PLANSOURCE HIPAA PRIVACY POLICY

PlanSource recognizes that the privacy of your personal information is important to you and follows strict policies to keep your protected health information (PHI) secure. This policy explains how PlanSource uses, discloses and protects your PHI in accordance with the Health Insurance Portability and Accountability Act as amended by the Health Information Technology for Economic and Clinical Health Act Title XIII of Division A of the American Recovery and Reinvestment Act, 2009 (“HITECH”) and regulations promulgated thereunder, as such law and regulations may be amended from time to time (collectively, “HIPAA”).

PHI is sensitive information that can be used to identify an individual and relates to a person’s past, present or future physical or mental health, the provision of health care or the payment for that care. This policy applies to all PHI including oral, written or electronic.

BUSINESS ASSOCIATE AGREEMENT

You, as a user of the PlanSource system, may, from time to time, perform an activity that brings you within the definition of a “Covered Entity” under HIPAA. Such activity may include disclosing to PlanSource certain individually identifiable information defined as PHI under HIPAA. PlanSource’s receipt and use of such information under its agreements with you may cause PlanSource to become a “Business Associate” as that term is defined by HIPAA. Pursuant to HIPAA, all Covered Entities and Business Associates must agree in writing (in the form of a Business Associate Agreement) to certain mandatory provisions regarding the uses, disclosures, and safeguards relating to PHI. To satisfy this requirement, we have posted the PlanSource Business Associate Agreement on our website. To download a copy of the Business Associate Agreement, please click here.

The Business Associate Agreement applies to you only to the extent that you are or become a Covered Entity under HIPAA and that PlanSource is or becomes your Business Associate. Execution of the Business Associate Agreement or any other agreement between you and PlanSource does not automatically qualify you or PlanSource as a Covered Entity or Business Associate. Unless otherwise agreed to in writing by the parties, this Business Associate Agreement supersedes and replaces any and all previous agreements between you and PlanSource with regard to the subject matter therein.

If you have any questions regarding the Business Associate Agreement, please contact your PlanSource representative.

Use and Disclosure of PHI

We may use PHI for our management, administration, data aggregation and legal obligations to the extent such use of PHI is permitted or required by the BA Agreement and not prohibited by law. We may use or disclose PHI on behalf of, or to provide services to, Covered Entities for purposes of fulfilling our service obligations to Covered Entities, if such use or disclosure of PHI is permitted or required by the BA Agreement and would not violate the Privacy Rule.

In the event that PHI must be disclosed to a subcontractor or agent, we will ensure that the subcontractor or agent agrees to abide by the same restrictions and conditions that apply to us under the BA Agreement with respect to PHI, including the implementation of reasonable and appropriate safeguards.

We may also use PHI to report violations of law to appropriate federal and state authorities.

Safeguards

We use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for in the BA Agreement. We have implemented administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that we create, receive, maintain, or transmit on behalf of a Covered Entity. Such safeguards include:

• Maintaining appropriate clearance procedures and providing supervision to assure that our workforce follows appropriate security procedures;
• Providing appropriate training to our staff to assure compliance with our security policies;
• Making use of appropriate encryption when transmitting PHI over the Internet;
• Utilizing appropriate storage, backup, disposal and reuse procedures to protect PHI;
• Utilizing appropriate authentication and access controls to safeguard PHI;
• Utilizing appropriate security incident procedures and providing training to our staff sufficient to detect and analyze security incidents; and
• Maintaining a current contingency plan and emergency access plan in case of an emergency to assure that the PHI we hold on behalf of a Covered Entity is available when needed.

Mitigation of Harm

In the event of a use or disclosure of PHI that is in violation of the requirements of the BA agreement, we will mitigate, to the extent practicable, any harmful effect resulting from the violation. Such mitigation will include:

• Reporting any use or disclosure of PHI not provided for by the BA Agreement and any security incident of which we become aware of the Covered Entity; and
• Documenting such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting of disclosure of PHI in accordance with HIPAA.

Access to PHI

As provided in the BA Agreement, we will make available to Covered Entities, information necessary for Covered Entity to give individuals their rights of access, amendment, and accounting in accordance with HIPAA regulations.

Upon request, we will make our internal practices, books, and records including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by the BA on behalf of a Covered Entity available to the Covered Entity or the Secretary of the U.S. Department of Health and Human Services for the purpose of determining compliance with the terms of the BA Agreement and HIPAA regulations.

Changes to this HIPAA Privacy Policy

We may change this HIPAA Privacy Policy. If we do so, such change will appear on this page of our website. We will also provide appropriate notice and choices to you, on this website and in other appropriate locations, based on the scope and extent of changes. You may always visit this policy to learn of any updates.

Acceptance of this HIPAA Privacy Policy

By accessing and using the PlanSource Website, you are indicating your acknowledgment and acceptance of this HIPAA Privacy Policy, including the terms of the Business Associate Agreement, if applicable.

Contact Us

If you have any questions regarding this HIPAA Privacy Policy, you may contact us at compliance@plansource.com.

Effective Date

The Effective Date of this HIPAA Privacy Policy is September 1, 2013. This Notice was revised on July 1, 2017, and reviewed on May 24, 2023