Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation that focuses on the portability, privacy and security of the participant and participant's dependent's health information.

HIPAA protects the participant and participant’s dependents by:

Limiting exclusions for pre-existing medical conditions;
Providing credit against maximum pre-existing condition exclusion periods for prior health coverage and a process for providing certificates showing periods of prior coverage to a new group health plan or health insurance issuer;
Providing new rights that allow individuals to enroll for health coverage when they lose other health coverage, get married, or add a new dependent;
Prohibiting discrimination in enrollment and in premiums charged to employees and their dependents based on health status-related factors; and
Ensuring the privacy of the participant's protected health information (PHI)

Disclosure of Protected Information

The confidentiality of the participant's health information is important. Leidos is required to maintain the confidentiality of the participant's information and has policies and procedures and other safeguards to help protect the participant's information from improper use and disclosure.

Leidos is allowed by law to use and disclose certain information without the participant's written permission. For example, Leidos may share information with the participant's health care provider to determine whether he or she is enrolled in the Plan or whether premiums have been paid on the participant's behalf. Leidos may also share the participant's information when legally required to do so — for example, in response to a subpoena or if the participant's medical safety may be at risk.

When the participant's authorization is required and the participant authorizes Leidos to use or disclose personal information for some purpose, the participant may revoke that authorization by notifying Leidos in writing at any time.

The participant's health care provider must have a Notice of Privacy Practices and provide the participant with a copy. For more information, contact Leidos Corporate Benefits.

To the extent required by the Standards for Privacy of Individually Identifiable Health Information and Security Standards, 45 C.F.R. Parts 160 through 164, as updated by the HITECH Act and various regulations and guidance (HIPAA Privacy & Security Rules), the Plan will comply with any restrictions, prohibitions, and attestation requirements related to reproductive health care information as required under 89 Federal Register 32976 (April 26, 2024) (HIPAA Privacy Rule To Support Reproductive Health Care Privacy).

Adding New Dependents

Under HIPAA, the participant has 31 days following marriage or the birth, adoption, or placement for adoption of a child to enroll a dependent in the health plans. The participant does not have to provide any medical or health information to enroll a dependent.

Continuing Coverage

For certain component benefit programs, in the event Plan coverage for that component benefit terminates, participants or their family member(s) may be eligible to continue the coverage for a period of time. Eligibility for such coverage (as well as the length of such coverage) will vary depending on the situation that renders you eligible, as well as the type of continuation coverage you are eligible for. There are several types of continuation coverage that may apply to particular component benefit programs, two of which are summarized below.

Consolidated Omnibus Budget Reconciliation Act (COBRA)

In accordance with the COBRA, if coverage under the Plan terminates due to the events listed below, a participant and the participant's covered dependents may be eligible to continue coverage at their own expense for a limited period. This section describes coverage continuation rights under federal law. Some state laws may offer additional COBRA benefits. For more information, review the Plan's Evidence of Coverage booklet.

In order to be eligible for continuation coverage under COBRA, you must meet the definition of a Qualified Beneficiary. A Qualified Beneficiary is any of the following persons who were covered under the Plan on the day before a qualifying event:

The covered employee
The employee’s dependent child
The employee’s spouse

Federal law also enables a participant's dependents to continue health insurance if their coverage ends due to a qualifying event. The participant must elect coverage according to the rules of the Leidos Plans. Under the Plan, Qualified Beneficiaries who elect COBRA continuation coverage must pay the Plan's full cost of providing continued coverage, plus an additional 2% administrative fee (totaling 102% of the premium). Continuation is subject to federal law, regulations, and interpretations.

Who is Eligible for COBRA

A participant, their spouse, or their dependent child, may become a Qualified Beneficiary and be eligible for continuation coverage under COBRA if they lose coverage under the Plan because of certain qualifying events, outlined below.

A covered participant who loses coverage due to termination of employment (other than termination for gross misconduct) or reduction in work hours. Termination of employment includes, but it not limited to, voluntarily quitting, layoff, and lack of work due to a work location closure.
The spouse and/or dependent children of a covered participant who are covered under the Plan and who lose coverage as a result of any of the following qualifying events**:
- The death of a covered employee;
- The termination of a covered employee (excluding termination due to gross misconduct);
- The divorce or legal separation of the covered employee from his or her spouse;
- A dependent's ceasing to qualify as a dependent child under the terms of the Plan; or
- The covered employee becomes entitled to Medicare benefits.

Notification Requirements

If the qualifying event is a reduction in the covered employees hours, termination of their employment, or eligibility for Medicare benefits, the employer must notify the plan administrator of the qualifying event.

Otherwise, it is the Qualifying Beneficiary’s responsibility to notify Employee Services within 31 days after the later of (1) the date of the qualifying event; and (2) the date on which the Qualified Beneficiary loses (or would lose) coverage under the terms of the Plan as a result of the qualifying event, when the qualifying event is a divorce, legal separation, or child's losing dependent status.

If the Qualifying Beneficiaries fail to notify the plan administrator of these events within the 31-day period, the affected Qualified Beneficiary will lose the opportunity to continue coverage under COBRA. If a participant is continuing coverage under COBRA, they must notify the COBRA administrator within 60 days of the birth or adoption of a child.

Applying for COBRA Coverage

If a participant wants to continue coverage, they can elect COBRA online or mail their election directly to the COBRA administrator. Information to enroll will be included in the COBRA Notice mailed to that participant’s home address on file. If a participant has any questions, they should contact the COBRA administrator's Member Support Team at the number indicated on the notification letter.

The participant must elect this coverage continuation within 60 days from the date the participant's Leidos medical coverage terminates or the date of notification, whichever is later. Once elected, the participant has 45 days from the date he or she elected COBRA to pay all of the premiums back to the date he or she would have lost Plan coverage under the Plan. The participant will be charged the Plan's full cost of providing continued coverage, plus an additional 2% administrative fee (102% of the premium). Coverage is retroactive to the date the participant’s coverage ended. If the participant does not make the first payment for continuation coverage within those 45 days, they will lose all continuation coverage rights under the Plan.

Each Qualified Beneficiary has a separate right to elect continuation coverage. For example, a spouse may elect continuation coverage even if the participant does not. Continuation coverage may be elected for only one, several, or for all dependent children who are Qualified Beneficiaries. A parent may elect to continue coverage on behalf of any dependent children. The employee or the employee’s spouse can elect continuation coverage on behalf of all of the Qualified Beneficiaries.

*To be eligible for the additional 11 months coverage due to disability, the participant must provide the plan administrator with a Social Security Disability Award (SSDI) letter. This SSDI letter must be provided to the plan administrator during the first 18 months of COBRA; must indicate that the onset of the disability was within the first 60 days of COBRA coverage; and must be provided to the plan administrator within 60 days of the later of 1) the SSA's determination of disability (the date of the SSA award letter); 2) the date of your qualifying event; 3) the date of your loss of coverage; or 4) the date you were notified of the requirement (the date of your qualifying event letter). A participant who qualifies for the disability extension will be charged the Plan's full cost of providing continued coverage, plus an additional 50% administrative fee (150% of the premium). If the Qualified Beneficiary is determined by the SSA to no longer be disabled, they must notify the plan administrator of that determination within 30 days of the SSA's decision.

When COBRA Coverage Will End

The coverage period begins on the date of the qualifying event and ends upon the earliest of the following:

18 months in the case of termination of employment, layoff, or work force reduction;
29 months in the event of a disability*, according to the Social Security Administration;
36 months in the event of legal separation, divorce, or death of the employee;
36 months in the event of all other qualifying events;
Failure to pay any required premium when due;
The date a covered participant, under the continuation program, becomes covered under another group plan or Medicare — one that does not impose any pre-existing condition limitations on the coverage; or
The date that Leidos no longer provides a group medical plan to any of its employees.

Summary of COBRA Benefits

The following table summarizes COBRA benefits under the Leidos Plans:

The situation	Obtaining information	Who can be covered	How long coverage can last
The participant's employment with Leidos is terminated for reasons other than gross misconduct	A notification will be sent to the participant automatically by Leidos’ COBRA administrator	The participant and the participant's dependents	18 months
There is a reduction in the participant's work hours and the participant no longer qualifies for benefits coverage	A notification will be sent to the participant automatically by Leidos’ COBRA administrator	The participant and the participant's dependents	18 months
The participant is disabled according to the Social Security Administration	The participant must notify Leidos’ COBRA administrator and provide a copy of the SSDI letter (as described above)	The participant and the participant's dependents	29 months
The participant dies	A notification will be sent to the covered dependents automatically by Leidos’ COBRA administrator	The participant's covered dependents	36 months
The participant becomes divorced or legally separated	Participant or participant’s former spouse provides Plan notice of divorce or legal separation. A notification will then be sent to the covered dependents automatically by Leidos’ COBRA administrator.	The participant's former spouse or child dependents	36 months
The participant's dependent reaches age 26	A notification will be sent to the over age dependent automatically by Leidos’ COBRA administrator	The participant's dependent	36 months

Participants that lose health coverage as a result of an Open Enrollment action will not receive COBRA information.

Leidos Health & Welfare Plan Privacy Notice

The Leidos Privacy Notice describes how information about you may be used and disclosed as well as how you can get access to this information. Please review it carefully.

Your Individual Rights

You have the following rights with respect to your PHI, as maintained by the Plan. These rights are subject to certain limitations, as discussed below. This section of the Notice describes how you may exercise each individual right. Please call the Leidos Corporate Benefits Department if you have questions about your rights.

You have the right to be notified by the Plan or a Benefit Service Provider in the unlikely event of a security breach involving your unsecured PHI.

You have the right to ask the Plan to restrict the use and disclosure of your health information for treatment, payment, or health care operations, except for uses or disclosures required by law. You also have the right to ask the Plan to request that the Plan not disclose your PHI as described in the first paragraph of the “Other Allowable Uses or Disclosures of Your PHI” section above. If you want to exercise this right, your request to the Plan must be in writing.

With one exception, the Plan is not required to agree to a requested restriction. The Plan will comply with any restriction request if: (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for the purposes of carrying out treatment); and (2) the PHI pertains solely to a health care item or service for which the health care provider involved has been paid in full by you or another person.

If the Plan does agree, a restriction may later be terminated by your written request, by agreement between you and the Plan (including an oral agreement), or unilaterally by the Plan for PHI created or received after you're notified that the Plan has removed the restrictions. The Plan may also disclose PHI about you if you need emergency treatment, even if the Plan has agreed to a restriction.

If you think that disclosure of your PHI by the usual means could endanger you in some way, the Plan will accommodate reasonable written requests to receive communications of PHI from the Plan by alternative means or at alternative locations. For example, if mailing documents containing your PHI to your home could endanger you, the Plan may be able to email these documents or mail them to your work location.

If you want to exercise this right, your request to the Plan must be in writing and you must include a statement that disclosure of all or part of the information could endanger you.

With certain exceptions, you have the right to inspect or obtain a copy of your PHI in a "Designated Record Set." This [DWT1] will include enrollment, payment, claims adjudication, and case or medical management record systems maintained by the Plan and any other group of records the Plan uses to make decisions about you. However, you do not have a right to inspect or obtain copies of psychotherapy notes or information compiled for civil, criminal, or administrative proceedings. In addition, the Plan may deny your right to access in limited circumstances. Depending on the reason for the denial, you may have a right to request a review of the denial.

If you want to exercise this right, your request to the Plan must be in writing. Within 30 days of receipt of your request, the Plan will provide you with:

The access or copies you requested;
A written denial that explains why your request was denied and any rights you may have to have the denial reviewed or file a complaint; or
A written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

If the Plan is unable to provide you with the above information within 30 days, we may extend the timeframe to respond to your request by an additional 30 days. The Plan may provide you with a summary or explanation of the information instead of access to or copies of your PHI, if you agree in advance and pay any applicable fees. The Plan may also charge reasonable fees for copies or postage.

If the Plan doesn't maintain the PHI but knows where it is maintained, you will be informed of where to direct your request.

With certain exceptions, you have a right to request that the Plan amend your health information in a Designated Record Set. The Plan may deny your request for a number of reasons. For example, the Plan may deny your request if the PHI is accurate and complete, is not part of the Designated Record Set, or is not available for inspection (e.g., psychotherapy notes or information compiled for civil, criminal, or administrative proceedings). The Plan may also deny your request if the PHI you would like the Plan to amend was created by another entity or person, unless that entity or person is no longer available, such as where the Plan received your PHI from your doctor, but your doctor’s office has since permanently closed

If you want to exercise this right, your request to the Plan must be in writing, and you must include a statement to support the requested amendment. Within 60 days of receipt of your request, the Plan will:

Make the amendment as requested;
Provide a written denial that explains why your request was denied and any rights you may have to disagree or file a complaint; or
Provide a written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

You have the right to a list of certain disclosures the Plan has made of your PHI. This is often referred to as an "accounting of disclosures."

If you request an accounting of disclosures, you may receive information on disclosures of your PHI going back for six (6) years from the date of your request. Your request to the Plan must be in writing. Within 60 days of the request, the Plan will provide you with the list of disclosures or a written statement that the time period for providing this list will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request. You may make one (1) request in any 12-month period at no cost to you, but the Plan may charge a fee for subsequent requests. You'll be notified of the fee in advance and have the opportunity to change or revoke your request.

You do not have a right to receive an accounting of any disclosures made:

For treatment, payment, or health care operations;
To you about your own PHI;
Incidental to other permitted or required disclosures;
Where authorization was provided;
To family members or friends involved in your care (where disclosure is permitted without authorization);
For national security or intelligence purposes or to correctional institutions or law enforcement officials in certain circumstances; or
As part of a "limited data set" (health information that excludes certain identifying information)

In addition, we may refuse to provide you with an accounting of the disclosures the Plan has provided to health oversight agencies or law enforcement officials if such agencies or officials direct the Plan to withhold this information.

You have the right to obtain a paper copy of this Privacy Notice upon request. Even individuals who agreed to receive this notice electronically may request a paper copy at any time.

This Notice is provided in accordance with HIPAA. However, if any applicable state law provides greater privacy protections or imposes additional limitations on the use or disclosure of PHI, those state law provisions will govern.

The Plan must abide by the terms of the Privacy Notice currently in effect. However, the Plan reserves the right to change the terms of its privacy policies as described in this notice at any time, and to make new provisions effective for all PHI that the Plan maintains. This includes PHI that was previously created or received, not just health information created or received after the policy is changed. If changes are made to the Plan's privacy policies described in this notice, you will be notified of the changes by electronic or U.S. Postal Service.

If you believe your privacy rights have been violated, you may complain to the Plan and to the Secretary of Health and Human Services. You won't be retaliated against for filing a complaint. To file a complaint, submit a written request to:

Leidos - Corporate Benefits
Attn: HIPAA Compliance
1750 Presidents Street
Reston, VA 20190

If you have questions or would like more information on the Plan, its administrator’s privacy policies or your rights under HIPAA, contact the Employee Services 855-553-4367, option #3.