Notice of Privacy Practices

Note for January 23, 2024 Update: This version incorporates changes made to update the contact information (specific offices and website locations) for the World Trade Center (WTC) Health Program and the U. S. Department of Health and Human Services (HHS) for questions about your personal health information. How the WTC Health Program uses and discloses your personal health information or any of your privacy rights regarding your personal health information is the same.

Effective Date of Notice: This Notice of Privacy Practices for the WTC Health Program is effective January 23, 2024.

Program Notice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires the World Trade Center (WTC) Health Program to maintain the privacy and security of your personal health information and to provide you with notice of its legal duties and privacy practices with respect to how your personal health information is held, used, and disclosed by the WTC Health Program.

How Do We Use and Share Your Personal Health Information?

The WTC Health Program must use and share your personal health information to provide information:

To you, someone you name to receive your personal health information, or someone who has the legal right to act for you (the WTC Health Program will make sure that the person has the proper authority before taking any action);
To the Secretary of the Department of Health and Human Services (HHS), if necessary, to make sure your privacy is protected and that the HIPAA requirements are being followed; and
Where required by law.

The WTC Health Program may use and share your personal health information to provide you with treatment, to pay for your health care, and to operate the WTC Health Program. For example, the WTC Health Program may use or share your personal health information in the following ways:

The WTC Health Program will collect and use your personal health information to decide if you meet the necessary requirements for coverage of your health condition(s) under the WTC Health Program. Conditions which meet these requirements are then “certified” by the WTC Health Program.
The WTC Health Program will collect and use your personal health information to determine your diagnosis and any medically necessary treatment for your “certified” health conditions.
The WTC Health Program will disclose your personal health information to the Centers for Medicare and Medicaid Services (CMS) Office of Financial Management to pay providers for eligible health care services you received.
The WTC Health Program will review and use your personal health information to make sure you are receiving quality healthcare.

Under limited circumstances, the WTC Health Program may use or share your personal health information for the following purposes:

To other federal and state agencies, where allowed by federal law, that need WTC Health Program health data for their program operations;
For public health activities conducted by public health authorities (such as reporting disease outbreaks);
For health care oversight activities (such as fraud and abuse investigations);
For judicial and administrative proceedings (such as in response to a court order);
For law enforcement purposes;
To avoid a serious and imminent threat to health or safety;
For purposes of reporting information to a government authority about victims of abuse, neglect, or domestic violence;
To report information about deceased individuals to a coroner, medical examiner, or funeral director;
To organ procurement organizations for organ or tissue donation and transplantation purposes;
For research purposes under certain conditions;
For workers’ compensation purposes; or
To contact you about new or changed coverage under the WTC Health Program.

What Are Your Rights When It Comes To Your Personal Health Information?

When it comes to your personal health information, you have certain rights. By law, you have the right to:

Receive a paper copy of this privacy notice. You can ask for a paper copy of this notice even if you have already received an electronic copy (for example, by email). We will provide you with a paper copy promptly upon request.
Receive a list that shows with whom we have shared your personal health information. You can ask for a list (accounting) of the times we have shared your personal health information for six years prior to the date you ask. The list shows whom we shared it with, when, and why. The list does not include information about treatment, payment, health care operations, and certain other disclosures (such as any you asked us to make). We will provide one free accounting a year but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Receive a copy your personal health information. You can ask to see or get a copy of your health and claims records and other health information that we have about you. You can contact us by using the information included in the last page of this notice. We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee to send your health and claims records.
Ask us to change (“amend”) your personal health information. You can request to change your records if you believe that your personal health information is wrong or that information is missing. Please note that we may deny your request to change your personal health information if we believe the information in your records is accurate and complete. If your request is denied, we will provide you with a written explanation of the denial within 60 days of the date we received your request. You may have a statement added to your personal health records to reflect your disagreement.
Request confidential communications. You may request that we communicate your personal health information in a private (“confidential”) way. You may ask that we contact you in a specific way (for example, home or office phone) or to send mail to a different address.
Ask us to limit how we use and share your personal health information. You can ask us not to use or share certain health information. We are not required to agree to the limits you request, except under certain circumstances.
Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your personal health information. We will make sure the person has this authority and can act for you before we take any action.
Receive breach notification. You can expect to be informed of and receive notification if a breach occurs that may have compromised the privacy or security of your information.

When Do We Require Your Written Permission?

By law, the WTC Health Program must have your written permission (authorization) to use or share your personal health information for any purpose that is not set out in this notice, including certain uses or disclosures of psychotherapy notes. In addition, the WTC Health Program will not sell or market your personal health information without your written permission.

You may take back (revoke) your written permission anytime, except in cases where the WTC Health Program has already acted on your permission. If you take back your written permission, please provide that to the WTC Health Program in writing.

The WTC Health Program is prohibited from using or sharing your personal genetic health information (i.e., your genetic tests, the genetic tests of your family members, and your family medical history) to determine your eligibility and enrollment into the WTC Health Program (i.e., underwriting).

What Are the Responsibilities of the WTC Health Program?

The WTC Health Program is required by law to abide by the terms of this privacy notice. The WTC Health Program has the right to change this privacy notice and the changes will apply to all the information that we have about you. If we make any significant changes to this notice, a copy of the revised notice will be made electronically available on the WTC Health Program website and you will receive the new notice by mail or email within 60 days. You may also request to receive a copy of the notice at any time.

How Can You Contact the WTC Health Program?

You can call 1-888-982-4748 to get further information about matters covered by this notice. Ask to speak to a member of the WTC Health Program’s HIPAA Team.

How Can You File a Complaint?

If you believe that your privacy rights have been violated, you may file a complaint with the WTC Health Program by calling 1-888-982-4748 or by sending a letter to P.O. Box 7000 Rensselaer, NY 12144 ATTN: WTC Health Program, HIPAA Complaint. Filing a complaint will not affect your coverage under the Program.

You may also file a complaint with the HHS Office for Civil Rights by sending a letter to 200 Independence Avenue, SW, Washington, DC 20201, calling 1-800-368-1019 , or visiting www.hhs.gov/hipaa/filing-a-complaint/index.html . TTY users should call 1-800-537-7697.