UMP notice of privacy practices

Effective November 1, 2025
This notice describes how medical information about you may be used and disclosed (shared) and how you can get access to this information. Please review it carefully.

Why am I getting this notice?

The Washington State Health Care Authority (HCA) and Uniform Medical Plan (UMP) are committed to protecting your health information. The law requires UMP to provide this notice to all UMP subscribers so you know how UMP may use or disclose your information. This notice does not affect your eligibility for services or coverage.

What does UMP do with my information?

The law requires UMP to keep your information confidential (private). Other than as explained in this notice, UMP does not disclose your information to anyone outside UMP, its administrators, and your providers.

When UMP does disclose information, it usually provides only the minimum information necessary. Employees and contractors who violate confidentiality standards can be punished and even dismissed.

In what situations can UMP use and disclose my information without my permission?

Treatment

This includes care provided to you and the coordination or management of your care. For example, UMP might disclose information to alert your health care provider to possible problems in your care.

Payment

This includes meeting UMP’s obligations to cover or provide benefits for your care. It also includes collecting premiums and other amounts due. For example, when UMP pays a provider, UMP usually specifies the treatment for which it is paying. Or, if a provider wants to discuss the amount paid, UMP may need to use and disclose your information. Another example would be exchanging information with a person or company that may be responsible for paying your medical expenses, such as another plan.

Health care operations

This refers to what UMP does to keep the plan operating, including:

• Quality control
• Medical and legal reviews
• Working with auditors and examiners
• Compliance reviews
• Using protected health information to create data sets that do not have individual members’ identifiable information

For example, UMP discloses information to business associates that handle claims processing and customer service, such as its plan administrator, pharmacy benefit manager, and contractors working on subrogation (third-party debt collection). These business associates also must protect your privacy. If they disclose to subcontractors of their own, those subcontractors must also protect your privacy.

Health benefits and services

UMP may use or disclose your personal information for purposes related to health benefits and services, such as to:

• You, about treatment alternatives or health-related benefits or services.
• Vendors hired to assist in contacting you.
• Contractors hired to provide services, and contractors hired by those contractors, regarding services such as:
  • Disease management
  • Case management
  • Health assessment
  • Evaluating your prescription drug use
  • Conferring with you or your providers about these programs or other services
• An Independent Review Organization (IRO; also called an external review organization) that reviews your appeal at your request. To learn more about appeals, including what you can appeal, read the “Complaint and appeal procedures” section in your plan’s certificate of coverage (COC). 

To HCA

HCA is the state agency designated by the state of Washington to create health plans for state employees, school employees, and other eligible persons. UMP is a self-insured health plan that HCA sponsors. As the plan sponsor, HCA may receive information about your participation in UMP, including whether you have enrolled or disenrolled, and a summary of your claims history.

HCA may also receive health information to fulfill administrative functions that HCA provides for UMP. To fulfill administrative functions, HCA may use or disclose information as described in this notice. However, HCA will not:

• Further use or disclose your health information other than as permitted or required by the plan documents or as required by law.
• Use or disclose the information for employment-related actions or decisions.
• Use or disclose the information in connection with any other employee benefit or benefit plan.

HCA has implemented administrative, physical, and technical safeguards that reasonably and appropriately protect your health information. It has created security measures that make sure your health information is only used by appropriate HCA employees working on UMP administrative functions.

Other situations where UMP might disclose your information without your permission

UMP may disclose your information:

• When UMP believes the law requires it, such as when responding to a subpoena or summons.
• To public health and social service agencies (such as the Washington State Department of Health; the Washington State Department of Social and Health Services; and the Washington State Department of Children, Youth, and Families) as provided by state and federal laws for reasons such as
  • Preventing or controlling disease.
  • Reporting births or deaths.
  • Reporting abuse or neglect.
  • Reporting problems with medicines or products to the U.S. Food and Drug Administration.
  • Notifying you if a product you are using is recalled.
  • Giving notice of exposure to a disease or condition that is a health risk.
• For oversight activities authorized (allowed) by law. Examples of these activities include audits, examinations, inspections, investigations, and licensing health professionals.
• When authorized or required to do so in the course of lawsuits or administrative hearings.
• To UMP’s and HCA’s attorneys for purposes of legal advice or litigation.
• To law enforcement officials.
• After your death, to a coroner, funeral director, or organ transplant organization.
• Fifty years after your death, when your information is no longer protected.
• In connection with certain research projects when your privacy is protected.
• If necessary to avert a serious and imminent threat to your, or someone else’s, health or safety, or to permit law enforcement authorities to identify or apprehend an individual.
• To an authorized government agency if UMP thinks you might be a victim of abuse, neglect, or domestic violence.
• To military authorities, in some situations, if you are armed forces personnel or a veteran.
• To an authorized federal official or other authorized persons for purposes of national security, for providing protection to the President or others, or to conduct special investigations, as authorized by law.
• To other government agencies to help determine your eligibility for benefits or services.
• To entities for accreditation, certification, or review of a UMP operation or program.
• To a subscriber (if the information relates to dependents enrolled on the account) to explain payments, benefits, deductibles, and other matters relating to payment.
• To the Secretary of the U.S. Department of Health and Human Services, or a designee, as needed to comply with regulations.
• To state or federal agencies and programs, where the law permits or requires it.
• To your parent or guardian, or someone else with a similar role, if you are under 18 years old. There are some exceptions to this disclosure.
  • UMP will not give information to a parent or guardian:
    • If you are older than 13, and the information relates to abortions, birth control, and prenatal care.
    • If you are 13 years old or older, and the information is about mental health and outpatient substance use disorder treatment.
    • If you are 14 years old or older, and the information is about sexually transmitted infections.
  • In all these cases, however, UMP will disclose to a parent or guardian if you authorize it or if the law requires it.
• To a family member or friend involved in your care, if you consent or do not object.
• To a family member or friend (if you cannot authorize disclosure, such as in some medical emergencies) if UMP thinks it is in your best interest.
• To the Department of Retirement Systems (DRS), if you are a retiree receiving benefits from DRS, so DRS can better serve you.

Are there specially protected types of information?

Yes, some types of information have greater protection under Washington State or federal laws. The above disclosure practices do not necessarily apply to specially protected types of information, which include:

• Confidential HIV-related information protected by Washington State laws.
• Alcohol and substance use disorder treatment information protected under both Washington State and federal laws.
• Mental health treatment information protected under both Washington State and federal laws.

When might I need to approve a disclosure?

Unless the law requires it, UMP will not make any use or disclosure of your information other than the uses listed in this notice unless you authorize it.

You may be asked to sign an authorization form allowing your information to be shared if any of the following apply:

• UMP needs to send information to other places not covered by the descriptions above.
• You want UMP to send information to an agency or provider.
• You want information sent to another person, such as an attorney or relative.

Your authorization is effective until the expiration time you choose. UMP will share only the information you list. If you do authorize a use or disclosure, you can revoke (take back) that authorization later. Your revocation does not affect any use or disclosure already made before UMP received your revocation. Your legally authorized personal representative may act on your behalf. UMP would treat a disclosure to your legally authorized personal representative as a disclosure to you.

What are my rights?

Although the below sections only refer to UMP, you may exercise your rights to access and control information held by HCA to the same extent.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

Request restrictions (limit disclosures)

You may ask UMP to restrict its use and disclosure of your personal information for treatment, payment, and health care operations and to restrict disclosures to persons you identify. UMP will consider your request but, in most cases, it is not required to agree to your request. If UMP does agree, it will abide by the agreement except in an emergency.

Inspect and copy

You may review the personal information UMP has about you by asking, in writing, for access to it or a copy of it. If you make your request to HCA and have records in more than one part of HCA — such as if you were previously enrolled in HCA’s Apple Health (Medicaid) program — you need to identify which records you want to see.

UMP may charge a fee for copies. In many situations, UMP will provide the copies in electronic format upon request.

The information you may review and copy does not include:

• Psychotherapy notes.
• Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
• Information that UMP cannot legally disclose to you.
• Information received from someone other than a health care provider under a promise of confidentiality if the access requested would be reasonably likely to reveal the source of the information.
• Information that a licensed health care professional or UMP determines should not be disclosed to you because it might harm you or someone else.

Except for the exclusions listed above, here are the records you may review and copy:

• Enrollment, payment, claims adjudication, and case or medical management records maintained by or for UMP.
• Other records UMP uses to make decisions about you.

Amend (add to or correct)

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will consider all reasonable
requests and must say “yes” if you tell us you would be in danger if we do not.

UMP is not necessarily required to make the changes you request. For example, UMP is not required to change information that it did not create or information that is correct. If UMP does not make the change you request, it will tell you why. If UMP does make the changes, it will make a reasonable effort to inform others to whom it gave the information or others you tell UMP received the information.

These are the records that you may ask UMP to amend:

• Enrollment, payment, claims adjudication, and case or medical management records maintained by or for UMP.
• Other records UMP uses to make decisions about you.

Accounting of disclosures

You may ask for a list of entities to whom UMP has disclosed your information. The list will not include all disclosures. For example, the list will not include:

• Disclosures for treatment, payment, and health care operations.
• Disclosures to you or with your authorization.
• Disclosures made more than six years before your request.

UMP will respond to you within 60 days of your request. If you ask for more than one accounting in any 12-month period, UMP may charge you a reasonable fee.

Sending by alternative means or to an alternative location

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will consider all reasonable
requests and must say “yes” if you tell us you would be in danger if we do not.

Get a paper copy of this notice

You may request a paper copy of this notice by calling UMP Customer Service:

• Public Employees Benefits Board (PEBB) members: 1-888-849-3681 (TRS: 711)
• School Employees Benefits Board (SEBB) members: 1-800-628-3481 (TRS: 711)

Notice of breach

UMP will notify you if there is a breach of your confidential information.

For questions or complaints

If you believe your privacy rights have been violated or you have questions, contact the HCA privacy officer by calling 1-844-284-2149 (toll-free) or writing to:

Privacy Officer
Health Care Authority
PO Box 42704
Olympia, WA 98504-2704

If you prefer, you may contact the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Changes and availability

UMP reserves the right to change its privacy practices at any time and apply the changes to information it created or received before it made the changes. If UMP changes its privacy practices, the new Notice of Privacy Practices will be posted on the HCA website, and UMP will inform you in the next annual mailing (or earlier). At any given time, UMP will comply with the notice that is currently in effect.