Skip to Main Content

On Feb. 21, 2024, Change Healthcare experienced a cybersecurity incident. Any individuals impacted by this incident will receive a letter in the mail. Learn more about this from Change Healthcare’s website or reach out to their contact center: 1-866-262-5342.

Notice of Privacy Practices

THIS NOTICE SAYS HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET THIS INFORMATION. PLEASE READ IT CAREFULLY.

Effective 5/2/2024

For help translating or understanding this notice, please call 1-833-404-1061 (TTY: 711).

Covered Entities Duties

Iowa Total Care is a company that helps manage your healthcare. Iowa Total Care must protect your protected health information (PHI) and keep it private. This notice explains how we may use and share your PHI and what your rights are regarding your information.

Iowa Total Care is responsible:

  • To keep your protected health information (PHI) safe.
  • To give you this notice and tell you about how we protect and use your health information.
  • To follow the rules in this notice.
  • To tell you when your PHI has been shared in error or not kept safe.

Iowa Total Care will change this notice when needed. We will make the changed notice effective for your PHI and any received in the future. Iowa Total Care will make these changes quick. We will give you this notice whenever there is a change to:

  • How we use or share your PHI.
  • Your rights.
  • Our legal duties.
  • Other privacy practices within this notice.

We will make any changed notices available.

Internal Protections of Oral, Written and Electronic PHI

Iowa Total Care keeps your PHI safe. We must keep your race, ethnicity, and language (REL), and sexual orientation and gender identity (SOGI) information safe. We have privacy and security processes to help.

To protect your PHI, we:

  • Train our employees to keep your information private.
  • Require our business partners to follow privacy and security processes.
  • Keep our offices safe.
  • Provide your PHI only for business reasons with people who need to know.
  • Keep your PHI safe when we send or store it electronically.
  • Use tools to keep the wrong people from getting your PHI.

Allowable Uses and Releases

The following is a list of how we may use or share your PHI without your approval or release:

  • Treatment.
    • We may share with doctors or hospitals to help them take care of you.
  • Payment.
    • We may use your PHI to pay for the care you receive.
  • Healthcare operations.
    • We may use your PHI to improve our services, handle complaints, and check the quality of your care.

In our healthcare operations, we may share PHI with contracted partners. We will have written agreements to protect the privacy of your PHI with these partners. We may share your PHI with another person or agency that must follow the federal Privacy Rules. They must have a relationship with you. This includes the following:

o  Quality assessment and improvement activities.

o  Reviewing the skill or ability of medical providers.

o  Care management and care coordination.

o  Finding or stopping medical fraud and abuse.

Your race, ethnicity, language, sexual orientation, and gender identity are protected by the health plan’s systems and laws. This means the information you share is private and secure. We can only share this information with health care providers. It will not be shared with others without your approval. We will use this information to help improve the quality of your care and services.

This information helps us to:

o  Better understand your medical needs.

o  Know your language preference when seeing medical providers.

o  Supply medical information that meets your needs.

o  Offer programs to help you be your healthiest.

This information is not used for underwriting purposes or to make decisions about your ability to get coverage
or services.

  • Group health plan/plan sponsor.
    • We may share your PHI with an employer or other group(s) that provide a medical program to you, if they agree to certain limits on how they will use or share the PHI (e.g., agreeing not to use the PHI for employment-related actions or decisions).

Other Allowed or Required Releases

  • Fundraising activities.
    • We may use or share your PHI for fundraising activities (e.g., raising money for a charitable foundation or like groups to help support their activities). If we do contact you for fundraising activities, we will give you the chance to say no, or stop getting such asks in the future.
  • Underwriting purposes.
    • We may use or share your PHI for underwriting purposes, to decide about a coverage application or request. However, we cannot use or share your PHI that is genetic information in the underwriting process.
  • Appointment reminders/treatment alternatives.
    • We may use and share your PHI to remind you of an appointment with us or your doctor. We may use and share your PHI to inform you about treatment options or other benefits and services (e.g., how to stop smoking or
      lose weight).
  • As required by law.
    • We may share your information if required by law.
  • Public health activities.
    • We may share your information to help stop the spread of diseases.
  • Victims of abuse and neglect.
    • If we have a belief that a member is subject to abuse, neglect, or domestic violence we may share your PHI to:
      • Local, state, or federal government authority,
      • Social services, or
      • A protective services agency authorized by law.
  • Judicial and administrative proceedings.
    • We may share your information if ordered by a court.
  • Law enforcement.
    • We may share your relevant PHI with law enforcement when needed for the purposes of responding to a crime.
  • Coroners, medical examiners, and funeral directors.
    • We may share your PHI to a coroner or medical examiner to help decide a cause of death. We may also share your PHI with funeral directors to perform their duties.
  • Organ, eye, and tissue donation.
    • We may share your PHI with organ procurement groups. We may share your PHI with those who work in procurement or transplant of organs, eyes, and tissues.
  • Threats to health and safety.
    • We may use or share your PHI if we believe, in good faith, that the use or sharing is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public.
  • Specialized government functions.
    • We may share your PHI:
      • If you are a member of U.S. Armed Forces, or as required by military command authorities,
      • Authorized federal officials for national security concerns,
      • Intelligence activities,
      • The Department of State for medical suitability determinations,
      • The protection of the President, or
      • Other authorized persons as may be required by law.
  • Workers’ compensation.
    • We may share your PHI to follow laws relating to workers’ compensation or other similar programs, established by law, which supply benefits for work-related injuries or illness without regard to fault.
  • Emergency situations.
    • We may share your PHI in an emergency, or if you are injured or not present, with a family member, friend, authorized disaster relief agency, or any other person earlier named by you.
      • If we decide through our professional judgment and experience, that sharing is in your best interest, we will only share the PHI that is needed for the person's involvement in your care.
  • Inmates.
    • If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may share your PHI:
      • To the correctional institution or law enforcement official,
      • When the institution needs to provide you with medical care,
      • To protect your health or safety, 
      • The health or safety of others, or
      • The safety and security of the correctional institution.
  • Research.
    • We may share your PHI with researchers when their clinical research study has been approved and where certain safety measures are in place to make sure the privacy and protection of your PHI are kept.

Uses and Releases That Require Your Permission

We must obtain your written permission to use or share your PHI, with limited exceptions, for the following reasons:

  • Sale of PHI.
    • We will ask your permission before selling your information to someone else.
  • Marketing.
    • If we want to use your information to sell products or services to you.
  • Psychotherapy notes.
    • If we have notes from your therapy sessions, we need your permission to share them.

You have the right to end your approval, in writing at any time, not including the PHI already used or shared based on that first authorization.

Individuals’ Rights

The following are your rights concerning your PHI. If you would like to use any of the following rights, please contact us using the information at the end of this notice.

  • Right to request restrictions.
    • You can ask us not to share your information in certain situations.
  • Right to request confidential communications. 
    • You can ask us to contact you in a specific way, like only sending mail to your home.
  • Right to access and receive a copy of your PHI. 
    • You can ask to see or get a copy of your health information.
  • Right to correct your PHI.
    • If you think your information is wrong, you can ask us to fix it.
  • Right to receive an accounting of disclosures.
    • You can ask for a list of people or groups we have shared your information with.
  • Right to file a complaint. 
    • If you feel your privacy rights have been violated or that we have violated our own privacy practices, you can file a complaint with us in writing or by phone using the contact information at the end of this notice.

To file a complaint with the Secretary of the U.S. Department of Health and Human Services Office for
Civil Rights:

o  Send a letter,

200 Independence Avenue, S.W.,

Washington, D.C. 20201

o   Call 1-800-368-1019 (TTY: 1-866-788-4989), or

o  Visit www.hhs.gov/ocr/privacy/hipaa/complaints.

WE WILL NOT TAKE ANY ACTION AGAINST YOU FOR FILING A COMPLAINT.

  • Right to receive a copy of this notice.
    • You may ask for a copy of our notice at any time by using the contact information listed below. If you get this notice from our website or by email, you are allowed to request a paper copy of the notice.

Contact Information

If you have questions about this notice, our privacy practices related to your PHI, or how to exercise your rights contact us using the information listed below:

Iowa Total Care 
Attn: Privacy Official 
1080 Jordan Creek Parkway, Suite 400 South
West Des Moines, IA 50266 
1-833-404-1061 (TTY: 711)