Privacy Statement

This notice explains how Aspire Health Plan may use and disclose your protected health information (PHI), your privacy rights, and how we protect your health information as required by law.

NPP (PDF): English | Español

THIS NOTICE DESCRIBES HOW HEALTH PLAN, CLAIMS AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Aspire Health Plan is committed to protecting the confidentiality of your protected health information (PHI), including medical and billing information. We take the job of protecting your PHI seriously.

This Notice of Privacy Practices describes how Aspire Health Plan may use and disclose your protected health information (PHI) to provide health care coverage for you, to facilitate payment of the health care services provided by your doctor and to support the health care operations of our insurance plan.

Aspire Health Plan provides this notice to you pursuant to the requirements of federal law, specifically the Health Insurance Portability and Accountability Act (HIPAA). To the extent that applicable state or federal laws and rules are more stringent that the HIPAA Privacy Standards, we will continue to follow these laws and rules.

The law requires Aspire Health Plan to notify you regarding:

• What kind of PHI we collect about you and how we get it
• How we use and share your PHI
• When we are required to share your PHI
• When we may share your PHI with those involved in your care
• When we need your consent to use or share your PHI
• What kind of PHI we release to other entities and organizations
• How we protect your PHI from unauthorized use and disclosures
• Your rights under the law

PHI includes your demographic information such as name, address, telephone number, social security number, birth date, and gender. PHI also includes information regarding your health, illnesses, injuries, and information about the medical services provided to you, including tests results. Your insurance information (e.g., your member ID) and other identifying information may also qualify as PHI.

Aspire Health Plan collects your PHI from a variety of sources, including but not limited to:

• You (when you complete enrollment forms)
• Your prior transactions with Aspire Health Plan Medicare Advantage Plans
• Your physician and other health care providers
• Your transactions with others (your providers, employer, or other health plans)

We may amend this Notice of Privacy Practices periodically and you may obtain a current copy of the Notice by obtaining from the Aspire Health Plan website or the Privacy Office.

We reserve the right to make the revised or changed Notice effective for PHI that we already have about you as well as for any PHI we receive in the future.

Uses and Disclosures of PHI for Treatment, Payment and Health Care Operations

The Aspire Health Plan will use and disclose your PHI for the following types of activities:

• For Treatment: We may share your PHI with health care providers who take care of you including doctors, dentists, pharmacies (including Mail-order pharmacies) and hospitals. Sometimes providers may ask for medical information from us to put into their records for future treatment purposes.
• For Payment: Payment means our activities to pay for the medical services provided to you, including billing, claims management, and collection activities. Payment activities also include our work in coordinating care, determining eligibility, claims processing, assessing medical necessity and utilization review. Specifically, we may use your health history and other PHI to decide whether a treatment is medically necessary and what the payment should be. During this process, we may share information with your health care provider.
• For Health Care Operations: Health care operations mean the business activities of our health plan. These activities include, for example, quality assessment and improvement activities, licensing, accreditation by independent organizations, practitioner performance evaluation, member satisfaction surveys, fraud and abuse compliance, business planning and development, health education, and general administrative activities. For example, we may use your PHI to offer programs for certain conditions, such as diabetes, asthma or heart failure. We may also use it for other operations requiring use and disclosure such as:
  • Administering reinsurance and stop loss
  • Underwriting and rating
  • Investigating fraud
  • Running pharmaceutical programs and payments
  • Moving policies or contracts from and to other health plans
  • Facilitating a sale, transfer, merger or consolidation of all or part of Aspire with another entity (including related due diligence)
  • Performing other general administrative activities (including data and information systems management and customer service)
  • Creating de-identified data (this is data that no longer identifies you. We may use it or share it for analytics, business planning or other reasons).
  • Send you a newsletter about our health plan or a mailing about health plan activities. We may also use or disclosure your PHI to contact you about health care quality improvement initiatives or health-related benefits that may be of interest to you.

When we involve third parties in our business activities, we require them to treat your PHI the same way we do and sign formal contracts that outline their legal obligations to safeguard the use and disclosure of your PHI.

We may also share your PHI with other covered entities or their business associates. This may be for treatment, payment, or for certain health care operations. For example, you may get your health benefits through an employer. If so, we may share your PHI with other health plans your employer offers. We do this to make sure we pay your claims the right way.

Additional Uses and Disclosures of PHI not Requiring Your Authorization

• To Business Associates: Aspire Health Plan may contract with other organizations called “Business Associates” to provide services on our behalf. As these services are performed by our Business Associates, PHI may be accessed or disclosed. We will enter into an agreement with Business Associates that explicitly set forth the requirements associated with the protection and safeguarding of your PHI.
• For Plan Administration: We may disclose PHI to the plan sponsor of a group health plan (typically with your employer if coverage is provided by your or your family member’s employer) when appropriately sought for the health plan operations.
• For Fundraising: Aspire Health Plan may contact you during fundraising campaigns. We may use and disclose your PHI to contact you regarding our fundraising efforts. You have the right to “opt out” of receiving fundraising communications by following the opt out instructions on the communication or contacting our Compliance Officer and making a request to opt-out of receiving fundraising communications.

Other permitted or required uses and disclosures of PHI that do not require your authorization include the following:

• Release of Information to you/your personal representative: We must disclose your PHI to you, or someone who has the legal right to act for you. This person is your personal representative. We do this to help manage your rights, as spelled in this Notice.
• Release of information to family/friends: We may disclose your PHI to a family member, close friend or other person you specifically identify in writing, to the extent the information is relevant to that person’s involvement in your care or payment related to your care. You have the right to stop or limit this kind of sharing (disclosure). To do so, just call the toll-free number on your member ID card.
• Parents as personal representatives of minors: In most cases, your minor child’s PHI may be disclosed to you. However, we may be required by law to deny a parent’s access to a minor’s PHI for certain diagnoses or treatment such as sexually transmitted diseases, family planning services, etc.
• Appointment reminders and treatment options: We may use and disclose your PHI to contact you and remind you of an appointment. We may use or disclose your PHI to inform you of potential treatment options or alternatives. We may use and disclose your PHI to inform you of other health-related benefits and services that may be of interest to you.

We will not use genetic information to decide whether we will give you coverage and the price of that coverage.

Uses and Disclosures of PHI Based Upon Your Written Authorization

Except as otherwise described in this Notice, we may not use or disclose your PHI without your written authorization, which you may revoke. For example, we will not use or disclose your health information for marketing purposes unrelated to your benefit plan(s), unless we have received your written authorization to do so. We will also seek your authorization prior to disclosing psychotherapy notes, when linked to the sale of PHI or any other reason required by law.

You may request that we disclose all or part of your PHI to a person or organization outside of Aspire Health Plan. We will ask for written documentation that complies with applicable law to disclose such information.

You may revoke your authorization at any time, but only regarding future uses or disclosures and only to the extent we have not already used or disclosed your PHI in reliance on your authorization. PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

Uses and Disclosures of PHI that are Permitted or Required by Law

In some circumstances, Aspire Health Plan may use or disclose your PHI without your authorization.

• Required by law: We may disclose PHI to the extent required by law and in a manner limited to the specific requirement of the law.
• Public health activities: We may disclose your PHI to a health oversight agency for audits, investigations, inspections and other activities necessary for the appropriate oversight of the health care system and the government benefit programs such as Medicaid and Medicare.
• Judicial, legal, and administrative proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order expressly directing disclosure and, within certain limits, in response to a subpoena, discovery request, or other lawful purpose.
• Law enforcement activities: We may disclose your PHI to a law enforcement officer for law enforcement purposes, or about a victim of a crime if, under limited circumstances, we are unable to obtain the person’s agreement; or, in emergency circumstances, to report a crime, the location of the crime or victim, or the identity, description, or location of the person who committed the crime.
• Organ and tissue donation requests and work with a medical examiner or funeral director: We can share health information about you with organ procurement organizations. We can also share health information with a coroner, medical examiner, or funeral director when an individual passes away.
• Research: We may disclose your PHI for certain medical or scientific research where the researchers have a protocol to ensure the privacy of your PHI.
• Serious threats to health and safety: We may disclose your PHI to prevent or reduce a serious and imminent threat to the health or safety of a person or the public.
• Armed forces personnel and national security: We may disclose the PHI of members of the armed forces for activities deemed necessary by appropriate military command authorities to assure proper execution of the military mission. We also may disclose your PHI to certain federal officials for lawful intelligence, counterintelligence, and other national security activities.
• Correctional facilities: Regarding inmates, we may disclose your PHI to a correctional institution or law enforcement official to the extent required by law, by court order, or as authorization by law or rule.
• Workers’ compensation: We may disclose your PHI as authorized by and to the extent necessary to comply with the Worker’s Compensation Act or other similar programs that provide benefits for work-related injuries or illness without regard to fault.
• Department of Health and Human Services: We must disclose your PHI to the Secretary of the US Department of Health and Human Services to investigate or determine our compliance with applicable law.
• Medicare Advantage Plan Compliance: We must disclose information to the Centers for Medicare & Medicaid Services and its contractors for various purposes, including payment and risk adjustment, quality measurement and improvement, program integrity and oversight, and coordination with other Medicare plans.

Special Categories of Information

In some circumstances, your PHI may be subject to restrictions that may limit or preclude some uses or disclosures described in this Notice. For example, there are special restrictions on the use or disclosure of certain categories of information — e.g., tests for HIV or treatment for mental health conditions or alcohol and drug abuse. Government health benefit programs may also limit the disclosure of beneficiary information for purposes unrelated to the program. We will follow the law that is stricter (or more protective of your PHI), where it applies to us.

We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:

• • You give us written consent, or
  • A court orders us with a subpoena or other legal requirement.
  • You or Aspire must also receive notice and a chance to be heard.

Your Rights Regarding PHI

We must disclose your PHI to you upon request. You have the following rights:

• Right to request restriction of uses and disclosures: You have the right to request that we not use or disclose any part of your PHI unless it is a use or disclosure required by law. Please advise us in writing of the specific PHI you wish to restrict and the individual(s) who should not receive the restricted PHI. If certain conditions are met, we have the right to terminate our agreement to the restriction.
• Right to access your Designated Record Set: You have the right to ask us for a copy of PHI that is part of a “Designated Record Set.” This may include medical records. It may also include other records we keep and use for:
  • Enrollment
  • Payment
  • Claims processing
  • Medical management
  • Other decisions
• Right to confidential communications: You can ask us to contact you in a specific way (for example, by home or office phone) or to send mail to a different address. We will consider all reasonable requests.
• Rights to choose someone to act for you (Personal Representative): If you have given someone medical or financial power of attorney or if someone is your legal guardian, that person may be able to exercise your rights and make choice about your health information. We will make sure the person has this authority and can act for you before we take any action.
• Right to amend your PHI: You have the right to request that we amend the PHI in your Designated Record Set for as long as we maintain the PHI in such format. Please make your request in writing to our Privacy Contact. If we deny your request for amendment, you have the right to submit a written statement of reasonable length disagreeing with the denial and we have the right to submit a rebuttal statement. A record of any disagreement about amendment will become part of your medical records and may be included in subsequent disclosures of your PHI. We will not delete any health information or PHI in your records. We will require that you identify persons who have received disclosure of the PHI that you have corrected, clarified, or amended and will request your agreement to share the corrected, clarified, or amended PHI with such person(s) and with our Business Associates or other that may have relied on the PHI to your detriment.
• Right to accounting of disclosures: Subject to certain limitations, you have the right to a written accounting of disclosures by us of your PHI for not more than six years prior to the date of your request. Your right to an accounting applies to all disclosures except those for treatment, payment, or health care operations; to yourself, to your legal guardian, or persons with Power of Attorney involved in your care; or for notification purposes. Please make your request in writing to our Privacy Contact. We will provide you with one accounting every 12 months free of charge. We will charge a reasonable fee based upon our costs for any subsequent accounting requests.
• Right to Breach Notification: You have a right to receive notice of any breach of your unsecured PHI. Generally, a breach occurs if an unauthorized acquisition, access, use, or disclosure of PHI compromises the security or privacy of such information.

If You Have a Complaint

If you have any questions, concerns or a complaint above about our Notice of Privacy Practices, or about our compliance with state and federal privacy law, please make your complaint in writing to our Compliance Officer. Please write to: Anthony Serrano/Compliance Officer c/o Compliance Department 10 Ragsdale Drive, Suite 101 Monterey, CA 93940

If you believe we are not complying with our legal obligations to protect the privacy of your PHI, you may file a complaint with the Secretary of the U.S. Department of Health and Human Services.

• Send your complaint to: Medical Privacy, Complaint Division, Office for Civil Rights (OCR) US Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington DC, 20201
• You may also contact OCR’s Voice Hotline Number at 1-800-368-1019 or send the information to their Internet address www.hhs.gov/ocr.

Aspire Health Plan will not take any retaliatory action against you if you file a complaint about our privacy practices with us or with the Office for Civil Rights.

If you have any questions or concerns about Aspire Health Plan Notice of Privacy Practices, please contact our Privacy hotline at 1-800-810-0176.

Revision History
Revised February 16, 2026