THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
1. Who This Notice Applies To
This Notice of Privacy Practices ("Notice") describes the privacy practices of Atlas Managed Care ("Atlas," "we," "us," or "our"), a California workers' compensation managed care company, with respect to Protected Health Information ("PHI") we create, receive, maintain, or transmit about you in connection with your workers' compensation claim.
This Notice is provided in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations at 45 CFR Parts 160 and 164, the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the California Confidentiality of Medical Information Act ("CMIA"). To the extent California law provides greater privacy protection than HIPAA, California law controls.
2. Our Legal Duties
Atlas is required by law to:
- Maintain the privacy and security of your PHI.
- Provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
- Notify you following a breach of unsecured PHI that affects you, as required by 45 CFR §§ 164.400–164.414.
- Abide by the terms of this Notice currently in effect.
- Comply with all applicable provisions of HIPAA, HITECH, the CMIA, and California Labor Code § 4610 and 8 CCR §§ 9792.6 – 9792.9.5.
3. How We May Use and Disclose Your PHI Without Your Authorization
HIPAA permits Atlas to use and disclose your PHI without your written authorization for the following purposes:
3.1 Treatment
We may use and disclose your PHI to coordinate, manage, or provide health care services. For example, we may share information with your treating physician, nurse case manager, or specialist provider so that everyone involved in your care has the information they need.
3.2 Payment
We may use and disclose your PHI to obtain payment for services provided to you, to determine eligibility, to coordinate benefits, to perform utilization review, or to bill your employer's workers' compensation insurer or claims administrator.
3.3 Health Care Operations
We may use and disclose your PHI for our internal operations, including quality assessment and improvement activities, peer review, credentialing of clinical reviewers, training, accreditation activities (including URAC accreditation), audits, and legal services.
3.4 Workers' Compensation
We may disclose your PHI as authorized by, and to the extent necessary to comply with, the California workers' compensation system, including California Labor Code Division 4, 8 CCR §§ 9792.6 – 9792.9.5 (utilization review), and the rules of the Workers' Compensation Appeals Board ("WCAB"). 45 CFR § 164.512(l) expressly authorizes such disclosures.
3.5 Required by Law
We will disclose your PHI when required to do so by federal, state, or local law, including in response to a court order, subpoena, warrant, summons, or similar lawful process.
3.6 Public Health Activities
We may disclose your PHI to public health authorities for public health activities, including to report a workplace injury or illness to the Occupational Safety and Health Administration ("OSHA") or to track product safety issues.
3.7 Health Oversight Activities
We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensure, and other regulatory or accreditation activities (including the California Department of Industrial Relations, the Division of Workers' Compensation, URAC, and the U.S. Department of Health and Human Services).
3.8 Judicial and Administrative Proceedings
We may disclose your PHI in the course of any judicial or administrative proceeding in response to a court order, an administrative tribunal order, a subpoena, or a discovery request, where the requesting party has made reasonable efforts to ensure that you have been notified or that a protective order has been issued.
3.9 Law Enforcement
We may disclose your PHI to law enforcement officials for specific law enforcement purposes (for example, to identify a suspect, to report a crime, or in response to a court order or grand jury subpoena).
3.10 Coroners, Medical Examiners, and Funeral Directors
We may disclose PHI to a coroner or medical examiner to identify a deceased person or determine cause of death, or to a funeral director as necessary to carry out their duties.
3.11 Serious Threat to Health or Safety
We may use and disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
3.12 Business Associates
We share PHI with vendors that perform services on our behalf (for example, cloud infrastructure, communications, voice/SMS, and analytics providers). Each business associate signs a written Business Associate Agreement (BAA) under HIPAA. Our current business associates include Amazon Web Services (AWS), Twilio, Bland AI, and Cloudflare.
3.13 Research, Marketing, and Sale of PHI
We do not use or disclose PHI for research, marketing, or fundraising. We do not sell PHI under any circumstances. Any future use of PHI for these purposes would require your prior written authorization.
4. Uses and Disclosures That Require Your Written Authorization
Except as described in Section 3 above, we will not use or disclose your PHI without your written authorization. This includes, but is not limited to:
- Most uses and disclosures of psychotherapy notes.
- Uses and disclosures for marketing purposes.
- Disclosures that constitute a sale of PHI.
- Other uses and disclosures not described in this Notice.
If you provide us with an authorization, you may revoke it in writing at any time, except to the extent that we have already taken action in reliance on it.
5. Your Rights With Respect to Your PHI
You have the following rights regarding your PHI:
5.1 Right to Access and Copy
You have the right to inspect and obtain a copy of your PHI maintained in our designated record set, in the form and format you request if readily producible (including electronic copies). We will respond within thirty (30) days, with one thirty-day extension permitted upon written notice to you. We may charge a reasonable, cost-based fee as permitted by 45 CFR § 164.524.
5.2 Right to Amend
You have the right to request that we amend PHI we maintain about you that you believe is inaccurate or incomplete. We may deny your request under certain circumstances, in which case we will provide a written denial and explain your rights, including your right to submit a statement of disagreement.
5.3 Right to an Accounting of Disclosures
You have the right to receive an accounting of disclosures of your PHI made by Atlas in the six (6) years prior to your request, other than disclosures for treatment, payment, health care operations, or pursuant to your authorization. We will provide one accounting per twelve-month period free of charge.
5.4 Right to Request Restrictions
You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request except where the disclosure is to a health plan for payment or health care operations and the PHI pertains solely to a service you paid for out of pocket in full.
5.5 Right to Request Confidential Communications
You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations (for example, by mail to a P.O. box rather than your home, or only by phone and not by SMS). We will accommodate reasonable requests.
5.6 Right to Breach Notification
You have the right to be notified following a breach of your unsecured PHI, as required by 45 CFR §§ 164.400–164.414.
5.7 Right to a Paper Copy of This Notice
You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
5.8 Right to Opt Out of SMS
You have the right to opt out of SMS communications from Atlas at any time by replying STOP to any Atlas SMS message. See our SMS Communication & Consent Policy for details.
6. How to Exercise Your Rights
To exercise any of the rights described in Section 5, submit a written request to our Privacy Officer at the address in Section 9. We will respond within the time frames required by HIPAA and applicable California law.
7. How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with Atlas or directly with the U.S. Department of Health and Human Services Office for Civil Rights ("HHS OCR"). We will not retaliate against you for filing a complaint.
7.1 File a Complaint With Atlas
Contact our Privacy Officer at the address, phone, or email in Section 9, or file a complaint through our Complaints & Grievances process.
7.2 File a Complaint With HHS Office for Civil Rights
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-free: 1-800-368-1019 (TDD: 1-800-537-7697)
Online: www.hhs.gov/ocr/complaints/
8. Changes to This Notice
We reserve the right to change this Notice and the privacy practices described in it at any time. We reserve the right to make the revised Notice effective for PHI we already have about you, as well as for PHI we receive in the future. The revised Notice will be posted on this page with an updated "Effective Date." You may obtain a copy of the current Notice at any time by contacting us or by visiting atlasmanagedcare.com/hipaa.
9. Contact Our Privacy Officer
For questions about this Notice, to exercise any of your rights, or to file a complaint, contact:
Atlas Managed Care: Privacy Officer
3400 Cottage Way, Ste. G2 #34605
Sacramento, CA 95825
Phone: 1-877-828-5276 (Mon–Fri 8AM–5PM PT)
Email: privacy@atlasmanagedcare.com