Introduction

It Starts With Me Health (ISWM) is required by law to maintain the privacy of your health information and provide you with notice of its legal duties and privacy practices with respect to your health information. 

This Privacy Policy sets forth ISWM's obligations and your rights in accordance with the Health Insurance Portability & Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and the regulations promulgated under these Acts, but does not imply that ISWM is necessarily acting as a Covered Entity as defined by HIPAA. In most instances, ISWM receives and shares your Protected Health Information (PHI) as a Business Associate and in accordance with a Business Associate Agreement. If you participate in a wellness program (Program) as a member of a Health Plan, the Health Plan's Notice of Privacy Practices is also applicable to your PHI. When you receive health care services from a third-party, such as laboratory testing services, the laboratory's Notice of Privacy Practices may apply to your PHI. In all situations, your PHI is obtained, maintained and shared in a private and secure manner consistent with HIPAA requirements by each of these entities.  

All capitalized terms not otherwise defined shall have the meanings assigned to them under HIPAA. References to "us", "we" and "our" refer to ISWM. 

I. Our Commitment Regarding Your Personal Health Information

ISWM is committed to maintaining and protecting the information you supply—including all personal information, the results of biometric screening tests, the information in your health assessment risk profile, and other health data or information collected. 

ISWM keeps your PHI safe through the use of a combination of physical, electronic, and procedural safeguards in accordance with applicable Federal and State laws. To use the ISWM website, you will create your own password protected account. You can change your contact information and password information on the site. Data transfer, storage, and integrity are secured and transmitted via secure encryption technology and regular data backups. ISWM also limits access to your PHI to employees, contractors and agents who need the data to do their jobs or provide their services.  To the extent ISWM is providing services for or on behalf of a HIPAA Covered Entity, ISWM is required by law to maintain the privacy of PHI and to notify the Covered Entity of any breach of unsecured PHI. 

ISWM reserves the right to make changes to this notice and to make such changes effective for all PHI we may already have about you. If and when this notice is changed, we will post this information on our website and provide you with a copy of the revised notice upon your request or as otherwise required by law. It is your responsibility to check our website periodically for updates or changes to our policy.

II. How ISWM May Use and Disclose Your Protected Health Information

A. Uses and Disclosures for Treatment, Payment, and Operations 

ISWM is permitted to use and disclose PHI for treatment, payment, and health care. When applicable, we are permitted to use and disclose PHI in accordance with a Business Associate Agreement (BAA) as required by HIPAA. The following examples are demonstrative and may not be inclusive of every type of use or disclosure that may fall within that category. 

Treatment. ISWM provides health screening and other employee health related programming. ISWM is permitted to use and disclose your PHI in connection with your participation in a Program. Your Program may involve, among other things, completing a health risk assessment form, obtaining laboratory biometric screenings for various health risks, and discussing your health, fitness, or other topics with staff or others associated with the Program. With regard to the health screening process, ISWM provides you with a printed copy of your health screening results, explanations of laboratory test results, and other health care information that may be relevant to you. 

Payment. ISWM may use and disclose Health Information so that ISWM and/or others may bill and receive payment from you, an insurance company or a third party for the treatment and services you received. Individuals may pay for additional tests or services at health screenings and payment is required at the time of the screening for those services. ISWM will not bill insurance on your behalf for those services. ISWM will provide a flex/insurance ready receipt for additional tests or services requested and paid for by the individual at a health screening. 

Operations. ISWM may use and disclose Health Information for operational purposes. ISWM compiles an electronic health record on each person served. Health records and the information contained therein are/is used to provide information to the individual, including trending of results over time (e.g. year to year). These records may also be used to conduct other tasks related to the operation of our business. For example, aggregate reports may be provided to event sponsors. These reports do not have individual identifying data in them. (Example: a report may provide the total number of people who came to a screening on a given day, the % of people who had elevated blood pressures, etc.) This data may assist event sponsors in developing programs that provide value and may assist in reducing health risks. 

To Business Associates.  ISWM may contract with third parties, known as “Business Associates,” to perform various functions or provide various services on behalf of the plan.  To perform these functions or to provide these services, Business Associates may receive, create, maintain, transmit, use, and disclose protected health information, but only after they agree in writing to safeguard PHI and respect your HIPAA rights (the “Business Associate Agreement”).  

To you. In accordance with HIPAA and applicable Business Associate Agreements, ISWM will provide access to you of your health information. 

B. Uses/Disclosures That Give You an Opportunity to Object and/or Opt Out

Individuals Involved in Your Care or Payment for Your Care. ISWM may disclose health information to others in an effort to notify or assist in notifying a family member, your personal representative or another person responsible for your care about your location and/or your general condition. If you are able and available to agree or object, we will give you the opportunity to object prior to making this notification. If you are unable or unavailable to agree or object, our health professionals will use their best judgment in communication with your family and others. 

Disaster Relief. We may disclose your PHI to disaster relief organizations that seek your PHI to coordinate your care or notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever we practically can do so. 

C. Uses and Disclosures Required by Law

As Required By Law. ISWM may use and disclose your health information as required by Federal and State law. ISWM may disclose your health information to public health authorities for purposes related to the following: preventing or controlling disease, injury or disability; reporting child abuse or neglect; reporting domestic violence; reporting to the Food and Drug Administration problems with products and reactions to medications; and reporting disease or infection exposure. Disclosures, however, will be made only to someone who may be able to help prevent the threat. 

Authorizations.   Other uses or disclosures of PHI not described above will be made only with your written authorization. For example, the ISWM generally needs your authorization to disclose psychiatric notes about you; to use or disclose PHI for marketing; or to sell PHI. You may revoke your authorizations at any time, so long as the revocation is in writing. However, the revocation will not be effective for any uses or disclosures made in reliance upon the authorization. 

Health Oversight Activities. ISWM may disclose health information to regulatory health agencies (e.g. Montana Health Care Licensing Division, Montana Department of Public Health and Human Services Compliance Division) during the course of audits, investigations, inspections, licensure and other proceedings. 

Judicial and Administrative Proceedings. ISWM may disclose your health information in the course of any administrative or judicial proceeding. 

Law Enforcement. ISWM may disclose your health information to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness or missing person, complying with a court order or subpoena and other law enforcement purposes. 

Deceased Person Information. ISWM may disclose your health information to coroners, medical examiners and funeral directors. 

Organ Donation. ISWM may disclose your health information to organizations involved in procuring, banking or transplanting organs and tissues. 

Research. ISWM may disclose your health information to researchers conducting research that has been approved by the Institutional Review Board or by an ISWM committee. 

Public Safety. ISWM may disclose your health information to appropriate persons in order to prevent or lessen a serious and imminent threat to the health or safety of a particular person or the general public. 

Specialized Government Functions. ISWM may disclose your health information for military, national security and prisoner purposes. 

Workers’ Compensation. ISWM may disclose your health information as necessary to comply with workers’ compensation laws. 

Contact Before/After Services. ISWM may contact you to provide reminders of events for which you are scheduled, remain updated on your condition, or to provide information about other treatments or health-related benefits and services that may be of interest to you. 

Electronic Health Records. Event sponsors (hospitals or clinics) or laboratories may utilize an electronic health record (EHR). Health results collected at the health event may be made available through those entities.   

Change of Ownership. In the event that ISWM is sold or merged with another organization, your health information/record will become the property of the new owner. 

D. Other Uses and Disclosures of Protected Health Information Require Your Authorization

The following uses and disclosures of your Protected Health Information will be made only with your written authorization: 

1. Uses and disclosures of Protected Health Information for marketing purposes; 
2. Disclosures that constitute a sale of your Protected Health Information; 
3. Uses & disclosures as indicated on a consent form signed at any ISWM health screening, thru the online registration process, or in association with any other ISWM or ISWM affiliated services. 

Except as described above, in Section I of this Notice of Privacy Practices, ISWM will not use or disclose your health information without your written authorization. If you do authorize ISWM to use or disclose your health information for another purpose, you may revoke your authorization in writing at any time. 

III. Your Health Information Rights

Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of your health information. ISWM is not required to agree to the restriction that you request, and if not in agreement, ISWM will notify you. Some restrictions on the ability to share information may result in ISWM’s termination of services or ISWM declining to provide services. 

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. To request confidential communications, you must make your request, in writing, to our HIPAA Privacy Official at the address below. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests. 

Right to Inspect and Copy. You have the right to inspect and copy your health information. 

Right to Amend. You have a right to request that ISWM amend your health information that is incorrect or incomplete. ISWM is not required to change your health information and will provide you with a denial if deemed appropriate, as well as instructions regarding how you can formally disagree with the denial. All requests and denials will become part of your medical record. 

Right to an Accounting of Disclosures. You have a right to receive an accounting of disclosures of your health information made by ISWM, except that ISWM does not have to account for the disclosures described in parts 1 (treatment), 2 (payment), 3 (health care operations), 4 (information provided to you), and 16 (certain government functions) of Section 1 of this Notice of Privacy Practices. 

Right to a Paper Copy of This Notice. You have a right to receive a paper copy of this notice at any time, even if you have previously agreed to receive this notice electronically. To obtain a paper copy of this notice, please contact the HIPAA Privacy Official. 

Right to Get Notice of a Breach. You have the right to be notified upon a breach of any of your unsecured Protected Health Information. 

Out-of-Pocket-Payments. If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your Protected Health Information with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request. 

If you want further information about matters covered in this notice, or believe that your privacy rights have been violated, or disagree with a decision made about access to your personal and health information, you may file a complaint with our office or with the Secretary of the Department of Health and Human Services. To file a complaint with our office, contact the HIPAA Privacy Official at the address or phone below. All complaints must be made in writing. You will not be retaliated against for filing a complaint. 

HIPAA Privacy Official
It Starts With Me Health
29 Fort Missoula Road Missoula, MT 59804
(406) 541-2036