HIPAA Notice of Privacy Practices | Michigan Catholic Conference

Please read this notice carefully. This notice describes how medical information about you may be used and disclosed and how you can access this information.

Download PDF

This HIPAA Notice of Privacy Practices (Notice) contains important information about your medical information. A current version of this Notice is available at www.micatholic.org/benefits

You have the right to receive a paper copy of this Notice and may ask us to give you a copy of this Notice at any time, even if you received this Notice electronically. If you have any questions about this Notice, contact the person listed in Part 8, below.

The Health Insurance Portability and Accountability Act (HIPAA) imposes numerous requirements on employer health plan regarding how protected health information (PHI), which includes most individually identifiable health information may be used and disclosed. This Notice describes how the Section 125 Church Flexible Benefit Plan (Plan), and any third party (referred to as “business associates” under HIPAA) that assists in the administration of the Plan, may use and disclose your PHI for treatment, payment, health care operations, and other purposes permitted or required by law. This Notice also describes your rights to access and control your PHI. PHI includes information maintained or transmitted by the Plan, which may identify you and that relates to your past, present, or future physical or mental health or condition and related health care services.

We understand that information about you and your health is personal. We are committed to protecting medical information about you and will use it to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request of it. We and/or our business associates create a record of the health care claims, including (without limitation) flexible spending accounts (FSA). This Notice applies to all PHI we maintain.

To the extent benefits provided under the Plan are insured or administered by a business associate, the insurance company or business associate’s Notices of Privacy Practices will apply, except for the limited PHI the Plan has access to, received or maintains, particularly when you ask us to assist you in a claims processing or benefit determination dispute, information related to your enrollment or disenrollment, and certain summary health information. This Notice will only apply to the Plan to the extent it has PHI.

Your health care provider may have different policies and will have a different notice about how they use and disclose your PHI. We are required by law to abide by the terms of this Notice to: (1) ensure PHI is kept private, (2) give you this Notice of our legal duties and privacy practices regarding PHI, and (3) follow the terms of the Notice that is currently in effect.

These rules apply to the Plan, not Michigan Catholic Conference or any Covered Unit as an employer.

1. How We May Use and Disclose Medical Information About You

HIPAA generally permits the use and disclosure of your PHI without your permission for purposes of health care treatment, payment activities, and health care operations. These uses and disclosures are described below. This Notice does not list every use or disclosure. It does give examples of the most common uses and disclosures.

Treatment: When and as appropriate, we may use or disclose PHI about you to facilitate medical treatment or services by health care providers. We may disclose medical information about you to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you. For example, we might disclose PHI about you with physicians who are treating you.
Payment: When and as appropriate, we may use and disclose PHI about you to determine your eligibility for Plan benefits, to facilitate payment for the treatment and services you receive from health care providers, to determine benefit responsibility and coverage under the Plan, or to coordinate your coverage. For example, we may disclose PHI about your medical history to a physician to determine whether a particular treatment is experimental, investigational, medically necessary, or to decide if the Plan will cover the treatment. Additionally, we may share PHI with another entity to assist with the adjudication or subrogation of health claims, or with another health plan to coordinate benefit payments.
Health Care Operations: When and as appropriate, we may use and disclose PHI about you for the Plan’s operations. For example, we may use PHI to conduct quality assessment and improve administration; underwriting, premium rating, and other activities relating to coverage; submitting claims for stop loss coverage; conduct or arrange for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development; and business management and general administrative activities of the Plan. For example, we may use your information to review the effectiveness of wellness programs or in negotiating new arrangements with our current or new insurers. We will not use or disclose your genetic information for underwriting purposes.

We apply the HIPAA ‘minimum necessary’ standard when using, disclosing, or requesting PHI, as required by law. The minimum necessary standard does not apply to certain disclosures, such as disclosures for treatment or disclosures to you about your own PHI. Where appropriate, we may use or disclose a limited data set or de-identified information. We may also contact you to provide information about treatment options or alternatives or other health-related benefits and services that may be of interest to you.

There are other permitted uses and disclosures.

Disclosure to Others Involved in Your Care: We may disclose PHI about you to a relative, a friend, or to any other person you identify, provided the PHI is directly relevant to that person’s involvement with your health care or payment for that care. For example, if a family member or caregiver calls us with prior knowledge of a claim and asks us to help verify the status of a claim, we may agree to help them confirm whether the claim has been received and paid.
Disclosure to Health Plan Sponsor: PHI may be disclosed to another health plan maintained by Michigan Catholic Conference for purposes of facilitating claims payments under that plan. In addition, PHI may be disclosed to Michigan Catholic Conference or Covered Unit personnel, but only after Michigan Catholic Conference or the Covered Unit has certified to the Plan that it agrees to safeguard the PHI as required by HIPAA and use it only for plan administration.
Workers’ Compensation: We may release medical information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
To Comply with Federal and State Requirements: We will disclose PHI about you when required to do so by federal, state, or local law. For example, we may disclose PHI when required by the U.S. government agencies that regulate us; to federal, state, and local law enforcement officials; in response to a judicial order, subpoena, or other lawful process; and to address matters of public interest as required or permitted by law. We are also required to disclose PHI about you to the Secretary of the U.S. Department of Health and Human Services if the Secretary is investigating or determining compliance with HIPAA, or to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law. We may disclose your PHI to a health oversight agency for activities authorized by law.
To Avert a Serious Threat to Health or Safety: We may use and disclose PHI about you when necessary to prevent a serious threat to the health and safety of yourself, another person, or the health and safety of the public. Any disclosure would only be to someone who is able to help prevent the threat. For example, we may disclose PHI about you in a proceeding regarding the licensure of a physician.
Military and Veterans: If you are a member of the armed forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.
Business Associates: We may disclose your PHI to our business associates that perform services for the plan (for example, claims administration, utilization review, and audit services). Our business associates are required by law and by contract to protect your PHI and to use or disclose it only as permitted by HIPAA and our agreements.
PHI Relating to Substance Use Disorders: Information relating to treatment or payment for treatment related to substance use disorders will be used or disclosed (other than for such treatment or payment) only with your written consent or at the order of a court with competent jurisdiction. This includes prohibiting the use of information relating to substance use disorders for civil, criminal, legislative, administrative or other proceedings without your written consent or a court order.
Other Uses: If you are an organ donor, we may release your PHI to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation. We may release your PHI to a coroner or medical examiner. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your PHI to the correctional institution or law enforcement official. To the extent we use PHI for fundraising purposes (to the extent permitted by HIPAA and other applicable law), you will be provided with a clear and conspicuous opportunity to opt out of those communications, uses and disclosures.

Uses and disclosures other than those described in this Notice will require your written authorization. We will obtain your written authorization for: most uses and disclosures of psychotherapy notes; uses and disclosure of substance use disorder records; uses and disclosures of PHI for marketing purposes; and disclosures that are a sale of PHI. Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke your authorization at any time, unless and until the Plan has already acted on it.

The privacy laws of a particular state or other federal laws might impose a more stringent privacy standard. If these more stringent laws apply and are not superseded by federal preemption rules under the Employee Retirement Income Security Act (ERISA), the Plan will also comply with the more stringent law.

Once PHI is used or disclosed, even in accordance with HIPAA and this Notice, it may be further used or disclosed and may no longer be subject to HIPAA.

2. Your Rights to Your PHI

You have the following rights regarding PHI that we maintain about you:

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI that may be used to make decisions about your benefits under the Plan. If you request a copy of the PHI, we may charge a fee for the costs associated with your request. We may deny your request to inspect a copy in certain limited circumstances. If you are denied access to PHI, you may request that the denial be reviewed. If the Plan does not maintain the PHI, but knows where it is maintained, you will be informed of where to direct your request.

Your Right to Amend

If you believe the PHI the Plan has about you is incorrect or incomplete, you may ask us to amend it. You have the right to request an amendment for as long as the PHI is kept by or for the Plan. You must provide a reason for your request. The Plan may deny your request if it is not in writing or does not include a reason to support the request. The Plan may deny your request if you ask us to amend any of the following:

Information that is not part of the PHI kept by or for the Plan.
PHI that was not created by us, unless the person or entity that created the PHI is no longer available to make the amendment.
PHI that is subject to your right to inspect and copy.
PHI that is accurate and complete.

Your Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures” (that is, a list of certain disclosures the Plan has made of your PHI). Generally, you may receive an accounting of disclosures if the disclosure is required by law, made in connection with public health activities, or in situations similar to those listed above as Other Permitted Uses and Disclosures. You do not have a right to an accounting of disclosures where such disclosure was made:

For treatment, payment, or health care operations.
To you about your own PHI.
Incidental to other permitted disclosures.
Where authorization was provided.
To family or friends involved in your care (where disclosure is permitted without authorization).
For national security or intelligence purposes or to correctional institutions or law enforcement officials in certain circumstances.
As part of a limited data set where the information disclosed excludes identifying information.
More than six years prior to your request.
To request this accounting of disclosures, you must submit your request, which shall state a period that is not longer than six years. Your request should indicate in what form you want the accounting of disclosures (paper or electronic). The first accounting you request within a 12-month period will be free, but we may charge a reasonable cost-based fee for additional requests within the 12-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Your Right to Request Restrictions

You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a surgery that you had. We are not required to agree to your request. If the Plan does agree to a request, a restriction may later be terminated by your written request, by agreement between you and the Plan (including orally), or unilaterally by the Plan for PHI created or received after the Plan has notified you that they have removed the restrictions and for emergency treatment. To request restrictions, you must make your request in writing and must tell us the following information:

What information you want to limit.
Whether you want to limit our use, disclosure, or both.
To whom you want the limits to apply.
The Plan will comply with any restriction request if, except as otherwise required by law, the disclosure is to the Plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment).

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that the Plan only contact you at work or by mail. You do not need to provide the reason for your request. We will accommodate reasonable requests that specify an alternative address, phone number, or other method of contact.

You must make any of the requests described above to the person listed in Part 8, below.

3. Breach Notification

We are required to notify you following a breach of your unsecured PHI. If a breach occurs, we will provide you with a notice that describes what happened, the types of PHI involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the harm, and how to contact us for more information. We will also provide any required notices to government authorities and, when applicable, to the media.

4. Changes to This Notice

We may change the terms of this Notice and make the new Notice effective for all PHI we maintain. If we make a material change, we will provide the revised Notice as required by law, such as by posting it at www.micatholic.org/benefits and by distributing a paper copy upon request.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Plan or with the Secretary of the Department of Health and Human Services. To file a complaint with the Plan, contact the person listed in Part 8, below. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

6. Other Uses of PHI

Other uses and disclosures of PHI that are not covered by this Notice or the laws that apply to us will be made only with your written permission. If you grant us permission to use or disclose PHI about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose PHI about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we may be required to retain our records related to your benefit determinations and enrollment.

7. Effective Date

This Notice is effective on February 16, 2026.

8. Contact Information

All correspondence relating to the contents of this Notice should be directed as follows:

Attn: Michelle Dollis-Brady
510 S Capitol Ave
Lansing, MI 48933
(517) 316-3587
mdollis-brady@micatholic.org