← Back

Notice of Privacy Practices

Effective January 1, 2023

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") applies to certain of DEVOTED HEALTH, INC.'s subsidiaries and related entities. These entities have designated themselves as an "Affiliated Covered Entity" for purposes of compliance with federal privacy laws, e.g., HIPAA. An Affiliated Covered Entity is a group of health plans and/or healthcare providers under common ownership or control that designates themselves as a single entity for purposes of compliance with HIPAA. These entities are collectively referred to as “Devoted Health” in this Notice. Devoted Health is required by law to maintain the privacy of your health information in accordance with applicable federal and state law. This Notice outlines our legal duties and privacy practices with respect to health information with respect to the following Devoted Health entities:

DEVOTED HEALTH INSURANCE COMPANY;
DEVOTED HEALTH INSURANCE COMPANY OF ALABAMA, INC.;
DEVOTED HEALTH PLAN OF ALABAMA, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF ARIZONA, INC.;
DEVOTED HEALTH PLAN OF ARIZONA, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF COLORADO;
DEVOTED HEALTH PLAN OF COLORADO, INC.;
DEVOTED HEALTH INSURANCE COMPANY;
DEVOTED HEALTH PLAN OF FLORIDA, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF HAWAII, INC.;
DEVOTED HEALTH PLAN OF HAWAII, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF ILLINOIS, INC.;
DEVOTED HEALTH PLAN OF ILLINOIS, INC.;
DEVOTED HEALTH PLAN OF NORTH CAROLINA, INC.;
DEVOTED HEALTH PLAN OF OHIO, INC.;
DEVOTED HEALTH PLAN OF OREGON, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF PENNSYLVANIA, INC.;
DEVOTED HEALTH PLAN OF PENNSYLVANIA, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF SOUTH CAROLINA;
DEVOTED HEALTH PLAN OF SOUTH CAROLINA, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF TENNESSEE, INC.;
DEVOTED HEALTH PLAN OF TENNESSEE, INC.;
DEVOTED HEALTH INSURANCE COMPANY OF TEXAS;
DEVOTED HEALTH PLAN OF TEXAS, INC.;
DEVOTED MEDICAL GROUP, INC.;
DEVOTED MEDICAL GROUP, PC;
DEVOTED MEDICAL, PC;
DEVOTED MEDICAL NC, PC;
DEVOTED MEDICAL PA, PC; and
DEVOTED MEDICAL GROUP OF TEXAS, INC.

We Are Legally Required to Safeguard your Protected Health Information

We are required by law to:

• Maintain the privacy of your health information, also known as “protected health information” or “PHI,”
• Provide you with this Notice,
• Comply with this Notice, and
• Notify you following a breach of your unsecured PHI

We reserve the right to change our privacy practices and the terms of this Notice at any time. If we make any material change in our practices, we will change this Notice and post the new Notice on our website. Any new terms of our Notice will be effective for all of your information, including information that we create or receive before we make any change. Each version of the Notice will have an effective date. We will provide a copy of the new Notice (or information about the changes and how to obtain the new Notice) in our next annual mailing to members or patients who we cover at that time. You may also obtain a copy of the revised Notice upon request, by contacting us using the information listed at the end of this Notice.

How We May Use and Disclose Your Protected Health Information

The law permits us to use and disclose your PHI for certain purposes without obtaining your written authorization. This Section gives examples of each of these circumstances.

Uses and Disclosures for Treatment, Payment, and Healthcare Operations

• Treatment: We may use or disclose your PHI for purposes of your treatment. For example, we may disclose your PHI to physicians, nurses, and other healthcare professionals who are involved in your care. We may also use and disclose your PHI to tell you about treatment alternatives or health-related benefits or services that may interest you. We may disclose your PHI to other providers to help support their efforts to deliver high quality care or to simply verify that they're indeed treating you. 
• Payment: We may use or disclose your PHI to provide payment for the treatment you receive. For example, we may use and disclose your PHI to obtain premiums, to pay and manage your claims, to coordinate your benefits, and to review healthcare services provided to you. We may also use and disclose your PHI to determine your eligibility or coverage for health benefits or to evaluate medical necessity or the appropriateness of care or charges. In addition, we may use and disclose your PHI as necessary to pre-certify and preauthorize services for you. We may further use and disclose your PHI to adjudicate your claims. Also, we may disclose your PHI to other healthcare providers or entities who need it to obtain or provide payment for your treatment. 
• Healthcare Operations: We may use or disclose your PHI for our healthcare operations. For example, we may use your PHI to evaluate the quality of the healthcare you received from providers in participating networks or preferred providers. We may also disclose your PHI to other providers to help support their efforts to deliver high quality care or to simply verify that they're indeed treating you. We may use or disclose your PHI to conduct audits, for purposes of risk management, and for purposes of underwriting and ratemaking; however, we are prohibited from using genetic information for certain underwriting purposes, such as determining eligibility to enroll in a health plan or determining the amount of premiums to be charged to an individual. In addition, we may disclose your PHI to third party business associates who provide us with billing, consulting, transcription, or other services. Our agreements with them require that they protect your information in accordance with the law.

Disclosures to the Sponsor of Health Plans

Your health plan contracts with us to provide certain medical services to you. We may disclose your PHI to your health plan sponsor for treatment, payment, and health plan operations and administration. For example, we may provide your health plan with certain data to ensure we are providing quality care to you.

Uses and Disclosures That Require Us to Give You the Opportunity to Object

If you verbally agree to the use or disclosure of your PHI, and in certain other situations, we may make the following uses and disclosures of your PHI. We may disclose certain PHI to your family, friends, and anyone else whom you identify as involved in your healthcare or who helps pay for your care; the PHI we disclose would be limited to the PHI that is relevant to that person's involvement in your care or payment for your care. We may also make these disclosures after your death as authorized by applicable law unless doing so is inconsistent with any prior expressed preference.

We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or any other person responsible for your care regarding your location, general condition, or death. We'll also use or disclose your PHI to public health authorities who are permitted or required to collect or receive this information for the purposes of controlling disease, injury, or disability. If directed by that health authority, we'll also disclose your health information to a foreign government agency that is collaborating with the public health authority.

Other Uses and Disclosures

HIPAA also allows us to disclose PHI without your authorization in the following circumstances:

• When Required by Law. We disclose PHI when we are required to do so by federal, state or local law.  
• For Public Health Activities. For example, we disclose PHI when we report to a public health authority for purposes such as public health surveillance or public health investigations (such as to the US Food and Drug Administration to report or track product defects/recalls).  
• For Reports About Victims of Abuse, Neglect, or Domestic Violence. We will disclose your PHI in these reports only if we are required or authorized by law to do so, or if you otherwise agree.  
• To Health Oversight Agencies. We will provide PHI as requested to government agencies that have authority to audit or investigate our operations.  
• For Lawsuits and Disputes. If you're involved in a lawsuit or dispute, we may disclose your medical information in response to a court or administrative order. We may also disclose your medical information in response to a subpoena, discovery request, or other lawful process filed by someone else involved in the dispute — so long as the party seeking the information provides us with satisfactory assurance that you've been given notice of the request, and that the party seeking the information has received a protective order for the information requested.  
• To Law Enforcement. We may disclose your PHI to a law enforcement official in response to a court order, subpoena, warrant, summons, or similar process; in cooperation with legitimate state or federal investigations such as fraud as well as activities that include national security, intelligence, and protective services; regarding the victim of a crime if, under certain limited circumstances, we're unable to obtain the person’s agreement; regarding a death we believe may be the result of criminal conduct; in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.  
• To Coroners, Medical Examiners and Funeral Directors. We may disclose PHI to facilitate the duties of these individuals.  
• To Organ Procurement Organizations. We may disclose PHI to facilitate organ donation and transplantation.  
• For Research. Under certain circumstances, we may disclose your PHI to researchers who are conducting a specific research project. For certain research activities, an Institutional Review Board (“IRB”) or Privacy Board may approve uses and disclosures of your PHI without your authorization.  
• To Avert a Serious Threat to Health or Safety. We may disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the public.   For example, we may disclose your PHI to authorized federal officials for intelligence and national security activities that are authorized by law, or so that they may provide protective services to the President or foreign heads of state or conduct special investigations authorized by law.  
• For Specialized Government Functions. For example, we may disclose your PHI to authorized federal officials for intelligence and national security activities that are authorized by law, or so that they may provide protective services to the President or foreign heads of state or conduct special investigations authorized by law.  
• Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official to assist them in providing you healthcare, protecting your health and safety or the health and safety of others, or providing for the safety of the correctional institution.  
• To Workers’ Compensation or Similar Programs. We may provide your PHI to these programs in order for you to obtain benefits for work-related injuries or illness.

Please be aware that state and other federal laws may have additional requirements that we must follow or may be more restrictive than HIPAA on how we use and disclose certain of your PHI. If there are specific more restrictive requirements, even for some of the purposes listed above, we may not disclose your PHI without your written permission as required by such laws. For example, we may be required by law to obtain your written permission to use and/or disclose your mental illness, developmental disability, or alcohol or drug abuse treatment records, reproductive health, HIV, STD, or other communicable disease related information, or your genetic test results in certain situations.

Uses and Disclosures Requiring Your Authorization

We must obtain your written authorization to use or disclose your PHI in circumstances not described above, including for marketing activities or before your PHI is sold. 

If you give us written authorization for a use or disclosure of your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization we will no longer use or disclose your PHI for the purposes specified in the written authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your PHI that occurred before you notified us of your decision, any actions that we have taken based upon your authorization, or if your authorization was obtained as a condition to your obtaining insurance coverage and the law permits us to contest a claim or the policy. To revoke an authorization, make a written request to our Privacy Officer, using the contact information below.  

Your Rights Regarding Your Protected Health Information 

You have the following rights regarding your PHI.
All requests or communications to us to exercise your rights discussed below must be submitted in writing to the Privacy Officer at the contact information listed below. 

The Right to Choose How We Communicate With You.
You have the right to ask that we send information to you at a specific address (for example, at work rather than at home) or in a specific manner (for example, by email rather than by regular mail, or never by telephone). We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. 

The Right to See and Copy Your PHI.
Except for limited circumstances (e.g., information contained in psychotherapy notes or information gathered in anticipation of use in a civil, criminal, or administrative proceeding), you may look at and copy your PHI if you ask in writing to do so. You may ask for a paper copy or, if your PHI is maintained electronically, an electronic copy of your PHI, and you may ask that the copy be sent to someone that you designate. We will respond to your request within 30 days (or 60 days if extra time is needed). In certain situations we may deny your request (e.g., if it is reasonably likely to put you or someone else in danger), but if we do, we will tell you in writing of the reasons for the denial and explain your rights with regard to having the denial reviewed. We may charge you a fee authorized by law to meet your request. Alternatively, we may provide you with a summary or explanation of your PHI, as long as you agree to that and to the cost, in advance. 

The Right to Correct or Update Your PHI.
If you believe that the PHI we have about you is incomplete or incorrect, you may ask us to amend it. Any such request must tell us why you think the amendment is appropriate. We will act on your request within 60 days (or 90 days if extra time is needed), and will inform you in writing as to whether the amendment will be made or denied. If we agree to make the amendment, we will make reasonable efforts to notify other parties that we know have your PHI of the amendment. If we agree to make the amendment, we will also ask you whom else you would like us to notify of the amendment. Under certain circumstances we may deny your request. If your request is denied, we will provide you with information about our denial and how you can file a written statement of disagreement with us that will become part of your record. 

The Right to Get a List of the Disclosures We Have Made.
You have the right to request an accounting of disclosures we make of your PHI. Please note that certain disclosures need not be included in the accounting we provide to you (such as disclosures made for payment, treatment, or healthcare operations or for uses or disclosures otherwise permitted or required by law). Your request must state a time period which may not go back further than six years. You will not be charged for this accounting, unless you request more than one accounting per year, in which case we may charge you a reasonable cost-based fee for providing the additional accounting(s). We will notify you of the costs involved and give you an opportunity to withdraw or modify your request before any costs have been incurred. We will respond to your request within 60 days (or 90 days if extra time is needed). 

The Right to Request Limits on Uses and Disclosures of Your PHI.
You have the right to request that we limit how we use or disclose your information. Except under limited circumstances, we are not required to agree to your request, but if we do, we will abide by our agreement (except in an emergency). 

The Right to Get a Paper Copy of This Notice.
Even if you have agreed to receive this Notice by email, you have the right to request a paper copy as well. You may obtain a paper copy of this Notice by contacting the Privacy Officer using the contact information below. You may also visit our website at
www.devoted.com/privacy-practices.  

Complaints 

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the federal Department of Health and Human Services Office of Civil Rights. To file a complaint with us, you must make that complaint in writing and send it to our Privacy Officer using the contact information below. We will not retaliate against you for filing a complaint. You may also contact our Privacy Officer if you have questions or comments about our privacy practices. 

FOR MORE INFORMATION ABOUT ANY OF OUR PRIVACY PRACTICES, TO EXERCISE YOUR PRIVACY RIGHTS, OR TO FILE A COMPLAINT, CONTACT OUR PRIVACY OFFICER AT: 

Paul Jernigan, Privacy Officer
c/o Devoted Health, Inc.
PO Box 21327
Eagan, MN 55121
1-800-338-6833 (TTY 711)