This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective Date: This Notice, originally effective April 14, 2003, has been updated to be effective as of January 1, 2026
This Notice is required by a federal law called the Health Insurance Portability and Accountability Act, commonly known as HIPAA.
This Notice applies to all group health plans maintained by CTA Retirement Healthcare Trust that are subject to HIPAA, collectively referred to herein as the “Plan.”
The Plan is required by law to take reasonable steps to ensure the privacy of your personally identifiable health information and to inform you about:
This Notice applies to your PHI used or disclosed by the Plan as well as entities designated as “business associates” of the Plan.
Please share these Notices with your covered family members, as their PHI is also protected under federal law.
The term “Protected Health Information” (PHI) includes all individually identifiable health information related to your past, present or future physical or mental health condition or to payment for health care. PHI includes information maintained by the Plan in oral, written, or electronic form.
Under the law, the Plan may disclose your PHI without your consent or authorization, or the opportunity to agree or object, in the following cases:
Treatment is the provision, coordination, or management of health care and related services. For example, the Plan may disclose PHI to a physician who is treating you.
Payment includes but is not limited to actions to make coverage determinations and payment. For example, the Plan may use PHI to pay claims from your health care provider. If we contract with third parties to help us with payment operations, such as a third-party claims administrator, we will also disclose information to them and they may conduct these activities on our behalf. These third parties are known as “business associates.”
Health care operations includes but is not limited to quality assessment and improvement, underwriting, premium rating and other insurance activities relating to creating or renewing insurance contracts. It also includes disease management, case management, conducting or arranging for medical review, legal services, and auditing functions including fraud and abuse compliance programs, business planning and development, business management and general administrative activities. For example, the Plan or its third-party administrators may use information about your claims to refer you to a disease management program, a well-pregnancy program, project future benefit costs or audit the accuracy of its health care payments.
The Plan will not use your genetic information for underwriting purposes.
The Plan will also disclose PHI to certain individuals who work for the Plan Sponsor for purposes related to treatment, payment, and health care operations, and has amended the Plan Documents to permit this use and disclosure as required by federal law. For example, we may disclose information to certain individuals to allow them to decide appeals of eligibility determinations, negotiate renewals of insurance contracts or audit the accuracy of health care payments.
In addition, the Plan may use or disclose “summary health information” for the purpose of obtaining premium bids or modifying, amending or terminating the group health Plan. Summary information summarizes the claims history, claims expenses or type of claims experienced by individuals for whom the Plan has provided health benefits.
The Plan is allowed under federal law to use and disclose your PHI without your consent or authorization under the following circumstances:
Except as otherwise indicated in this Notice, uses and disclosures will be made only with your written authorization, which you have the right to revoke.
The Plan may contact you to provide you information about treatment alternatives or other health-related benefits and services that may be of interest to you.
Some federal and state laws may require special privacy protections that restrict the use and disclosure of certain sensitive health information such as alcohol and substance use disorder, (including Part 2 Programs); biometric information; child or adult abuse or neglect, including sexual assault; communicable diseases; genetic information; HIV/AIDS; mental health; minors’ information; prescriptions; reproductive health; and sexually transmitted diseases. In such case, the Plan will follow the more stringent or protective law, to the extent that it applies.
Note, information that is disclosed by the Plan in accordance with HIPAA’s Privacy Rule is subject to redisclosure by the recipient and may no longer protected by the Privacy Rule.
When the Plan obtains or receives a valid authorization for its use or disclosure of PHI, such use or disclosure will be consistent with such authorization. If you have authorized us to use or disclose your PHI for a purpose that requires authorization, you may revoke your authorization in writing at any time. If you revoke your authorization, the Plan will no longer be able to use or disclose PHI about you for the reasons covered by your written authorization. However, the Plan will be unable to take back any disclosures it has already made with your permission. Requests to revoke a prior authorization must be submitted in writing to the Privacy Official identified in Section 7. The following situations require your authorization:
The Plan does not routinely obtain psychotherapy notes. However, if it is necessary to use or disclose them, it must obtain your written authorization. The Plan may use and disclose such notes when needed by the Plan to defend itself against litigation filed by you. Psychotherapy notes are separately filed notes about your conversations with your mental health professional during a counseling session. They do not include summary information about your mental health treatment.
The Plan does not engage in the marketing of your PHI. In any event, before the Plan could market your PHI, it would have to obtain your authorization for any use or disclosure of PHI for marketing purposes and disclose whether remuneration will be received. Note face-to-face communications made by the Plan to you and promotional gifts of nominal value provided by the Plan are not considered as marketing.
The Plan does not sell your PHI. In any event, before the Plan could sell your PHI, it would have to obtain your authorization. For this purpose, sale of PHI generally means a disclosure of PHI by the Plan where the Plan directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI, but does not include a disclosure of PHI otherwise permitted by HIPAA.
Substance use disorder treatment records (SUD Records) received from a program covered by 42 CFR Part 2 (a “Part 2 Program”), or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided under law. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD Record is used or disclosed.
If the Plan receives SUD Records about you from a Part 2 Program pursuant to a consent you provided to the Part 2 Program to use and disclose your SUD records for all future purposes of treatment, payment or health care operations, the Plan may use and disclose your SUD records for the purposes of treatment, payment or health care operations, as described above, consistent with such consent until the Plan receives notification that you have revoked such consent in writing. When disclosed to the Plan for treatment, payment, and health care operations activities, the Plan may further disclose those SUD records in accordance with HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against you.
The Plan will not use or disclose your PHI (including, but not limited to SUD Records) for any fundraising activities whether for the benefit of the Plan, or for or on behalf of others. In any event, before the Plan could use your PHI for fundraising, it would have to obtain your written authorization for such use or disclosure, and with respect to SUD Records, give you the opportunity to elect not to receive any fundraising communications.
All requests under this section with respect to information about the Plan should be addressed to the Privacy Official identified in Section 7 below. If a form is required, it will be available from the Privacy Official.
You may request the Plan to:
The Plan, however, is not required to agree to your request if the Plan Administrator or Privacy Official determines it to be unreasonable.
You have the right to ask us to communicate with you using an alternative means or at an alternative location. The Plan will accommodate an individual’s reasonable request to receive communications of PHI by alternative means or at alternative locations where the request includes a statement that disclosure could endanger the individual.
You or your personal representative will be required to complete a form to request restrictions on use and disclosures of your PHI.
You have a right to inspect and obtain a copy of your PHI contained in a “designated record set,” for as long as the Plan maintains the PHI.
The Plan must provide the requested information within 30 days if the information is maintained on site or within 60 days if the information is maintained offsite. A single 30-day extension is allowed if the Plan is unable to comply with the deadline.
You or your personal representative will be required to complete a form to request access to the PHI in your designated record set. A reasonable fee may be charged.
If access is denied, you or your personal representative will be provided with a written denial setting forth the basis for the denial, a description of how you may exercise your review rights and a description of how you may complain to the Plan and HHS.
Designated Record Set: includes enrollment, payment, claims adjudication and other information used to make decisions about payment for care. Information used for quality control or peer review analyses and not used to make decisions about you is not included.
You have the right to request that the Plan amend your PHI or a record about you in a designated record set for as long as the PHI is maintained in the designated record set subject to certain exceptions.
The Plan has 60 days after receiving your request to act on it. The Plan is allowed a single 30 day extension if the Plan is unable to comply with the 60-day deadline. If the Plan denied your request in whole or part, the Plan must provide you with a written denial that explains the basis for the decision. You or your personal representative may then submit a written statement disagreeing with the denial and have that statement included with any future disclosures of that PHI.
You or your personal representative will be required to complete a form to request amendment of the PHI.
At your request, the Plan will also provide you with an accounting of certain disclosures by the Plan of your PHI. We do not have to provide you with an accounting of disclosures related to treatment, payment, or health care operations, or disclosures made to you or authorized by you in writing. The Plan has 60 days to provide the accounting. The Plan is allowed an additional 30 days if the Plan gives you a written statement of the reasons for the delay and the date by which the accounting will be provided.
If you request more than one accounting within a 12-month period, the Plan will charge a reasonable, cost-based fee for each subsequent accounting.
You have the right to obtain a paper copy of this Notice upon request.
You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of authority to act on your behalf before the personal representative will be given access to your PHI or be allowed to take any action for you. Proof of such authority will be a completed, signed and approved Appointment of Personal Representative form or other form acceptable under state or federal law.
The Plan retains discretion to deny access to your PHI to a personal representative to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse, violence, or neglect.
Disclosure of your PHI to family members, other relatives, your close personal friends, and any other person you choose is allowed under federal law if:
The Plan is required by law to maintain the privacy of your PHI and to maintain the privacy of Protected Health Information, to provide individuals with notice of its legal duties and privacy practices, and to notify affected individuals following a breach of unsecured protected health information.
The Plan is required to abide by the terms of the Notice currently in effect.
The Plan reserves the right to change the terms of the Notice and to apply the changes to any PHI received or maintained by the Plan prior to that date. If this Notice is changed, a revised version of this Notice will be provided to you.
If you believe that your privacy rights have been violated, you may obtain additional information or file a complaint with the Plan in care of the following person:
Privacy Official55 W. Monroe Street,
Suite 1950
Chicago, IL 60603
You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services (“HHS”). Please contact the nearest office of the Department of Health and Human Services, listed in your telephone directory, visit the HHS website at www.hhs.gov, or contact the Privacy Official for more information about how to file a complaint.
The Plan will not retaliate against you for filing a complaint.
If you have any questions regarding this Notice or the subjects addressed in it, you may contact the Privacy Official listed in Section 7.
PHI use and disclosure by the Plan is regulated by the federal Health Insurance Portability and Accountability Act, known as HIPAA. You may find these rules at 45 Code of Federal Regulations Parts 160 and 164. This Notice attempts to summarize the regulations. The regulations will supersede this Notice if there is any discrepancy between the information in this notice and the regulations.
Some of the provisions of the Plan were changed due to the passage of State legislation earlier in the year. The Plan Text is being updated to reflect these changes.
There may be portions of the website or forms within the website that have not yet been changed to reflect the legislation. The legislation and the most current collective bargaining agreement supersede any old language on the website.
For the most current information regarding your benefits, please contact the Retirement Plan at (312) 441-9694 or at questions@ctapension.com.