Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation that focuses on the portability, privacy and security of the participant and participant's dependent's health information.

HIPAA protects the participant and participant's dependents by:

Limiting exclusions for pre-existing medical conditions;
Providing credit against maximum pre-existing condition exclusion periods for prior health coverage and a process for providing certificates showing periods of prior coverage to a new group health plan or health insurance issuer;
Providing new rights that allow individuals to enroll for health coverage when they lose other health coverage, get married, or add a new dependent;
Prohibiting discrimination in enrollment and in premiums charged to employees and their dependents based on health status-related factors; and
Ensuring the privacy of the participant's protected health information

Disclosure of Protected Information

The confidentiality of the participant's health information is important. Leidos is required to maintain the confidentiality of the participant's information and has policies and procedures and other safeguards to help protect the participant's information from improper use and disclosure.

Leidos is allowed by law to use and disclose certain information without the participant's written permission. For example, Leidos may share information with the participant's health care provider to determine whether he or she is enrolled in the plan or whether premiums have been paid on the participant's behalf. Leidos may also share the participant's information when legally required to do so — for example, in response to a subpoena or if the participant's medical safety may be at risk.

When the participant's authorization is required and the participant authorizes Leidos to use or disclose personal information for some purpose, the participant may revoke that authorization by notifying Leidos in writing at any time.

The participant's health care provider must have a Notice of Privacy Practices and provide the participant with a copy. For more information, contact Leidos Corporate Benefits.

Adding New Dependents

Under HIPAA, the participant has 31 days following marriage or the birth, adoption, or placement for adoption of a child to enroll a dependent in the health plans. The participant does not have to provide any medical or health information to enroll a dependent.

Continuing Coverage Through COBRA

The Consolidated Omnibus Budget Reconciliation Act (COBRA) enables a participant and the participant's covered dependents to continue health insurance if coverage ceases due to a reduction of work hours or termination of employment (other than for gross misconduct). Federal law also enables a participant's dependents to continue health insurance if their coverage ends due to the participant's death or entitlement to Medicare; divorce; legal separation; or when a covered child no longer qualifies as an eligible dependent. The participant must elect coverage according to the rules of the Leidos health care plans. Continuation is subject to federal law, regulations, and interpretations.

In accordance with COBRA, a participant and his or her family have some important rights concerning the continuation of group health care benefits if that coverage ceases.

Leidos maintains the following types of plans that are subject to federal COBRA requirements:

Medical
Dental
Vision
Health Care Flexible Spending Accounts

Some state laws may offer additional COBRA benefits. For more information, review the insured plan's Evidence of Coverage booklet.

Who is Eligible for COBRA

A covered participant who loses coverage due to termination of employment (other than termination for gross misconduct) or reduction in work hours. Termination of employment includes, but it not limited to, voluntarily quitting, layoff, and lack of work due to a work location closure.
The spouse and/or dependent children of a covered participant who are covered under the plan and who lose coverage as a result of any of the following qualifying events**:
- The death of a covered employee;
- The termination of a covered employee (excluding termination due to gross misconduct);
- The divorce or legal separation of the covered employee from his or her spouse;
- A dependent's ceasing to qualify as a "dependent child" under the terms of the plan; or
- The covered employee's becoming entitled to Medicare benefits.

**To continue coverage for a spouse and/or dependent child(ren), it is the participant's (or a family member's) responsibility to notify Employee Services within 31 days of a divorce, legal separation, or child's losing dependent status.

When COBRA Coverage Will End

The coverage period begins on the date of the qualifying event and ends upon the earliest of the following:

18 months in the case of termination of employment, layoff, or work force reduction;
29 months in the event of a disability*, according to Social Security;
36 months in the event of legal separation, divorce, or death of the employee;
36 months in the event of all other qualifying events;
Failure to pay any required premium when due;
The date a covered participant, under the continuation program, becomes covered under another group plan or Medicare — one that does not impose any pre-existing condition limitations on the coverage; or
The date that Leidos no longer provides a group medical plan to any of its employees.

If a participant wants to continue coverage, they can elect COBRA online or mail their election directly to the COBRA Administrator. Information to enroll will be included in the COBRA Notice mailed to that participant’s home address on file. If a participant has any questions, they should contact the COBA Administrator's Member Support Team at the number indicated on the notification letter.

The participant must elect this coverage continuation within 60 days from the date the participant's Leidos medical coverage terminates or the date of notification, whichever is later. Once elected, the participant has 45 days from the date he or she elected COBRA to pay all of the premiums back to the date he or she would have lost plan coverage under the plan. The participant will be charged the plan's full cost of providing a continued coverage, plus an additional 2% administrative fee (102% of the premium).

*To be eligible for the additional 11 months coverage due to disability, the participant must provide the Plan Administrator with: a Social Security Disability Award (SSDI) letter. This SSDI letter must be provided to the Plan Administrator during the first 18 months of COBRA; must indicate that the onset of the disability was within 60 days of losing coverage; and must be provided to the Plan Administrator within 60 days of your receipt of the Notice of Award letter from Social Security. A participant who qualifies for the disability extension will be charged the plan's full cost of providing a continued coverage, plus an additional 50% administrative fee (150% of the premium).

The following table summarizes COBRA benefits under the Leidos health care plans:

The situation	Obtaining information	Who can be covered	How long coverage can last
The participant's employment with Leidos is terminated for reasons other than gross misconduct	A notification will be sent to the participant automatically by Leidos’ COBRA administrator	The participant and the participant's dependents	18 months
There is a reduction in the participant's work hours and the participant no longer qualifies for benefits coverage	A notification will be sent to the participant automatically by Leidos’ COBRA administrator	The participant and the participant's dependents	18 months
The participant is disabled according to Social Security	The participant must notify Leidos’ COBRA administrator and provide a copy of the SSDI letter (as described above)	The participant and the participant's dependents	29 months
The participant dies	A notification will be sent to the covered dependents automatically by Leidos’ COBRA administrator	The participant's covered dependents	36 months
The participant becomes divorced or legally separated	A notification will be sent to the covered dependents automatically by Leidos’ COBRA administrator.	The participant's former spouse	36 months
The participant's dependent reaches age 26	A notification will be sent to the over age dependent automatically by Leidos’ COBRA administrator	The participant's dependent	36 months

Participants that lose health coverage as a result of an Open Enrollment action will not receive COBRA information.

Leidos Health & Welfare Plan Privacy Notice

The Leidos Privacy Notice describes how information about you may be used and disclosed as well as how you can get access to this information. Please review it carefully.

Your Individual Rights

You have the following rights with respect to your health information the Plan maintains. These rights are subject to certain limitations, as discussed below. This section of the notice describes how you may exercise each individual right.

You have the right to be notified by the Plan or a Benefit Service Provider in the unlikely event of a security breach involving your unencrypted PHI.

You have the right to ask the Plan to restrict the use and disclosure of your health information for Treatment, Payment, or Health Care Operations, except for uses or disclosures required by law. You also have the right to ask the Plan to request that the Plan not disclose your PHI as described in the “Other Allowable Uses or Disclosures of Your PHI” section above. If you want to exercise this right, your request to the Plan must be in writing.

The Plan is not required to agree to a requested restriction. And if the Plan does agree, a restriction may later be terminated by your written request, by agreement between you and the Plan (including an oral agreement), or unilaterally by the Plan for PHI created or received after you're notified that the Plan has removed the restrictions. The Plan may also disclose PHI about you if you need emergency treatment, even if the Plan has agreed to a restriction.

If you think that disclosure of your PHI by the usual means could endanger you in some way, the Plan will accommodate reasonable requests to receive communications of PHI from the Plan by alternative means or at alternative locations. For example, if mailing documents containing your PHI to your home could endanger you, the Plan may be able to email these documents or mail them to your work location.

If you want to exercise this right, your request to the Plan must be in writing and you must include a statement that disclosure of all or part of the information could endanger you.

With certain exceptions, you have the right to inspect or obtain a copy of your PHI in a "Designated Record Set." This may include medical and billing records maintained for a health care provider; enrollment, payment, claims adjudication, and case or medical management record systems maintained by a plan; or a group of records the Plan uses to make decisions about individuals. However, you do not have a right to inspect or obtain copies of psychotherapy notes or information compiled for civil, criminal, or administrative proceedings. In addition, the Plan may deny your right to access, although in certain circumstances you may request a review of the denial.

If you want to exercise this right, your request to the Plan must be in writing. Within 30 days of receipt of your request, the Plan will provide you with:

The access or copies you requested;
A written denial that explains why your request was denied and any rights you may have to have the denial reviewed or file a complaint; or
A written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

If the Plan is unable to provide you with the above information within 30 days, we may extend the timeframe to respond to your request by an additional 30 days. The Plan may provide you with a summary or explanation of the information instead of access to or copies of your PHI, if you agree in advance and pay any applicable fees. The Plan may also charge reasonable fees for copies or postage.

If the Plan doesn't maintain the PHI but knows where it is maintained, you will be informed of where to direct your request.

With certain exceptions, you have a right to request that the Plan amend your health information in a Designated Record Set. A Designated Record Set refers to the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for the Plan or any records the Plan, or a Benefits Service Provider acting on behalf of the Plan, uses, in whole or in part, to make decisions about Plan participants. The Plan may deny your request for a number of reasons. For example, the Plan may deny your request if the PHI is accurate and complete, is not part of the Designated Record Set, or is not available for inspection (e.g., psychotherapy notes or information compiled for civil, criminal, or administrative proceedings). The Plan may also deny your request if the PHI you would like the Plan to amend was created by another entity or person, unless that entity or person is no longer available, such as where the Plan received your PHI from your doctor, but your doctor’s office has since permanently closed

If you want to exercise this right, your request to the Plan must be in writing, and you must include a statement to support the requested amendment. Within 60 days of receipt of your request, the Plan will:

Make the amendment as requested;
Provide a written denial that explains why your request was denied and any rights you may have to disagree or file a complaint; or
Provide a written statement that the time period for reviewing your request will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request.

You have the right to a list of certain disclosures the Plan has made of your PHI. This is often referred to as an "accounting of disclosures."

If you request an accounting of disclosures, you may receive information on disclosures of your PHI going back for six (6) years from the date of your request. Your request to the Plan must be in writing. Within 60 days of the request, the Plan will provide you with the list of disclosures or a written statement that the time period for providing this list will be extended for no more than 30 more days, along with the reasons for the delay and the date by which the Plan expects to address your request. You may make one (1) request in any 12-month period at no cost to you, but the Plan may charge a fee for subsequent requests. You'll be notified of the fee in advance and have the opportunity to change or revoke your request.

You do not have a right to receive an accounting of any disclosures made:

For treatment, payment, or health care operations;
To you about your own PHI;
Incidental to other permitted or required disclosures;
Where authorization was provided;
To family members or friends involved in your care (where disclosure is permitted without authorization);
For national security or intelligence purposes or to correctional institutions or law enforcement officials in certain circumstances; or
As part of a "limited data set" (health information that excludes certain identifying information)

In addition, we may refuse to provide you with an accounting of the disclosures the Plan has provided to health oversight agencies or law enforcement officials if such agencies or officials direct the Plan to withhold this information.

You have the right to obtain a paper copy of this Privacy Notice upon request. Even individuals who agreed to receive this notice electronically may request a paper copy at any time.

The Plan must abide by the terms of the Privacy Notice currently in effect. However, the Plan reserves the right to change the terms of its privacy policies as described in this notice at any time, and to make new provisions effective for all PHI that the Plan maintains. This includes PHI that was previously created or received, not just health information created or received after the policy is changed. If changes are made to the Plan's privacy policies described in this notice, you will be notified of the changes by electronic or U.S. Postal Service.

If you believe your privacy rights have been violated, you may complain to the Plan and to the Secretary of Health and Human Services. You won't be retaliated against for filing a complaint. To file a complaint, submit a written request to:

Leidos Corporate Benefits Department
Attn: HIPAA Compliance Department
1750 Presidents Street
Reston, VA 20190

For more information on the Plan, its administrator’s privacy policies or your rights under HIPAA, contact the Employee Services 855-553-4367, option #3.