Chartr Health
Updated July 12, 2025
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act and its implementing regulations, provides restrictions on the use and disclosure of protected health information (PHI).
This policy specifies the responsibilities, requirements, and procedures for the safeguarding, use, and disclosure of protected health information (PHI) transmitted or maintained in any form or medium (electronic or otherwise) by Chartr Health and its members.
An entity, not a member of the Covered Entity's workforce, who:
Business Associates include:
Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. There are two ways a covered entity can determine that information is de-identified:
A group of records maintained by or for a company that includes:
For information that is PHI, disclosure means any release, transfer, provision of access to, or divulging in any other manner of individually identifiable health information to persons not employed by or working within the human resources department of the location(s) of the Employer.
Health care operations means any of the following activities to the extent that they are related to Plan administration:
Payment includes activities undertaken to obtain Plan contributions or to determine or fulfill the Plan's responsibility for provision of benefits under the Plan, or to obtain or provide reimbursement for health care. Payment also includes:
The sharing, employment, application, utilization, examination, or analysis of individually identifiable health information by any person working for or within the human resources department of the Employer, or by a Business Associate (defined below) of the Plan.
Chartr Health is a business entity that is considered to be a Business Associate with respect to protected health information (PHI), as provided by the standards, requirements, and implementation specifications of HIPAA Privacy Rule. Therefore, this policy applies to Chartr Health and all the members of its workforce with access to PHI. Additionally, all third parties, subcontractors, or vendors that provide services to Chartr Health that involve the creation, receipt, maintenance, or transmission of private health information on behalf of the Employer to fulfill its contractual duties, must comply fully with HIPAA's requirements.
Privacy personnel designations will be documented and maintained in written or electronic form for six years from time of designation.
Chartr Health's CISO will serve as the Privacy Official, who will be responsible for:
This policy and associated procedures are designed to ensure compliance as it applies to Chartr Health, its size, and the type of activities it performs. As documented, this policy will be maintained for at least six years from the date last in effect. Any necessary or appropriate changes to this policy will be:
The Plan shall document certain events and actions (including authorizations, requests for information, sanctions, and complaints) relating to an individual's privacy rights.
Chartr Health will ensure that all personnel are trained on the company's privacy policies and procedures, and the HIPAA Privacy Rule as applicable, annually. The training will be reviewed and updated as needed, but annually at the least.
Chartr Health has appropriate administrative, technical and physical safeguards to prevent PHI from intentionally or unintentionally being used or disclosed in violation of HIPAA's requirements (see company information security policies and procedures, and controls in place).
Chartr Health's privacy notice will include:
Chartr Health will deliver or make available the privacy notice to appropriate individuals:
Violation of this policy or HIPAA Privacy Rule will be met with sanctions in accordance with Chartr Health's discipline policy, up to and including termination (See Information Security Policy).
Chartr Health will, to the extent possible, mitigate any harmful effects that become known to it of a use or disclosure of an individual's PHI in violation of HIPAA or the policies and procedures set forth in this Policy. As a result, personnel will immediately contact the Privacy Official for the appropriate steps to mitigate the harm to impacted individuals, if the member becomes aware of:
No Chartr Health member may intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for exercising their rights, filing a complaint, participating in an investigation, or opposing any improper practice under HIPAA.
No individual will be required by Chartr Health or any of its members to waive his or her privacy rights under HIPAA, as a condition of treatment, payment, enrollment or eligibility under a health plan.
All members of Chartr Health with access to PHI must comply with this Policy and included procedures.
The following employees (“employees with access”) have access to PHI:
Employees with access may use and disclose PHI for company administrative functions, and they may disclose PHI to other employees with access for administrative functions (but the PHI disclosed must be limited to the minimum amount necessary to perform the plan administrative function). Employees with access may not disclose PHI to employees (other than employees with access) unless an authorization is in place or the disclosure otherwise is in compliance with this Policy and any associated procedures.
Chartr Health may disclose the following for its use:
PHI may be disclosed for the purposes of Chartr Health's own payment purposes, and PHI may be disclosed to another covered entity for the payment purposes of that covered entity. Same stands for disclosure for health care operations. PHI may be disclosed to another covered entity for purposes of the other covered entity's quality assessment and improvement, case management, or health care fraud and abuse detection programs, if the other covered entity has (or had) a relationship with the participant and the PHI requested pertains to that relationship.
PHI may not be used or disclosed for the payment or operations of the Chartr Health's “non-health” benefits (e.g., disability, workers' compensation, life insurance, etc.), unless the participant has provided an authorization for such use or disclosure or such use or disclosure is required by applicable state law and particular requirements under HIPAA are met.
A participant's PHI must be disclosed as required by HIPAA in three situations: (1) The disclosure is to the individual who is the subject of the information; (2) the disclosure is required by law; or (3) the disclosure is made to HHS for purposes of enforcing HIPAA.
An employee who receives a request for disclosure of an individual's PHI that appears to fall within one of the permitted categories must contact the Privacy Official. Disclosures must: (1) be approved by the Privacy Official; (2) comply with the “Minimum-Necessary Standard”; and (3) be documented in accordance with the procedure for “Documentation Requirements”. Permitted disclosures include disclosures about victims of abuse, neglect or domestic violence; for judicial and administrative proceedings; to law enforcement officials; to public health authorities; to health oversight agencies; to coroners or medical examiners; for cadaveric organ donation; for limited research purposes; to avert serious threats to health or safety; for specialized government functions; and for workers' compensation programs.
PHI may be disclosed for any purpose if an authorization that satisfies all of HIPAA's requirements for a valid authorization is provided by an individual. All uses and disclosures made pursuant to a signed authorization must be consistent with the terms and conditions of the authorization.
Employees must take steps to verify the identity of individuals who request access to PHI. They must also verify the authority of any person to have access to PHI, if the identity or authority of such person is not known. Separate procedures apply depending on whether the request is made by the individual, a parent seeking access to the PHI of his or her minor child, a personal representative, or a public official seeking access.
Employees may disclose PHI to Chartr Health's business associates and allow the business associates to create or receive PHI on its behalf. However, prior to doing so, Chartr Health will first obtain assurances from the business associate that it will appropriately safeguard the information. All uses and disclosures by a “business associate” will be made in accordance with a valid business associate agreement.
HIPAA requires that when PHI is used or disclosed, the amount disclosed generally must be limited to the “minimum necessary” to accomplish the purpose of the use or disclosure. The minimum-necessary standard does not apply to uses or disclosures made to the individual, pursuant to an individual authorization, to HHS, as required by law, or as required to comply with HIPAA.
HIPAA provides individuals the right to access and obtain copies of their PHI (or electronic copies of PHI) that Chartr Health (or its business associates) maintains in designated record sets. Requests will be responded to within 30 days, with a possible 30-day extension upon written notice.
HIPAA also provides individuals the right to request to have their PHI amended. Chartr Health will consider requests for amendment that are submitted in writing by participants. Requests will be responded to within 60 days, with a possible 30-day extension upon written notice.
An individual has the right to obtain an accounting of certain disclosures of his or her own PHI. The accounting must include disclosures made during the period requested by the individual up to six years prior to the request.
Individuals may request to receive communications regarding their PHI by alternative means or at alternative locations. The Employer shall accommodate such a request if the participant clearly provides information that the disclosure of all or part of that information could endanger the participant.
Individuals may request restrictions on the use and disclosure of the participant's PHI. All requests for limitations on use or disclosure of PHI that are approved must be tracked, and all business associates that may have access to the individual's PHI must be notified of any agreed-to restrictions.
Copies of all of the following items will be maintained for a period of at least six years from the date the documents were created or were last in effect, whichever is later: