you can contact CareEntrust Support at 816-221-7710 ext 200 or by e-mailing us at support@CareEntrust.org.
Securing the information contained within the CareEntrust health record and/or website is protected using appropriate industry standard security measures. CareEntrust’s system is hosted in a 70,000 square foot, dual fed, redundant data operation facility intended to provide uninterrupted power and service for those users of the CareEntrust health record. In order to promote privacy and security, functionality used includes Security Sockets Layer (SSL), role-based access, audit capabilities, VPN encryption and supporting documentation to meet regulatory requirements (including HIPAA). The facility is monitored 24 hours a day, 365 days a year and information including access to the system is logged within the CareEntrust application. As discussed in the above sections, each individual creates their own unique username and password. Each consumer member will be able to monitor access to their own record. Please email us at support@CareEntrust.org if you have additional questions related to the security of the system.
If you have any questions or concerns related to the CareEntrust health record or website, please send us your questions and comments via e-mail to support@CareEntrust.org. Please note, however, that e-mail communications are not a secure form of communications between CareEntrust and the User. From an internet standpoint, there is a risk that unauthorized access by other Internet users is possible. PLEASE DO NOT SEND INFORMATION IN WHICH YOU FEEL IS CONFIDENTIAL TO US VIA E-MAIL. If you have specific privacy and/or security concerns, please contact the Chief Privacy/Compliance Officer at 816-221-7710 ext 100 or privacy@CareEntrust.org .
For any documentation that is received from you, CareEntrust will retain your communication until we have attempted to provide you with a response to your question or concern. As a result of your question or concern, CareEntrust will either discard your communication or retain it for documentation purposes.
For more information regarding our privacy practices at CareEntrust or if you have a privacy concern, please contact Chief Privacy/Compliance Officer at CareEntrust immediately at 1-816-221-7710 ext 100. You may also send an e-mail to privacy@CareEntrust.org (see email section above) or
CareEntrust
1100 Walnut Street Suite 2980
Kansas City, MO 64106
CareEntrust reserves the right, at its discretion, to change, modify, add, or remove portions of this Privacy Policy at any time by posting such changes to this page in a manner that is easily identifiable. Please check this Privacy Policy periodically for changes. The continued use of the Web Site and/or CareEntrust system following the posting of changes to these terms will mean that you accept those changes.
CareEntrust reserves the right at any time, for any reason, and without notice to discontinue access to the Web Site. In such event, the information stored in the CareEntrust database will be securely destroyed or securely archived consistent with applicable laws and regulations.
|
