It is important for members to take an active role in protecting their health information. Helping members know what to look for when choosing an app can help members make more informed decisions. Members should look for an easy-to-read privacy policy that clearly explains how the app will use their data. If an app does not have a privacy policy, members should not use the app.
Members should consider:
Some members, particularly those who are covered by Qualified Health Plans (QHPs) on the Federally-facilitated Exchanges (FFEs), may be part of an enrollment group where they share the same health plan as multiple members of their tax household.
Often, the primary policy holder and other members, can access information for all members of an enrollment group unless a specific request is made to restrict access to member data.
Patients should be informed about how their data will be accessed and used if they are part of an enrollment group based on the enrollment group policies of their specific health plan in their specific state.
Patients who share a tax household but who do not want to share an enrollment group have the option of enrolling individual household members into separate enrollment groups, even while applying for Exchange coverage and financial assistance on the same application. However, this may result in higher premiums for the household and some members, (i.e. dependent minors, may not be able to enroll in all QHPs in a service area if enrolling in their own enrollment group) and in higher total out-of-pocket expenses if each member has to meet a separate annual limitation on cost sharing (i.e., Maximum Out-of-Pocket or MOOP).
For information about our procedures for complaints submission, please see our Notice of Privacy Practices: https://mcsclassicare.com/en/Pages/privacy-notice.aspx
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules, and the Patient Safety Act and Rule. You can find more information about patient rights under HIPAA and who is obligated to follow HIPAA here: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html
You may also find additional information in the HIPAA FAQs for Individuals: https://www.hhs.gov/hipaa/for-individuals/faq/index.html
Most third-party apps will not be covered by HIPAA. Most third-party apps will instead fall under the jurisdiction of the Federal Trade Commission (FTC) and the protections provided by the FTC Act.
The FTC Act, among other things, protects against deceptive acts (e.g., if an app shares personal data without permission, despite having a privacy policy that says it will not do so).
The FTC provides information about mobile app privacy and security for consumers here: https://www.consumer.ftc.gov/articles/0018-understanding-mobile-apps
HIPAA, or the Health Insurance Portability and Accountability Act of 1996, covers both individuals and organizations. Those who must comply with HIPAA are often called HIPAA covered entities.
HIPAA covered entities include:
The member has the right to file a complaint with MCS, if you believe that your privacy rights have been violated. All complaints must: (1) be submitted in writing; (2) include the name of the covered entity that is the subject of the complaint; (3) describe the acts or omissions believed to be in violation of the standards, and (4) be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred.
You may also file a civil rights complaint with the U.S. Department of Health and Human Services (DHHS) Office for Civil Rights (OCR) electronically through the OCR complaint portal, available at https://hhs.gov/ocr/portal/lobby.jsf, or by mail at the following address or by telephone at the following numbers: U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Room 509F, HHH Building, Washington, D.C. 20201, 1-800-368-1019, 800-537-7697 (TDD). Claim forms may be obtained from the website at http://www.hhs.gov/ocr/office/file/index.html.
No penalty or retaliation will be taken against you for filing a complaint with the Secretary of DHHS or with MCS.
You must submit the complaint to MCS at the following postal mail address or email address:
MCS Attention: Privacy Officer Box 9023547 San Juan, PR 00902-3547 mcscompliance@medicalcardsystem.com
To learn more about filing a complaint with OCR under HIPAA; visit: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
Individuals can file a complaint with OCR using the OCR complaint portal: https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf
Individuals can file a complaint with the FTC using the FTC complaint assistant:: https://reportfraud.ftc.gov/#/