receive when they first enroll in the group health plan or the Employee Benefit Booklet for a full explanation. Copies of the notice and Employee Benefit Booklet may be obtained from OHR.

HIPAA Privacy Policy for Fully Insured Plan with no Protected Health Information

The KSU Group Health Plan is a fully-insured group health plan sponsored by KSU KSU will comply with the requirements of 45 C.F.R. § 164.530(k) so that the group health plan is not subject to most of HIPAA's privacy requirements:

i. No Access to Protected Health Information (PHI) Except for Summary Health Information for Limited Purposes and Enrollment/Disenrollment Information

Neither the Group Health Plan nor the KSU will create or receive protected health information (PHI) as defined in 45 C.R.F. § 160.103 except for (1) summary health information for purposes of (a) obtaining premium bids or (b) modifying, amending, or terminating the Group Health Plan, and (2) enrollment and disenrollment information.

ii. Insurer for Group Health Plan Will Provide Privacy Notice

The insurer for the Group Health Plan will provide the Group Health Plan’s Notice of Privacy Practices and will satisfy the other requirements under HIPAA related to the Group Health Plan’s PHI. The Notice of Privacy Practices will notify participants of the potential disclosure of summary health information and enrollment/disenrollment information to the Group Health Plan and the University.

iii. No Intimidating or Retaliatory Acts.

The group Health Plan shall not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against individuals for exercising their rights, filing a complaint, participating in an investigation, or opposing any improper practice under HIPAA. If such an action should occur by a KSU employee, the action shall not be attributed to the Group Health Plan.

iv. No Waiver.

The Group Health Plan shall not require an individual to waive his or her privacy rights under HIPAA as a condition of treatment, payment, enrollment or eligibility. If such an action should occur by a KSU employee, the action shall not be attributed to the Group Health Plan.