Notice of Privacy Practices
Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Mally Financial Services ("we," "us," or "our") is a licensed independent insurance agency and broker headquartered in Stony Brook, New York. We provide health insurance brokerage, advisory, and administrative assistance services. In the course of these services, we may create, receive, maintain, or transmit Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA").
Depending on the specific relationship, Mally Financial Services may act as a Business Associate of a covered health plan, insurance carrier, or plan sponsor, or, in limited circumstances, as a Covered Entity. This Notice of Privacy Practices describes how we may use and disclose your PHI and your rights with respect to that information.
1. Our Duties Regarding Your Protected Health Information
We are required by law to:
- Maintain the privacy and security of your PHI.
- Provide you with this Notice of our legal duties and privacy practices with respect to PHI.
- Notify you following a breach of unsecured PHI as required by the HIPAA Breach Notification Rule.
- Follow the terms of this Notice that are currently in effect.
- Obtain your written authorization for uses and disclosures of PHI not otherwise permitted or required by law.
2. How We May Use and Disclose Your Protected Health Information
We may use or disclose your PHI for the following purposes without your written authorization, as permitted or required by HIPAA and other applicable law:
Treatment, Payment, and Health Care Operations
Although Mally Financial Services is primarily an insurance intermediary and not a health care provider, we may use or disclose PHI as necessary to facilitate enrollment, eligibility determinations, premium billing, claims coordination, and related administrative functions on behalf of health plans or carriers. We may also use PHI for our own health care operations, including quality assessment, training, auditing, legal services, and business management.
Insurance and Benefits Administration
We may use and disclose PHI to evaluate eligibility, process applications, obtain quotes, submit enrollment information to carriers, assist with claims inquiries, coordinate benefits, and perform other functions necessary to administer or service health insurance coverage.
Business Associates and Service Providers
We may disclose PHI to third-party service providers (such as technology vendors, claims administrators, or professional advisors) who perform services on our behalf, provided they have agreed in writing (including through Business Associate Agreements where required) to protect the information in accordance with HIPAA.
As Required by Law
We may use or disclose PHI when required by federal, state, or local law, including disclosures to the U.S. Department of Health and Human Services (HHS) for compliance investigations or reviews.
Public Health, Safety, and Other Legal Disclosures
We may disclose PHI for public health activities, to prevent or lessen a serious and imminent threat to health or safety, in response to court orders or subpoenas, for workers’ compensation purposes, to coroners or medical examiners, or as otherwise authorized by HIPAA.
Health Plan Sponsor / Employer Group Plans
If you are enrolled in a group health plan, we may disclose certain PHI to the plan sponsor or employer for plan administration purposes, consistent with the plan documents and applicable law.
Authorizations
Uses and disclosures not described in this Notice or not otherwise permitted by law will be made only with your written authorization. You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance on it.
3. Your Rights Regarding Your Protected Health Information
You have the following rights with respect to your PHI that we maintain:
Right to Access and Copy
You may request to inspect or obtain a copy of your PHI that we maintain in a designated record set. We may charge a reasonable, cost-based fee for copies. If denied in limited circumstances, we will provide a written explanation.
Right to Request Amendment
You may request that we amend PHI that you believe is incorrect or incomplete. Your request must be in writing and include a reason.
Right to an Accounting of Disclosures
You may request a list of certain disclosures of your PHI that we have made for a period of up to six years prior to the date of your request (excluding treatment, payment, or operations).
Right to Request Restrictions
You may request that we restrict certain uses or disclosures of your PHI. We must agree if the item/service was paid out-of-pocket in full and disclosure is not required by law.
Right to Request Confidential Communications
You may request that we communicate with you about your PHI by alternative means or at alternative locations. We will accommodate reasonable requests.
Right to Paper Copy & Breach Notice
You may request a paper copy of this Notice at any time. You have the statutory right to be notified if a breach of your unsecured PHI occurs under the HIPAA Breach Notification Rule.
4. Changes to This Notice
We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we maintain. If we make a material change, we will post the revised Notice on our website (www.mallyfinancial.com) and make it available upon request.
5. Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services (Office for Civil Rights). We will not retaliate against you for filing a complaint.
To file a complaint with HHS, visit: https://www.hhs.gov/hipaa/filing-a-complaint or contact the Office for Civil Rights regional office that serves your area.
6. Contact Information — Privacy Officer
If you have questions about this Notice, wish to exercise any of your rights, or need to file a complaint, please contact our Privacy Officer:
Mally Financial Services — Attn: Privacy Officer / Chris Mally
4 Olympia Ln, Stony Brook, NY 11790
Phone: (631) 928-4496 | Email: chris@mallyfinancial.com
Website: www.mallyfinancial.com
7. Important Additional Information
This Notice applies to Protected Health Information that Mally Financial Services creates, receives, maintains, or transmits in connection with its health insurance brokerage and related services. It does not replace the terms of any insurance policy, plan document, or Summary of Benefits and Coverage. Specific coverage terms, eligibility rules, and benefits are governed by the applicable carrier’s policy documents.
This Notice is provided in addition to our general website Privacy Policy. Where HIPAA imposes stricter requirements regarding PHI, those requirements control.
Mally Financial Services — Compliance & Privacy Office
Attn: Privacy Officer / Chris Mally • Independent Insurance Agency
Stony Brook, NY 11790