MyHNE
HNEDirect
Health New England (HNE) knows how important it is to protect your privacy at all times and in all settings. This Notice of Privacy Practices describes how HNE may collect, use and disclose your protected health information, and your rights concerning your protected health information. “Protected health information” or “PHI” is information about you, including demographic information such as Race, Ethnicity, Language, Disability (RELD), Sexual Orientation and/or Gender Identity (SOGI) data, that can reasonably be used to identify you, and that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the payment for that care.
State and federal law require us to maintain the privacy of your protected health information. This includes protecting all of your information whether it is oral, written or in electronic format. The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) also requires us to provide you this notice about our legal duties and privacy practices.
This Notice takes effect September 1, 2025. We must follow the privacy practices described in this Notice while it is in effect. We may change the terms of this Notice at any time in the future and make the new Notice effective for all PHI that we maintain. This Notice replaces any other information you have previously received from us with respect to your PHI. Whenever we make an important change, we will publish the updated Notice on this page. We will inform subscribers whenever we make a material change to the privacy practices described in this notice in one of our periodic mailings.
How does HNE protect my personal health information?
HNE has a detailed policy on confidentiality. All HNE employees are required to protect the confidentiality of your PHI. An employee may only access your information when they have an appropriate reason to do so. Each employee or temporary employee must sign a statement that he or she has read and understands the policy. On an annual basis, HNE will send a notice to employees to remind them of this policy. Any employee who violates the policy is subject to discipline, up to and including dismissal. If you would like a copy of HNE’s Policy on Confidentiality, you may request a copy from HNE Member Services. In addition, HNE includes confidentiality provisions in all of its contracts with plan providers. HNE also maintains physical, electronic, and procedural safeguards to protect your information.
How does HNE use or share your health Information?
HNE and its affiliated entities participates in an organized health care arrangement (OHCA) and Accountable Care Organizations (ACOs), such as the Pioneer Valley Accountable Care ACO and the Be Healthy Partnership ACO.HNE providers and other participants in these OHCAs and ACOs, will share your medical information among themselves, for treatment, payment, and operations related to the OHCA or ACO.
How does HNE collect protected health information?
HNE gets PHI from:
• Attorneys who are representing our members in automobile accidents or other cases.
• Insurers and other health plans.
How does HNE use and disclose my protected health information?
HIPAA and other laws allow or require us to use or disclose your PHI for many different reasons. We can use or disclose your PHI for some reasons without your written agreement. For other reasons, we need you to agree in writing that we can use or disclose your PHI. providers and other health plans that have a relationship with you, for their treatment, payment and some limited health care operations.
Uses and Disclosures for Treatment, Payment and Health Care Operations: HNE uses and discloses protected health information in a number of different ways in connection with your treatment, the payment for your health care, and our health care operations. We can also disclose your information to providers and other health plans that have a relationship with you, for their treatment, payment and some limited health care operations. For more information, see: https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html.
The following are only a few examples of the types of uses and disclosures of your protected health information that we are permitted to make without your authorization for these purposes:
Treatment: We may disclose your protected health information to health care providers (doctors, dentists, pharmacies, hospitals and other caregivers) who request it in connection with your treatment. We may also disclose your protected health information to health care providers (including their employees or business associates) in connection with preventive health, early detection and disease and case management programs. Payment: We will use and disclose your protected health information to administer your health benefits policy or contract, which may involve:
• Determining your eligibility for benefits;
• Paying claims for services you receive;
• Making medical necessity determinations;
• Coordinating your care, benefits or other services;
• Coordinating your HNE coverage with that of other plans (if you have coverage through more than one plan) to make sure that the services are not paid twice;
• Responding to complaints, appeals and external review requests;
• Obtaining premiums, underwriting, ratemaking and determining cost sharing amounts; and
• Disclosing information to providers for their payment purposes.
Health Care Operations: When we collect Race, Ethnicity, Language, Sexual Orientation, and Gender Identity data, it will not be used for underwriting purposes or denial of coverage or benefits. We will use and disclose your protected health information to support HNE’s other business activities, including the following:
• Conducting quality assessment activities, or for the quality assessment activities of providers and other health plans that have a relationship with you;
• Developing clinical guidelines;
• Reviewing the competence or qualifications of providers that treat our members;
• Evaluating our providers’ performance as well as our own performance;
• Obtaining accreditation by independent organizations such as the National Committee for Quality Assurance;
• Maintaining state licenses and accreditations;
• Conducting or arranging for medical review, legal services and auditing functions including fraud and abuse detection and compliance programs;
• Business planning and development, including the development of HNE’s drug formulary;
• Operation of preventive health, early detection and disease and case management and coordination of care programs, including contacting you or your doctors to provide appointment reminders or information about treatment alternatives, therapies, health care providers, settings of care or other health-related benefits and services;
• Reinsurance activities; and
• Other general administrative activities, including data and information systems management and customer service.
Health Information Exchanges: We participate in secure health information exchanges (“HIEs”), such as those operated by Pioneer Valley Information Exchange and the Massachusetts statewide HIE (“Mass HIway”). HIEs help coordinate patient care efficiently by allowing health care providers involved in your care to share health information with each other in a secure and timely manner. Your health information will be accessed, used and disclosed via the HIEs in which Health New England participates for purposes of treatment, payment and health care operations.
Other Permitted or Required Uses and Disclosures of Protected Health Information: In addition to treatment, payment and health care operations, federal law allows or requires us to use or disclose your protected health information in the following additional situations without your authorization:
Abuse or Neglect: We may make disclosures to government authorities if we believe you have been a victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when we are required or authorized by law to do so.
Required by Law: We may use or disclose your protected health information to the extent we are required to do so by state or federal law. For example, the HIPAA law compels us to disclose PHI when required by the Secretary of the Department of Health and Human Services to investigate our compliance efforts.
Coroners, Funeral Directors and Organ Donation: We may disclose your protected health information in certain instances to coroners, funeral directors and organizations that help find organs, eyes, and tissue to be donated or transplanted.
Correctional Institutions: If you are an inmate in a correctional facility, we may disclose your protected health information to the correctional facility for certain purposes, including the provision of health care to you or the health and safety of you or others.
Health Oversight: We may disclose your protected health information to a government agency authorized to oversee the health care system or government programs, or its contractors (e.g., state insurance department, U.S. Department of Labor) for activities authorized by law, such as audits, examinations, investigations, inspections and licensure activity.
Law Enforcement: We may disclose your protected health information under limited circumstances to law enforcement officials. For example, disclosures may be made in response to a warrant or subpoena or for the purpose of identifying or locating a suspect, witness or missing persons or to provide information concerning victims of crimes.
Legal Proceedings: We may disclose your protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal and, in certain cases, in response to a subpoena, discovery request or other lawful process.
Military Activity and National Security: We may disclose your protected health information to Armed Forces personnel under certain circumstances and to authorized federal officials for the conduct of national security and intelligence activities.
Public Health Activities: We may disclose your protected health information to an authorized public health authority for purposes of public health activities. The information may be disclosed for such reasons as controlling disease, injury or disability. We also may have to disclose your PHI to a person who may have been exposed to a communicable disease or who may otherwise be at risk of contracting or spreading the disease. In addition, we may make disclosures to a person subject to the jurisdiction of the Food and Drug Administration, for the purpose of activities related to the quality, safety or effectiveness of an FDA-regulated product or activity.
Research: We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.
Threat to Health or Safety: If we believe that a serious threat exists to your health or safety, or to the health and safety of any other person or the public, we will notify those persons we believe would be able to help prevent or reduce the threat. Workers’ Compensation: We may disclose your protected health information to the extent required by workers’ compensation laws.
Other Uses and Disclosures (Requires Written Authorization): For all other uses or disclosures not described above, HNE will always obtain your written authorization prior to conducting these activities.
Disclosure of “Highly Confidential” PHI: Certain kinds of PHI are deemed as “highly confidential” due to the sensitivity of the information. For example:
Additional protection might be added for these kinds of PHI as required by state and federal law. HNE will only disclose “highly confidential” PHI only when we have obtained prior written authorization from you unless otherwise required by law.
Reproductive Health Care Information: We are prohibited from using or disclosing your reproductive health care information for any of the following purposes:
Furthermore, we will not use or disclose PHI for the following purposes:
If we receive a request for your reproductive health care information, the requestor will be required to sign an attestation in certain scenarios to confirm they will not use your information for a non-permitted purpose. For example, we will require the requestor to sign an attestation if the request is related to health oversight activities or law enforcement purposes. The Attestation Regarding Use or Disclosure of Reproductive Health Care PHI can be found on Health New England’s website at https://healthnewengland.org/forms.
Substance Use Disorder Records Privacy (42 CFR Part 2): We provide additional protection for Substance Use Disorder (SUD) records in accordance with 42 CFR Part 2. These records are specially protected and require your written consent for most uses and disclosures. Once consent is given, your SUD records may be redisclosed in accordance with HIPAA, unless otherwise restricted. You have the right to revoke your consent at any time. Revocation must be submitted in writing and will not affect any disclosures made prior to the revocation. Additionally, de-identified SUD data may be disclosed to public health authorities without your consent, following HIPAA de-identification standards.
Will HNE give my PHI to my family or friends?
We will only disclose your PHI to a member of your family (including your spouse), a relative, or a close friend in the following circumstances:
• You have authorized us to do.
• That person has submitted proof of legal authority to act on your behalf.
• That person is involved in your health care or payment for your health care and needs your PHI for these purposes. If you are present for such a disclosure (whether in person or on a telephone call), we will either seek your verbal agreement to the disclosure or provide you an opportunity to object to it. We will only release the PHI that is directly relevant to their involvement.
• We may share your PHI with your friends or family members if professional judgment says that doing so is in your best interest. We will only do this if you are not present or you are unable to make health care decisions for yourself. For example, if you are unconscious and a friend is with you, we may share your PHI with your friend so you can receive care.
• We may disclose a minor child’s PHI to their parent or guardian. However, we may be required to deny a parent’s access to a minor’s PHI, for example, if the minor is an emancipated minor or can, under law, consent to their own health care treatment.
Will HNE disclose my personal health information to anyone outside of HNE?
HNE may share your protected health information with affiliates and third party “business associates” that perform various activities for us or on our behalf. For example, HNE may delegate certain functions, such as medical management or claims repricing, to a third party that is not affiliated with HNE.
HNE may also share your personal health information with an individual or company that is working as a contractor or consultant for HNE. HNE’s financial auditors may review claims or other confidential data in connection with their services. A contractor or consultant may have access to such data when they repair or maintain HNE’s computer systems. Whenever such an arrangement involves the use or disclosure of your protected health information, we will have a written contract that contains terms designed to protect the privacy of your protected health information.
HNE may also disclose information about you to your Primary Care Physician, other providers that treat you and other health plans that have a relationship with you, for their treatment, payment and some of their health care operations.
Will HNE disclose my personal health information to my employer?
In general, HNE will only release to your employer enrollment and disenrollment information, information that has been de-identified so that your employer can not identify you or summary health information. If your employer would like more specific PHI about you to perform plan administration functions, we will either get your written permission or we will ask your employer to certify that they have established procedures in their group health plan for protecting your PHI, and they agree that they will not use or disclose the information for employment-related actions and decisions. Talk to your employer to get more details. When does HNE need my written authorization to use or disclose my personal health information?
We have described in the preceding paragraphs those uses and disclosures of your information that we may make either as permitted or required by law or otherwise without your written authorization. For other uses and disclosures of your medical information, we must obtain your written authorization. A written authorization request will, among other things, specify the purpose of the requested disclosure, the persons or class of persons to whom the information may be given, and an expiration date for the authorization. If you do provide a written authorization, you generally have the right to revoke it. Many members ask us to disclose their protected health information to third parties for reasons not described in this notice. For example, elderly members often ask us to make their records available to caregivers. To authorize us to disclose any of your protected health information to a person or organization for reasons other than those described in this notice, please call our Member Services Department and ask for an Authorization of Personal Representative Form, which can also be found on Health New England website Forms page.
You should return the completed form to HNE’s Enrollment Department at One Monarch Place, Suite 1500, Springfield, MA 01144. You may revoke the authorization at any time by sending us a letter to the same address. Please include your name, address, member identification number and a telephone number where we can reach you.
What are my rights with respect to my PHI?
The following is a brief statement of your rights with respect to your protected health information:
Right to Request Restrictions: You have the right to ask us to place restrictions on the way we use or disclose your protected health information for treatment, payment or health care operations or to others involved in your health care. However, we are not required to agree to these restrictions. If we do agree to a restriction, we may not use or disclose your protected health information in violation of that restriction, unless it is needed for an emergency.
Right to Request Confidential Communications: You have the right to request to receive communications of protected health information from us by alternative means or at alternative locations if you clearly state that the disclosure of all or part of that information could endanger you. We will accommodate reasonable requests. Your request must be in writing.
Right to Access Your Protected Health Information: You have the right to see and get a copy of the protected health information about you that is contained in a “designated record set,” with some specified exceptions. Your “designated record set” includes enrollment, payment, claims adjudication, case or medical management records and any other records that we use to make decisions about you. Requests for access to copies of your records must be in writing and sent to the attention of the HNE Legal Department. Please provide us with the specific information we need to fulfill your request. We reserve the right to charge a reasonable fee for the cost of producing and mailing the copies. Right to Amend Your Protected Health Information: You have the right to ask us to amend any protected health information about you that is contained in a “designated record set” (see above). All requests for amendment must be in writing and on a HNE Request for Amendment form. Please contact the HNE Legal Department to obtain a copy of the form. You also must provide a reason to support the requested amendment. In certain cases, we may deny your request. For example, we may deny a request if we did not create the information, as is often the case for medical information in our records. All denials will be made in writing. You may respond by filing a written statement of disagreement with us, and we would have the right to rebut that statement. If you believe someone has received the unamended protected health information from us, you should inform us at the time of the request if you want them to be informed of the amendment. Right to Request a List (accounting) of Certain Disclosures: You have the right to request an account of the times we have shared your health information. This accounting requirement applies for six years from the date of the disclosure, beginning with disclosures occurring after April 14, 2003. HNE will provide an accounting for all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). If you request this accounting more than once in a 12-month period, we may charge you a reasonable fee. Right to a Notice in the event of a Breach: In the event of a data breach, you have the right to receive notice regarding the incident.
Right to Request a Copy of this Notice: If you have received this notice electronically, you have the right to obtain a paper copy of this notice upon request.
Who should I contact if I have a question about this notice or a complaint about how HNE is using my personal health information?
To exercise your rights under this Notice or to file a complaint with HNE, please call us at (413) 787-4004, toll-free at (800) 310-2835 (TTY: 711) or write to:
Privacy Officer - Compliance Department
Health New England
One Monarch Place, Suite 1500
Springfield, MA 01144-1500
Complaints to the Federal Government: If you believe your privacy rights have been violated, you also have the right to file a complaint with the Secretary of the Department of Health and Human Services by calling 1-877-696-6775 or visit their website at: https://www.hhs.gov/ocr/complaints/index.html.
You will not be retaliated against for filing a complaint with Health New England or the federal government.
View Health New England's full Compliance Program Description and Code of Conduct here.
Last revised: 9/1/2025