Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation that focuses on the portability, privacy and security of the participant and participant's dependent's health information.

HIPAA protects the participant and participant’s dependents by:

Limiting exclusions for pre-existing medical conditions;
Providing credit against maximum pre-existing condition exclusion periods for prior health coverage and a process for providing certificates showing periods of prior coverage to a new group health plan or health insurance issuer;
Providing new rights that allow individuals to enroll for health coverage when they lose other health coverage, get married, or add a new dependent;
Prohibiting discrimination in enrollment and in premiums charged to employees and their dependents based on health status-related factors; and
Ensuring the privacy of the participant's protected health information (PHI)

Disclosure of Protected Information

The confidentiality of the participant's health information is important. Leidos is required to maintain the confidentiality of the participant's information and has policies and procedures and other safeguards to help protect the participant's information from improper use and disclosure.

Leidos is allowed by law to use and disclose certain information without the participant's written permission. For example, Leidos may share information with the participant's health care provider to determine whether he or she is enrolled in the Plan or whether premiums have been paid on the participant's behalf. Leidos may also share the participant's information when legally required to do so — for example, in response to a subpoena or if the participant's medical safety may be at risk.

When the participant's authorization is required and the participant authorizes Leidos to use or disclose personal information for some purpose, the participant may revoke that authorization by notifying Leidos in writing at any time.

The participant's health care provider must have a Notice of Privacy Practices and provide the participant with a copy. For more information, contact Leidos Corporate Benefits.

To the extent required by the Standards for Privacy of Individually Identifiable Health Information and Security Standards, 45 C.F.R. Parts 160 through 164, as updated by the HITECH Act and various regulations and guidance (HIPAA Privacy & Security Rules), the Plan will comply with any restrictions, prohibitions, and attestation requirements related to reproductive health care information as required under 89 Federal Register 32976 (April 26, 2024) (HIPAA Privacy Rule To Support Reproductive Health Care Privacy).

Adding New Dependents

Under HIPAA, the participant has 31 days following marriage or the birth, adoption, or placement for adoption of a child to enroll a dependent in the health plans. The participant does not have to provide any medical or health information to enroll a dependent.

Continuing Coverage

For certain benefit programs, in the event Plan coverage for that benefit terminates, participants or their family member(s) may be eligible to continue the coverage for a period of time. Eligibility for such coverage (as well as the length of such coverage) will vary depending on the situation that renders you eligible, as well as the type of continuation coverage you are eligible for. There are different types of continuation coverage that may apply to particular benefit programs, including COBRA.

For benefits programs that are not eligible for COBRA, refer to the Participating in the Plans SPD section titled "If You Leave Leidos" for details on contiuation of coverage, if applicable.

Consolidated Omnibus Budget Reconciliation Act (COBRA)

In accordance with the COBRA, if coverage under the Plan terminates due to the events listed below, a participant and the participant's covered dependents may be eligible to continue coverage at their own expense for a limited period. This section describes coverage continuation rights under federal law. Some state laws may offer additional COBRA benefits. For more information about COBRA, refer to the Participating in the Plans SPD.

Leidos Health & Welfare Plan Privacy Notice

The Leidos Privacy Notice describes how information about you may be used and disclosed as well as how you can get access to this information. Please review it carefully.

Your Individual Rights

You have the following rights with respect to your PHI, as maintained by the Plan. These rights are subject to certain limitations, as discussed below. This section of the Notice describes how you may exercise each individual right. Please call the Leidos Corporate Benefits Department if you have questions about your rights.

You have the right to be notified by the Plan or a Benefit Service Provider in the unlikely event of a security breach involving your unsecured PHI.

You have the right to ask the Plan to restrict the use and disclosure of your health information for treatment, payment, or health care operations, except for uses or disclosures required by law. You also have the right to ask the Plan to request that the Plan not disclose your PHI as described in the first paragraph of the “Other Allowable Uses or Disclosures of Your PHI” section above. If you want to exercise this right, your request to the Plan must be in writing.

With one exception, the Plan is not required to agree to a requested restriction. The Plan will comply with any restriction request if: (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for the purposes of carrying out treatment); and (2) the PHI pertains solely to a health care item or service for which the health care provider involved has been paid in full by you or another person.

If the Plan does agree, a restriction may later be terminated by your written request, by agreement between you and the Plan (including an oral agreement), or unilaterally by the Plan for PHI created or received after you're notified that the Plan has removed the restrictions. The Plan may also disclose PHI about you if you need emergency treatment, even if the Plan has agreed to a restriction.

If you think that disclosure of your PHI by the usual means could endanger you in some way, the Plan will accommodate reasonable written requests to receive communications of PHI from the Plan by alternative means or at alternative locations. For example, if mailing documents containing your PHI to your home could endanger you, the Plan may be able to email these documents or mail them to your work location.

If you want to exercise this right, your request to the Plan must be in writing and you must include a statement that disclosure of all or part of the information could endanger you.

With certain exceptions, you have the right to inspect or obtain a copy of your PHI in a "Designated Record Set." This [DWT1] will include enrollment, payment, claims adjudication, and case or medical management record systems maintained by the Plan and any other group of records the Plan uses to make decisions about you. However, you do not have a right to inspect or obtain copies of psychotherapy notes or information compiled for civil, criminal, or administrative proceedings. In addition, the Plan may deny your right to access in limited circumstances. Depending on the reason for the denial, you may have a right to request a review of the denial.

If you want to exercise this right, your request to the Plan must be in writing. Within 30 days of receipt of your request, the Plan will provide you with:

The access or copies you requested;
A written denial that explains why your request was denied and any rights you may have to have the denial reviewed or file a complaint; or
A written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

If the Plan is unable to provide you with the above information within 30 days, we may extend the timeframe to respond to your request by an additional 30 days. The Plan may provide you with a summary or explanation of the information instead of access to or copies of your PHI, if you agree in advance and pay any applicable fees. The Plan may also charge reasonable fees for copies or postage.

If the Plan doesn't maintain the PHI but knows where it is maintained, you will be informed of where to direct your request.

With certain exceptions, you have a right to request that the Plan amend your health information in a Designated Record Set. The Plan may deny your request for a number of reasons. For example, the Plan may deny your request if the PHI is accurate and complete, is not part of the Designated Record Set, or is not available for inspection (e.g., psychotherapy notes or information compiled for civil, criminal, or administrative proceedings). The Plan may also deny your request if the PHI you would like the Plan to amend was created by another entity or person, unless that entity or person is no longer available, such as where the Plan received your PHI from your doctor, but your doctor’s office has since permanently closed

If you want to exercise this right, your request to the Plan must be in writing, and you must include a statement to support the requested amendment. Within 60 days of receipt of your request, the Plan will:

Make the amendment as requested;
Provide a written denial that explains why your request was denied and any rights you may have to disagree or file a complaint; or
Provide a written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

You have the right to a list of certain disclosures the Plan has made of your PHI. This is often referred to as an "accounting of disclosures."

If you request an accounting of disclosures, you may receive information on disclosures of your PHI going back for six (6) years from the date of your request. Your request to the Plan must be in writing. Within 60 days of the request, the Plan will provide you with the list of disclosures or a written statement that the time period for providing this list will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request. You may make one (1) request in any 12-month period at no cost to you, but the Plan may charge a fee for subsequent requests. You'll be notified of the fee in advance and have the opportunity to change or revoke your request.

You do not have a right to receive an accounting of any disclosures made:

For treatment, payment, or health care operations;
To you about your own PHI;
Incidental to other permitted or required disclosures;
Where authorization was provided;
To family members or friends involved in your care (where disclosure is permitted without authorization);
For national security or intelligence purposes or to correctional institutions or law enforcement officials in certain circumstances; or
As part of a "limited data set" (health information that excludes certain identifying information)

In addition, we may refuse to provide you with an accounting of the disclosures the Plan has provided to health oversight agencies or law enforcement officials if such agencies or officials direct the Plan to withhold this information.

You have the right to obtain a paper copy of this Privacy Notice upon request. Even individuals who agreed to receive this notice electronically may request a paper copy at any time.

This Notice is provided in accordance with HIPAA. However, if any applicable state law provides greater privacy protections or imposes additional limitations on the use or disclosure of PHI, those state law provisions will govern.

The Plan must abide by the terms of the Privacy Notice currently in effect. However, the Plan reserves the right to change the terms of its privacy policies as described in this notice at any time, and to make new provisions effective for all PHI that the Plan maintains. This includes PHI that was previously created or received, not just health information created or received after the policy is changed. If changes are made to the Plan's privacy policies described in this notice, you will be notified of the changes by electronic or U.S. Postal Service.

If you believe your privacy rights have been violated, you may complain to the Plan and to the Secretary of Health and Human Services. You won't be retaliated against for filing a complaint. To file a complaint, submit a written request to:

Leidos - Corporate Benefits
Attn: HIPAA Compliance
1750 Presidents Street
Reston, VA 20190

If you have questions or would like more information on the Plan, its administrator’s privacy policies or your rights under HIPAA, contact the Employee Services 855-553-4367, option #3.