To provide services to many of our clients, Enlightenment Insurance Agency, Inc., must have access to Protected Health Information (“PHI”) as defined in the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Standards”) issued under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). In accordance with the Privacy Standards, Enlightenment Insurance Agency, Inc., takes all steps necessary to ensure the privacy and confidentiality of our client’s PHI as summarized below.
We use and disclose PHI (a) as necessary for the performance of our insurance broker duties provided that such use and disclosure does not violate the Privacy Standards; and (b) for the proper management and administration of our business or to carry out our legal responsibilities, provided that (i) any such disclosure is required by law, or (ii) Enlightenment Insurance Agency, Inc. obtains reasonable assurances from the person or entity to whom such information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person or entity, and the person or entity notifies Enlightenment Insurance Agency, Inc. of any instances of which it is aware in which the confidentiality of such information has been breached.
Additionally, we take steps necessary to appropriately safeguard PHI to prevent its use or disclosure other than as permitted by our applicable client contract or by the Privacy Standards. We report to the appropriate Covered Entity/client any use or disclosure of PHI not provided for by our applicable client contract of which we become aware. We also ensure that any agents, including a subcontractor, to whom we provide PHI received from, or created or received by us on behalf of, a Covered Entity/client, agree to the same restrictions and conditions that apply to us with respect to such information.
We make available PHI: a) to individuals for inspection and copying, in accordance with § 164.524 of the Privacy Standards; b) for amendment and incorporate any amendments to PHI, in accordance with § 164.526 of the Privacy Standards. We also make available the information required to provide an accounting of disclosures, in accordance with § 164.528 of the Privacy Standards.
We make our internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by us on behalf of, a Covered Entity/client, available to the Secretary of Health and Human Services for purposes of determining a Covered Entity’s/client’s compliance with Subpart E of the Privacy Standards.
At termination of a client contract, if feasible, we return or destroy all PHI received from, or created or received by us on behalf of, a Covered Entity/client, that we still maintain in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of our privacy practices to such information and limit further uses and disclosures to those purposes that make the return or destruction of such information infeasible.
