Privacy Policies

Christian Brothers Services (CBS) respects the privacy of our members, participants, clients, and customers, and we are committed to protecting the personal and institutional information entrusted to our care. We are honoring our commitment by disclosing the nature of information collected and how such information is used. This Privacy Policy applies to all Christian Brothers plans, programs, and services provided as well as www.cbservices.org.

Information Collected
CBS collects the minimum amount of information necessary in order to provide the services requested and respond to the needs of our members, participants, clients and customers.

Information Collection Methods
CBS collects information via paper-based and web-based forms tailored to the services requested.

Use of Information Collected
Information provided by our members, participants, clients and customers is used solely for its expressed purpose and the purposes stated below. CBS, as administrator for Christian Brothers plans and programs and provider of services, may use information collected in the course of administering any of the Christian Brothers plans and programs and provision of services, as necessary, to provide the highest level of services, plan/program information, and educational activities to our members, participants, clients and customers.

Sharing of Information Collected
CBS does not rent, sell or trade any information it collects to any 3rd party. CBS, as administrator for Christian Brothers plans and programs and provider of services, may share information collected with its affiliates to provide the highest level of services, plan, program and services information, and educational activities to our members, participants, clients and customers.

CBS contracts services from third parties during the course of administering Christian Brothers plans/programs and providing services to meet needs and requests. To the extent that these services require information to be shared, that information will be provided so that the vendor may carry out their contractual duties. All vendors are contractually required to use provided information only as specified within the parameters of their agreement(s) with CBS which also provides for protection (privacy, confidentiality, and security) of such information.

Email Usage
Please note that unsecure/unencrypted eMail is not considered a safe method of sending personal, individually identifiable, or confidential information to CBS. An unsecured, unencrypted email message may be susceptible to interception by any system it passes through to get to CBS. If you send these types of information to CBS via email, we will accept it. However, any email reply from us will not include these types of information except in a secure, encrypted email message. The preferred methods for you to send us personal, individually identifiable, or confidential information include CBS Secure Message Center, US Mail, fax, or secure website forms. You will know that you are using a secure website form because the URL will begin with “https://” and the lock icon will show as being locked indicating valid secure socket layer (SSL) encryption security is in effect.

Changes to Information
Should an individual or institution wish to review, correct, change or update information that has been collected, they may do so through online means provided or their customer service contact.

Security
CBS is committed to providing the necessary security to protect information entrusted to its care. CBS employs commercially reasonable, appropriate and prudent physical, administrative, and technical safeguards to protect information. However, no security is considered 100% impenetrable. Should a breach of non-public information occur, CBS will take action to remedy the breach and notify all affected individuals without unreasonable delay.

Consent
By providing any information to CBS, you fully understand and unambiguously consent to the collection, processing and usage of such information according to the intent it was collected.

Legal Compliance
It is CBS’ intent to comply with all applicable laws. CBS may disclose information when required by law. Examples include responding to a subpoena, conducting a fraud investigation, or reporting to a credit bureau. CBS may also share your information when requested and authorized by an individual or institution.

Notification of Changes
This Privacy Policy became effective 8/1/2005. We reserve the right, at our discretion, to change, modify, add, or remove portions of this policy at any time with or without providing prior notice with the most current Privacy Policy posted on our website.

Contact Us
You may contact our Chief Privacy Officer at cpo@cbservices.org with any comments or questions regarding our privacy policies or practices.

Summary of Notice of Privacy Practices for Christian Brothers Employee Benefit Trust

The Christian Brothers Employee Benefit Trust ("Trust") is sponsored by the Trustees elected by organizations that have adopted the Trust. The Trustees are required by law to provide you with a copy of the attached Notice ("Notice").

HIPAA Information:

• Managing Director Letter
• CBEBT HIPAA Privacy Policy Brochure
• Summary of Notifications of Privacy Practices
• Authorization Forms

THE NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY.

How the Trust Will Use Your Information
The Trust may use, share or disclose the personal health information the Trust creates, receives or maintains about you (“protected health information” or “PHI”) to pay medical benefits, operate the Trust or for treatment by a health care provider. In addition, the Trust may use or disclose your information in other special circumstances described in the Notice. For any other purpose, the Trust will require your written authorization for the use or disclosure of your protected health information.

Your Individual Rights
You have the right to inspect and copy certain of your protected health information, request an amendment of the information, request restrictions on the use and disclosure of the information, request that communications be made to you through alternate means or at an alternative location, and obtain an accounting of the information that the Trust has disclosed for reasons other than treatment, payment, health care operations, required or authorized disclosures. There are certain limitations on these rights as explained in the Notice.

Questions and Complaints
You may contact the following person for more information about the Trust’s privacy practices, to exercise your rights or to complain about how the Trust is handling your protected health information:

Chief Privacy Officer
Christian Brothers Services
1205 Windham Parkway
Romeoville, IL 60446-1690
cpo@cbservices.org
Toll free: 800-807-0100

The attached Notice describes the Trust’s privacy practices in more detail.

NOTICE OF PRIVACY PRACTICES FOR CHRISTIAN BROTHERS EMPLOYEE BENEFIT TRUST

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY.

• Why Am I Receiving This Notice?
  The Christian Brothers Employee Benefit Trust (“Trust”) is subject to the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). The Trust is sponsored by the Trustees elected by organizations that have adopted the Trust. The privacy of your personal health information that is created, used, or disclosed by the Trust is protected by HIPAA. The Trustees are required by law to:
  • maintain the privacy of your protected health information (“PHI”);
  • provide you with this Notice of the Trust’s legal duties and privacy practices with respect to your PHI; and
  • abide by the terms of this Notice.
  
  
  
• What is PHI?
  PHI, or protected health information, is the identifiable health information about you created, received or maintained by the Trust, regardless of the form or medium of the information. It does not include employment records held by your employer.
  
  
• How will the Trust Use my PHI?
  Under HIPAA, the Trust must disclose your PHI:
  • to you or your legal representative when you ask for information;
  • to the U.S. Department of Health and Human Services, if necessary, to make sure your privacy is protected; and
  • where otherwise required by law.
  
  The Trust, and the individuals who administer the Trust, may use, receive or disclose your PHI for treatment, payment or health care operations without obtaining a written authorization from you. These activities cover a broad range of activities, including
  • Treatment. The Trust may disclose protected health information to your providers for treatment, including the provision of care (diagnosis, cure, etc.) or the coordination or management of that care.
  • Payment. The Trust may use and disclose your protected health information to pay benefits. Payment activities may include receiving claims or bills from your health care providers, processing payments, sending explanations of benefits (EOBs) to Trust participants, reviewing the medical necessity of the services rendered, conducting claims appeals and coordinating the payment of benefits between multiple medical plans.
  • Health Care Operations. The Trust may use and disclose your protected health information for Trust operational purposes. For example, the Trust may use or disclose your protected health information for Trust administration activities such as enrollment, verification to your doctors or hospitals that you are eligible for benefits under the Trust, disease management programs and other Trust-related activities, including audits of claims.
  
  The Trust may also use and disclose your protected health information to provide information to you about disease management programs, treatment alternatives or other health related benefits and services that may be of interest to you without your prior authorization, unless such communications are considered to be “marketing” as described below. Communications of health information for the purpose of “marketing” generally requires your authorization. A communication about a product or service that encourages you to purchase or use the product or service is considered “marketing.” A “marketing” communication requires your authorization, unless the Trust receives no financial remuneration for the communication and the communication relates to (i) a health related product or service provided by the Trust to you, (ii) your treatment, or (iii) case management or coordination for your benefits under the Trust. In addition, “marketing” does not include refill reminders or other communications about a drug or biologic that is currently being prescribed to you, only if any financial remuneration received by the Trust in exchange for the communication is reasonably related to the Trust’s cost of making the communication (i.e., the Trust is not making a profit on the disclosure).
  
  The Trust may contract with other businesses for certain Trust administrative services. The Trust may release your health information to one or more of these “business associates” for Trust administration if the business associate agrees in writing to protect the privacy of your information.
  
  The Trustees of the Trust, as the sponsor of the Trust, as well as employees and agents of Christian Brothers Services, the organization selected by the Trustees to administer the Trust, will also have access to your protected health information for Trust administration purposes. Access to your protected health information by Trustees or employees of Christian Brothers Services will be limited to persons responsible for Trust administration. Notwithstanding the foregoing, the Trustees of the Trust, as well as employees and agents of Christian Brothers Services will not use or disclose genetic information for underwriting purposes.
  
  Unless you authorize the Trust otherwise in writing (or the individually identifying data is deleted from the information), your protected health information will be available only to individuals who need the information to conduct these Trust administration activities and the release of your PHI will be limited to the minimum disclosure required, unless otherwise permitted or required by law.
  
  
• Under What Circumstances Would My PHI be Released for Other than Trust Administration?
  The Trust is also permitted to use or disclose your protected health information, without obtaining a written authorization from you, in the following circumstances:
  • For certain required public health activities (such as reporting disease outbreaks);
  • To prevent serious harm to you or other potential victims, where abuse, neglect or domestic violence is involved;
  • For health oversight agency for oversight activities authorized by law;
  • In the course of any judicial or administrative proceeding in response to a court or administrative tribunal’s order, subpoena, discovery request or other lawful process;
  • For a law enforcement purpose to a law enforcement official if certain legal conditions are met (such as providing limited information to locate a missing person);
  • For research studies that meet all privacy law requirements (such as research related to the prevention of disease or disability);
  • To avert a serious threat to the health or safety of you or any other person; and
  • To the extent necessary to comply with laws and regulations related to workers’ compensation or similar programs.
  
  Any other use or disclosure of your protected health information not identified within this Notice will be made only with your written authorization.
  
  
• Does My State Privacy Law Also Apply to PHI?
  If your state laws provide more stringent privacy protections than HIPAA, the more stringent state law will still apply to protect your rights. If you have a question about your rights under any particular federal or state law, please contact the person identified below as the Privacy Contact.
  
  
• How Do I Authorize a Release of My PHI?
  You will need to complete a written authorization form. An authorization form is available from our website, www.cbservices.org, or by calling us at 800-807-0100. You have the right to limit the type of information that you authorize the Trust to disclose and the persons to whom it should be disclosed. You may revoke your written authorization at any time, and the revocation will be followed to the extent action on the authorization has not yet been taken.
  
  
• What Are My Individual Rights With Respect to My PHI?
  You have the right to:
  • Request the Trust to restrict its uses and disclosures of your PHI. The Trust is not required to agree to a requested restriction; except that we will comply with your request if the request involves a disclosure not otherwise required by law and pertains solely to a health care item or service for which someone other than the Trust has paid in full. If we do agree to a restriction, we must abide by it unless you agree in writing to remove it. To request a restriction, please write to the Privacy Contact (identified at the end of this Notice) and provide specific information as to the disclosures that you wish to restrict and the reasons for your request. The Privacy Contact will respond in writing.
  • Request that the Trust’s confidential communications of your PHI be sent to another location or by alternative communicative means. For example, you may
    ask that we send all explanation of benefits statements (EOBs) to your office rather than your home address. The Trust is not required to accommodate your request unless your request is reasonable and you state that the Trust’s ordinary communication process could endanger you.
  • To inspect and obtain a copy of the PHI held by the Trust. You may obtain a copy in an electronic format of health information we use or maintain in an electronic health record, if any, and direct us to transmit a copy of the electronic health record directly to a third party you designate. However, access to psychotherapy notes, information compiled in reasonable anticipation of, or for use in legal proceedings and under certain other, relatively unusual, circumstances may be denied. Your request should be made in writing. A reasonable fee may be imposed for copying and mailing the requested information.
  • Request that the Trust amend your protected health information or record if you believe the information is incorrect or incomplete.
  • Receive a list of those individuals or entities who have accessed your PHI for reasons other than for treatment, payment or Trust operations or that you have authorized in writing, for up to 6 years prior to your request. In addition, you have a limited right to receive an accounting of disclosures for treatment, payment or Trust operations, for up to 3 years prior to your request, to the extent the Trust
    maintains an electronic health record, if any.
  • Get a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
  • Receive notification from the Trust in the event there is a breach of unsecured protected health information.
  
  
  
• How Do I Make A Complaint If I Think My Rights Have Been Violated?
  You may file a complaint with the Trust’s Privacy Contact and with the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated by any Trust. Their addresses are available under contact information below. All complaints must be filed in writing. You will not be retaliated against for filing a complaint.
  
  
• Who Is the Trust’s Privacy Contact?
  If you have any questions about this Notice, please contact the Trust’s Privacy Contact:
  
  Chief Privacy Officer
  Christian Brothers Services
  1205 Windham Parkway
  Romeoville, IL 60446-1690
  cpo@cbservices.org
  Toll free: 800-807-0100
  
  
• How Do I Contact The Federal Government If I Want To Make a Complaint or Inquiry?
  To contact the Secretary of Health and Human Services, write to:
  
  U.S. Department of Health and Human Services
  Office of Civil Rights
  200 Independence Avenue, S.W.
  Washington, D.C. 20201
  (202) 619-0257
  Toll free: 1-877-696-6775
  http://www.hhs.gov/contacts/privacy.html
  
  
• What is the Effective Date of This Notice?
  The effective date of this Notice is September 23, 2013.
  
  
• Can This Notice Be Changed?
  The Trust reserves the right to change the terms of this Notice and its information practices and to make the new provisions effective for all protected health information it maintains. Any amended Notice will be provided to you.