UNIVERSITY OF OKLAHOMA
HEALTH PLANS
HIPAA Privacy Policies
Subject: Definitions
Policy #: Privacy-01
Page: 1 of 9
Effective Date: September 15, 2014
Revised:
I. DEFINITIONS
0B
A.
Unless otherwise provided, the definitions below apply to all of the University’s Health
Plans’ Privacy and Security Policies. These terms are capitalized when used in the Policies to
indicate that they have been uniquely defined by the Plan or federal law.
1.
Affiliated Covered Entity. Legally separate Covered Entities under common
ownership or control, such as the University’s self-funded Employee Health Plans,
may designate themselves as an Affiliated Covered Entity to provide for sharing of
PHI.
2.
Authorization. The formal grant of authority by a Member to a Covered Entity or
Health Plan to Use or Disclose the Member’s Protected Health Information.
3.
Business Associate. A person or entity that is not Plan Personnel and that creates,
receives, maintains, or transmits Protected Health Information for a covered function or activity,
for or on behalf of the Plan. Such activities may include, but are not limited to, billing; repricing;
claims processing and administration; data analysis; legal, accounting, and actuarial services;
certain Member safety activities; consulting; utilization review; quality assurance; and similar
services or functions. A Business Associate may be a Covered Entity but does not include a Plan
Sponsor with respect to disclosures by the Plan to the Plan Sponsor consistent with 45 C.F.R.
164.504(f) & 45 C.F.R. § 160.103.
4. Correctional Institution . Any penal or correctional facility, jail, reformatory, detention
center, work farm, halfway house, or residential community program center operated by, or
under contract to, the United States, a State, a territory, a political subdivision of a State or
territory, or an Indian tribe for the confinement or rehabilitation of persons charged with or
convicted of a criminal offense or other persons held in lawful custody. Other persons held in
lawful custody include juvenile offenders, adjudicated delinquent aliens detained awaiting
deportation, persons committed to mental institutions through the criminal justice system,
witnesses, or others awaiting charges or trial. 45 C.F.R. § 164.501.
U
U
5. Covered Entity . The entities to which the Privacy Regulations apply, including the
Plan because it transmits Health Information in electronic form in connection with one of the
following eleven transactions: (i) Health Care claims or equivalent encounter information; (ii)
Health Care payment and remittance advice; (iii) coordination of benefits; (iv) Health Care
U
U
Page 1
claims status; (v) enrollment and disenrollment in a Health Plan; (vi) eligibility for a Health Plan;
(vii) Health Plan premium payments; (viii) referral certification and authorization; (ix) first
report of injury; (x) health claims attachments; and (xi) other transactions that the Secretary of
DHHS may prescribe by regulation. 45 C.F.R. § 160.103.
6. Covered Functions . Those functions of a Covered Entity, the performance of which
makes the entity a Health Plan. 45 C.F.R. § 160.103.
U
U
7. Designated Record Set . A group of records maintained by or for a Health Plan that is:
(i) The medical records and billing records about individuals maintained by or for a covered
health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical
management record systems maintained by or for a Health Plan; or (iii) Used, in whole or in part,
by or for the covered entity to make decisions about individuals.
U
The term record means any item, collection, or grouping of information that includes
Protected Health Information and is maintained, collected, Used, or disseminated by or for a
Health Plan.
A Designated Record Set does not include: (a) duplicate information maintained in other
systems; (b) data collected and maintained for peer review or risk management purposes; (c)
Psychotherapy Notes; (d) information compiled in reasonable anticipation of litigation or
administrative action; (e) employment records; (f) information subject to 42 USC 263a (CLIA)
or exempt under 42 CFR 493.3(a)(2) (CLIA); and (g) source data interpreted or summarized in
the individual's medical record (example: pathology slide and diagnostic films); (h) records
created by students or faculty as part of the teaching function that are used to evaluate students
but not for patient decision-making; (i) research records used to document results of research but
not for patient decision-making; (j) other compiled records and analyses not used for patient
decision-making; or (k) accreditation records.
The definition of a Designated Record Set refers only to the official record for the
Member and not to duplicate information maintained in other systems.
8. Disclose or Disclosure . The release, transfer, provision of access to, or divulging in
any other manner of information outside the Health Plan. 45 C.F.R. § 160.103.
U
U
Exchange of Protected Health Information with a department of the University that
is not designated as a Health Plan is considered a Disclosure, subject to HIPAA.
U
U
U
U
9. Direct Treatment Relationship. A treatment relationship between an individual and a
Health Care Provider that is not an Indirect Treatment Relationship. 45 C.F.R. § 164.501.
U
10. Genetic Information. Genetic information means: (1) Subject to paragraphs (2) and
(3) of this definition, with respect to an individual, information about: (i) The individual's genetic
tests; (ii) The genetic tests of family Members of the individual; (iii) The manifestation of a
disease or disorder in family Members of such individual; or (iv) Any request for, or receipt of,
genetic services, or participation in clinical research that includes genetic services, by the
individual or any family Member of the individual (2) Any reference to genetic information
concerning an individual or family Member of an individual shall include the genetic
information of: (i) A fetus carried by the individual or family Member who is a pregnant woman;
Page 2
and (ii) Any embryo legally held by an individual or family Member utilizing an assisted
reproductive technology (3) Genetic information excludes information about the sex or age of
any individual.
11. Genetics Services. Genetic Services means: (1) A genetic test; (2) Genetic counseling
(including obtaining, interpreting, or assessing genetic information); or (3) Genetic education.
12. Genetic Tests. Genetic Tests means an analysis of human DNA, RNA,
chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or
chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is
directly related to a manifested disease, disorder, or pathological condition.
13. Group Health Plan. Group Health Plan (also see definition of Health Plan below )
means an employee welfare benefit Plan (as defined in section 3(1) of the Employee Retirement
Income and Security Act of 1974 (ERISA), 29 U.S.C. 1002(1)), including insured and selfinsured Plans, to the extent that the Plan provides medical care (as defined in section 2791(a)(2)
of the Public Health Service Act (PHS Act), 42 U.S.C. 300gg-91(a)(2)), including items and
services paid for as medical care, to employees or their dependents directly or through insurance,
reimbursement, or otherwise, that: (1) Has 50 or more participants (as defined in section 3(7) of
ERISA, 29 U.S.C. 1002(7)); or (2) Is administered by an entity other than the employer that
established and maintains the Plan.
14. Health Care . Care, services, or supplies related to the health of an individual. Health
Care includes, but is not limited to, the following: (a) preventive, diagnostic, therapeutic,
rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure
with respect to the physical or mental condition or functional status of an individual or that
affects the structure or function of the body; and (b) sale or dispensing of a drug, device,
equipment, or other item in accordance with a prescription. 45 C.F.R. § 160.103.
HHH
U
15. Health Care Component(s) . A component or combination of components designated
by the Plan, a Hybrid Entity. The “Health Care Components” of the University of Oklahoma
include part or all of the: (a) Information Technology; (b) Internal Auditing; (c) Office of Legal
Counsel; (d) HSC Financial Services; (e) NC Financial Support Services; (f) Office of
Compliance; (g) University Printing Services; and (h) Waste Management – Norman Camus.
U
U
“Health Care Component” as used in the University’s Privacy Policies, will include
all of the constituent parts of a Health Care Component that perform covered
functions and University Personnel providing Health Care services on behalf of the
Health Care Component, unless circumstances clearly indicate otherwise.
The Health Plans are not Health Care Components of the University.
16. Health Care Operations. “Health Care Operations” means any of the following
activities of the Plan to the extent that the activities are related to Covered Functions:
U
(a) Conducting quality assessment and improvement activities, including
outcomes evaluation and development of clinical guidelines, provided that the obtaining
of generalizable knowledge is not the primary purpose of any studies resulting from such
activities; population-based activities relating to improving health or reducing Health
Page 3
Care costs; protocol development; case management and care coordination contacting of
Plan Personnel and Members with information about treatment alternatives; and related
functions that do not include treatment;
(b) Reviewing the competence or qualifications of Health Care professionals;
evaluating practitioner and provider performance and Health Plan performance;
conducting training programs in which students, trainees, or practitioners in areas of
Health Care learn under supervision to practice or improve their skills as Plan Personnel;
training of non-Health Care professionals; accreditation, certification, licensing, or
credentialing activities;
(c) Conducting or arranging for medical review, legal services, and auditing
functions, including fraud and abuse detection and compliance programs;
(d) Business Planning and development, such as conducting cost-management
and Planning-related analyses related to managing and operating the Plan, including
formulary development and administration, development, or improvement of methods of
payment or coverage policies; and
(e) Business management and general administrative activities of the Plan,
including, but not limited to: (1) management activities relating to implementation of and
compliance with the Plan’s Privacy Policies; (2) resolution of internal grievances; (3) due
diligence related to the sale, transfer, merger, or consolidation of all or part of a Health
Care Component with another Covered Entity; and (4) creating de-identified Health
Information or a limited data set and fundraising for the benefit of a Health Care
Component(s). 45 C.F.R. § 164.501.
17. Health Care Provider . A provider of services (as defined in § 1861(u) of the Social
Security Act, 42 U.S.C. § 1395x(u)), a provider of medical or health services (as defined in §
1861(s) of the Act, 42 U.S.C. § 1395x(s)), and any other person or organization who furnishes,
bills, or is paid for Health Care in the normal course of business. 45 C.F.R. § 160.103.
U
U
18. Health Information . Any information, whether oral or recorded in any form or
medium, that: (a) is created or received by a Health Care Provider, Health Plan, Public Health
Authority, employer, life insurer, school or university, or health care clearinghouse, and (b)
relates to the past, present, or future physical or mental health or condition of an individual; the
provision of Health Care to an individual; or the past, present, or future payment for the
provision of Health Care to an individual. 45 C.F.R. § 160.103.
U
U
19. Health Insurance Insurer. An insurance company, insurance service, or insurance
organization (including an HMO) that is licensed to engage in the business of insurance in a state
and is subject to state law that regulates insurance. Such term does not include a Group Health
Plan.
20. Health Maintenance Organization (HMO). A federally qualified HMO, an
organization recognized as an HMO under state law, or a similar organization regulated for
solvency under state law in the same manner and to the same extent as such an HMO.
21. Health Oversight Agency . An agency or authority of the United States, a State, a
U
U
Page 4
territory, a political subdivision of a State or territory, an Indian tribe, or a person or entity acting
under a grant of authority from or contract with such public agency, including the employees or
agents of such public agency or its contractors or persons or entities to whom it has granted
authority, that is authorized by law to oversee the Health Care system (whether public or
private) or government programs in which Health Information is necessary to determine
eligibility or compliance, or to enforce civil rights laws for which Health Information is relevant.
45 C.F.R. § 164.501.
22. Health Plan. Health Plan means an individual or group Plan that provides, or pays the
cost of, medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-1(a)(2))
and Health Plan includes the following, singly or in combination: (i) A group Health Plan, as
defined above. (ii) A Health Insurance Issuer, as defined above. (iii) An HMO, as defined above.
(iv) Part A or Part B of the Medicare program under Title XVIII of the Act. (v) The Medicaid
program under title XIX of the Act, 42 U.S.C. 1396, et seq. (vi) The Voluntary Prescription Drug
Benefit Program under Part D of title XVIII of the Act, 42 U.S.C. 1395w-101 through 1395w152. (vii) An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the
Act, 42 U.S.C. 1395ss(g)(1)). (viii) An issuer of a long-term care policy, excluding a nursing
home fixed indemnity policy. (ix) An employee welfare benefit Plan or any other arrangement
that is established or maintained for the purpose of offering or providing health benefits to the
employees of two or more employers. (x) The Health Care program for uniformed services under
Title 10 of the United States Code. (xi) The veterans’ Health Care program under 38 U.S.C.
chapter 17. (xii) The Indian Health Service program under the Indian Health Care Improvement
Act, 25 U.S.C. 1601, et seq. (xiii) The Federal Employees Health Benefits Program under 5
U.S.C. 8902, et seq. (xiv) An approved State Child Health Plan under Title XXI of the Act,
providing benefits for child health assistance that meet the requirements of section 2103 of the
Act, 42 U.S.C. 1397, et seq. (xv) The Medicare Advantage program under Part C of title XVIII
of the Act, 42 U.S.C. 1395w-21 through 1395w-28. (xvi) A high risk pool that is a mechanism
established under State law to provide health insurance coverage or comparable coverage to
eligible individuals. (xvii) Any other individual or group Plan, or combination of individual or
group Plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2)
of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).
Health Plan excludes: (i) Any policy, Plan, or program to the extent that it provides, or
pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42
U.S.C. 300gg-91(c)(1); and (ii) A government-funded program (other than one listed in
paragraph (1)(i)-(xvi) of this definition): (A) Whose principal purpose is other than providing, or
paying the cost of, Health Care; or (B) Whose principal activity is: (1) The direct provision Care
to persons. Implementation specification means specific requirements or instructions for
implementing a standard.
23. HIPAA . The Health Insurance Portability and Accountability Act of 1996.
U
U
24. HITECH. The Health Information Technology for Economic and Clinical Health Act,
passed on February 17, 2009.
25. Hybrid Entity . A single legal entity: (1) that is a Covered Entity; (2) whose business
activities include both Covered and non-Covered functions; and (3) that designates Health Care
Components. 45 C.F.R. § 164.504. (The University is a Hybrid Entity.)
U
U
Page 5
26. Indirect Treatment Relationship . A relationship between an individual and a Health
Care Provider in which: (a) the Health Care Provider delivers Health Care to the individual
based on the orders of another Health Care Provider; and (b) the Health Care Provider typically
provides services or products or reports the diagnosis or results associated with the Health Care
directly to another Health Care Provider, who provides the services or products or reports to the
individual. 45 C.F.R. § 164.501.
U
27. Individually Identifiable Health Information . Information that is a subset of Health
Information, including demographic information collected from an individual, and that (a) is
created or received by a Health Care Provider, Health Plan, employer, or health care
clearinghouse; and (b) relates to the past, present, or future physical or mental health or condition
of an individual; the provision of Health Care to an individual; or the past, present, or future
payment for the provision of Health Care to an individual; and (i) that identifies the individual;
or (ii) with respect to which there is a reasonable basis to believe the information can be used to
identify the individual. 45 C.F.R. § 160.103
U
U
28. Inmate . A person incarcerated in or otherwise confined to a Correctional Institution.
45 C.F.R. § 164.501.
U
U
29. Law Enforcement Official . An officer or employee of any agency or authority of the
United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe
who is empowered by law to: (i) investigate or conduct an official inquiry into a potential
violation of law; or (ii) prosecute or otherwise conduct a criminal, civil, or administrative
proceeding arising from an alleged violation of law. 45 C.F.R. § 164.103.
U
U
30. Legal Counsel . The University’s Office of Legal Counsel and the individual
attorneys who work in or for the office.
U
U
31. Marketing . To make a communication about a product or service that encourages
recipients of the communication to purchase or use the product or services unless the
communication is made: (a) to describe a health-related product or service (or payment for such
product or service) that is provided by the Plan, including communications about the entities
participating in a Health Care Provider network or Health Plan network and health-related
products or services available only to a Health Plan enrollee that add value to, but are not part of,
a Plan of benefits; (b) for Treatment of the individual; or (c) for case management or care
coordination for the individual, or to direct or recommend alternative treatments, therapies,
Health Care Providers, or settings of care to the individual.
U
U
32. Member. An eligible, enrolled participant in a University Health Plan.
33. Particularly Sensitive Health Information . Protected Health Information that is
generally considered highly confidential including, but not limited to, mental health, drug and
alcohol abuse, and communicable disease information.
U
U
34. Payment . Any activities by the Plan to obtain premiums or determine of fulfil its
responsibility for coverage and provision of benefits under the Plan; or to obtain or provide
reimbursement for the provisions of Health Care. Such activities relate to the individual to
whom Health Care is provided and include, but are not limited to: (a) determinations of
eligibility or coverage (including coordination of benefits or the determination of cost-sharing
U
U
Page 6
amounts) and adjudication or subrogation of health benefit claims; (b) risk adjusting amounts
due based on enrollee health status and demographic characteristics; (c) billing, claims
management, collection activities, obtaining payment under a contract for reinsurance (including
stop loss insurances and excess of loss insurances) and related Health Care data processing or
contract and related Health Care data processing; (d) review of Health Care services with
respect to medical necessity, coverage under a health Plan., appropriateness of care, or
justification of charges; (e) utilization review activities, including pre-certifications and preauthorization of services and concurrent and retrospective review of services; and (f) Disclosure
to consumer reporting agencies of any of the following Protected Health Information relating to
collection of premiums or reimbursement: (i) name and address; (ii) date of birth; (iii) Social
Security number; (iv) payment history; (v) account number; and (vi) name and address of the
Health Care Provider. 45 C.F.R. §164.501.
35. Personal Representative. See Privacy Policy-02, “Personal Representatives.”
36. Protected Health Information or PHI . Individually Identifiable Health Information
that is transmitted by, or maintained in, electronic media or any other form or medium.
U
U
Protected Health Information excludes Individually Identifiable Health
Information in: (a) education records covered by the Family Educational
Rights and Privacy Act (FERPA); and (b) employment records held by the
University of Oklahoma and the Plan in their role as employer.
U
U
*
NOTE: While the University and its Health Care Components and Plans treat all health
information created or maintained in its clinical operations the same, regardless of whether it is
exempt from HIPAA because the records are student records subject to FERPA. Student records
are not subject to HIPAA and the University and its Plans will not be legally responsible for
complying with HIPAA with respect to such records.
37. Plan Sponsor. The University is the Plan sponsor for the University Health Plans
when acting in its role of implementing, adopting, amending, or terminating a Group Health
Plan.
38. Privacy Policies or Policies . This set of policies drafted and adopted by the Plan for
the use relating to the protection and confidentiality of Protected Health Information.
U
U
39. Privacy Regulations . The regulations issued by the Department of Health and
Human Services implementing the privacy requirements of the Health Insurance Portability Act
of 1996 (HIPAA), 42 CFR Parts 160 and 164, aimed at protecting a Member’s right to privacy in
matters involving his or her Health Care, as amended.
U
U
40. Psychotherapy Notes . Notes recorded in any medium by a Health Care Provider who
is a mental health professional documenting or analyzing the contents of conversation during a
private counseling session or a group, joint, or family counseling session and that are separated
from the rest of the individual’s medical record.
U
U
Psychotherapy Notes exclude medication prescription and monitoring,
counseling sessions start and stop times, the modalities and frequencies of
Page 7
treatment furnished, results of clinical tests, and any summary of the following
items: diagnosis, functional status, the treatment Plan, symptoms, prognosis,
and progress to date. 45 C.F.R § 164.501.
41. Public Health Authority . An agency or authority of the United States, a State, a
territory, a political subdivision of a State or territory, an Indian tribe, or a person or entity acting
under a grant of authority from or contract with such public agency, including the employees or
agents of such public agency or its contractors or persons or entities to whom it has granted
authority, that is responsible for public health matters as part of its official mandate. 45 C.F.R. §
164.501.
U
U
42. Required by Law . A mandate contained in law that compels a Plan to make a Use or
Disclosure of Protected Health Information and that is enforceable in a court of law. Required
by Law includes, but is not limited to, court orders and court-ordered warrants; a subpoena or
summons issued by a court, grand jury, governmental or tribal inspector general, or
administrative body authorized to require the production of information; a civil or an authorized
investigative demand; Medicare conditions of participation with respect to Health Care
Providers participating in the program; and statutes or regulations that require the production of
information, including those that require such information if payment is sought under a
government program providing public benefits. 45 C.F.R. § 164.501.
U
U
43. Research . A systematic investigation, including research development, testing, and
evaluation, designed to develop or contribute to generalizable knowledge. 45 C.F.R § 164.501.
U
U
44. Transaction. Transaction means the transmission of information between two parties
to carry out financial or administrative activities related to health care. It includes the following
types of information transmissions: (1) Health Care claims or equivalent encounter information.
(2) Health Care payment and remittance advice. (3) Coordination of benefits. (4) Health Care
claim status. (5) Enrollment and disenrollment in a Health Plan. (6) Eligibility for a Health Plan.
(7) Health Plan premium payments. (8) Referral certification and authorization. (9) First report
of injury. (10) Health claims attachments. (11) Health Care electronic funds transfers (EFT) and
remittance advice. (12) Other transactions that the Secretary may prescribe by regulation.
45. Treatment . The provision, coordination, or management of Health Care and related
services by Plan Personnel. 45 C.F.R. § 164.501.
U
U
Treatment includes: (a) the coordination or management of Health Care
by a Health Care Provider with a third party; (b) consultation between
Health Care Providers relating to a Member; or (c) the referral of a
Member for Health Care from one Health Care Provider to another. 45
C.F.R. § 164.501.
46. University . The University of Oklahoma, including its officers, employees, and
agents when the context clearly intends such.
U
U
47. P lan Personnel . Faculty, staff, volunteers, students and other trainees, and other
persons whose conduct, in the performance of work for the Plan, is under the direct control of the
Plan or University, whether or not they are paid by the Plan (“Workforce”). 45 C.F.R. §
160.103.
P
U
Page 8
48. Use . With respect to Individually Identifiable Health Information, the sharing,
employment, application, utilization, examination, or analysis of such information within
the Plan. 45 C.F.R. § 164.501.
U
U
49. Workforce Member. See Plan Personnel.
II. REFERENCES
A. 45 C.F.R. 160.103
B. 45 C.F.R. 164.501
Page 9