Privacy-HIPAA

THE NEW YORK HOTEL TRADES COUNCIL AND HOTEL ASSOCIATION OF NEW YORK CITY, INC. HEALTH CENTER, INC. NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

Our Legal Responsibility

We are furnishing this Notice pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended from time to time (“HIPAA”). You may find these rules at 45 Code of Federal Regulations Parts 160 and 164 (“HIPAA Privacy Rule”).

The New York Hotel Trades Council and Hotel Association Of New York City, Inc. Health Center, Inc. (“HCI”) recognizes the trust that you place in us by providing us with your personal and confidential health information. We take this responsibility very seriously and take numerous steps to protect your health information (also referred here as “PHI”). We maintain physical, electronic, and procedural safeguards that are designed to ensure the privacy of your PHI. We also restrict access to your PHI only to individuals who need to know that information to provide services to you.

PHI includes all individually identifiable health information relating to your past, present, or future physical or mental health condition, the health care provided to you, or payment for your health care. This includes information in oral, written, or electronic form. HCI is required by the law to maintain the privacy of your PHI. We are also required by law to provide you with this Notice of Privacy Practices (“Notice”) regarding our legal duties and your rights concerning your PHI. Also, we are required to abide by the terms of this Notice and to notify you if there is a breach of your PHI.

References to “you and “your” mean you, the participants of the New York Hotel Trades Council and Hotel Association of New York City, Inc. Health Benefits Fund (“Health Fund”), and each of your covered dependents. You may request a copy of this Notice at any time. For more information about our privacy practices, or for additional copies of this Notice, please contact the Privacy Officer using the information set forth at the end of this Notice.

This Notice does not apply to information that has been de-identified. Deidentified information is information that:
• Does not identify you, and
• With respect to which there is no reasonable basis to believe that the information can be used to identify you.

Your Authorization

Without your written authorization, we will not use or disclose your PHI for any reason except those described in this Notice. HCI must disclose your PHI to you, as described in the “Your Rights” section of this Notice. You may give us written authorization to use or disclose your PHI to anyone for any purpose. If you give us an authorization, you may revoke it in writing at any time. Your revocation will not apply to any disclosure we have already made in reliance on your previous authorization. However, we will not make any further disclosures until a new written authorization is received. Requests to revoke a prior authorization must be submitted in writing to the Privacy Officer at the mailing address listed at the end of this Notice.

Your Personal Representative

You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of authority to act on your behalf before being given access to your PHI or taking any action for you. Proof of such authority includes a completed, signed and approved Appointment of Personal Representative form or other form acceptable under state or federal law.

HCI retains discretion to deny personal representative access to your PHI if we have reasonable belief that you have been or may be subjected to domestic violence, abuse, or neglect by such person, if you could be endangered, or if, in the exercise of professional judgment, we decide that it is not in your best interest to do so.

What Information HCI Creates or Collects

We collect PHI from the following sources:
1. Information you provide on eligibility and enrollment applications and other forms, including demographic data, as your name, address, date of birth and Social Security number.
2. Information about your treatment and transactions with us, our affiliated health care providers or others with whom we have a formalized business associate relationship utilized for the delivery of certain health care services.

Our Uses and Disclosures of Your PHI

Under the law, we may use and disclose your PHI without your written consent or authorization when necessary to assist us with providing your health care and health care benefits. We typically use and disclose PHI about you as follows:
• At your request. If you request it, HCI is generally required to give you access to certain PHI to allow you to inspect and/or copy it.
• As required by the Secretary of the U.S. Department of Health and Human Services who may require the disclosure to investigate or determine HCI’s compliance with the privacy regulations.
• For treatment, payment or health care operations. HCI and its business associates will use or disclose PHI in order to carry out treatment, payment, or health care operations.

For Treatment
HCI may disclose your PHI to doctors, nurses, or other health care providers for the coordination of your health care or related services, or to provide you with preventative care reminders or treatment options. For example, an orthopedist treating you for an injury may ask us to provide information about your overall health condition.

For Payment
HCI may use and disclose your PHI to bill or pay claims from doctors and other health care providers for treatment you received, to determine your eligibility for benefits or to examine medical necessity. For example, we may disclose PHI about your treatment to the Health Fund so that it can determine medical necessity and appropriateness of care.

For Health Care Operations
HCI may use or disclose your PHI in the process of the routine operations of the organization related to health care, such as to assure the quality of your care, internal audit, and for accreditation and certification purposes. For example, we may use your PHI about your claims to refer you to a disease management program, a well-pregnancy program, project future benefit costs or audit the accuracy of health care payments.

HCI is prohibited by law from using or disclosing your genetic information for underwriting purposes.

Minimum Necessary Standard
When using or disclosing PHI or when requesting PHI from another covered entity, HCI will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical
and technological limitations.

However, the minimum necessary standard will not apply in the following
situations:
• Disclosures to or requests by a health care provider for treatment;
• Uses or disclosures made to you or pursuant to your written authorization;
• Disclosures made to the Secretary of the U.S. Department of Health and Human Services pursuant to its enforcement activities under HIPAA;
• Uses or disclosures required by law, and
• Uses or disclosures required for HCI’s compliance with the HIPAA privacy regulations.

Disclosure to Your Family and Friends

HCI may disclose to your family member, friend, or other person you indicate as involved in your care or payment for your care, your PHI that is directly relevant to their involvement, provided you have either agreed to the disclosure or have been given an opportunity to object and have not objected or we reasonably infer from the circumstances - based on the exercise of professional judgment - that you do not object to the disclosure.

Other Uses and Disclosures of Your PHI

Health Fund
HCI may disclose your PHI to the Health Fund for the purpose of the Health Fund performing administrative functions, but only when the Health Fund agrees to certify that applicable processes are in place to safeguard the confidentiality of your PHI.

Business Associates
HCI may use and disclose your PHI to our business associates. These are third party contractors and agents who need the information to assist us with our health care operations, obtaining payment, or carrying out our business operations. Some examples of business associates include consultants, accountants, lawyers, pharmacy claims administrators and other delegated entities. If we do disclose your PHI to a business associate, we will have a written contract to ensure that our business associates also safeguards your PHI.

Regulatory Authorities
HCI may, and in some instances is required to, disclose your PHI to regulatory and/or law enforcement authorities. For example, we may disclose your PHI to insurance and health oversight agencies, such as the New York State Department of Health, Department of Insurance, or the U.S. Department of Health and Human Services to comply with requests for audits, inspections, and licensure or during disciplinary proceedings.

In addition, we may disclose your PHI to appropriate government authorities for the reporting of child abuse, neglect or, in instances of domestic violence. In such case, HCI will promptly inform you that such a disclosure has been or will be made, unless we believe that notice would cause a risk of serious harm or the notice would be given to a personal representative who is believed to be responsible for the abuse, neglect, or violence.

Law Enforcement
We may also share your PHI with law enforcement agencies, under certain conditions, such as where required by law to report certain wounds or injuries, in response to a subpoena, to locate a suspect, a material witness or a missing person.

Legal Proceedings
When required in a judicial or administrative proceeding or a court order, HCI may disclose your PHI. Additionally, in response to a subpoena or discovery request if certain conditions are met. If the PHI relates to substance use disorder (“SUD”), the information will not be disclosed in a civil, criminal or any other proceeding against you, unless you provide written consent or a court issues an order after you have been provided notice and an opportunity to be heard in the matter. The court order authorizing the use or disclosure of SUD records must also be accompanied by a subpoena or another legal requirement that compels us to provide the information.

Determining Cause of Death and Organ Donation
We may disclose PHI of a deceased person to a medical examiner or coroner to identify a deceased person, determine a cause of death or as necessary, to carry out their duties. If you are an organ donor, HCI may also use or disclose your PHI to organizations that handle organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank to facilitate organ or tissue donation and transplantation.

Funeral Purposes
We may disclose PHI of a deceased person to funeral directors to carry out their duties with respect to the decedent. If necessary for funeral directors to carry out their duties, we may also disclose your PHI prior to, and in reasonable anticipation of, death.

Research
We may disclose your PHI to researchers when an institutional review board or privacy board, which has established protocols to ensure the privacy of your PHI, has approved the research, and provided that certain other requirements are met.

Health or safety threats
We may use or disclose your PHI when, consistent with applicable law and standards of ethical conduct, we in good faith believe the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of you, or another person, or the public, and the disclosure is to a person reasonably able to prevent or lessen the threat, including the target of the threat. We may also disclose your PHI to any authorized public or private entities assisting in disaster relief efforts.

Workers’ Compensation Programs
We may disclose your PHI when authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

Inmates
If you are an inmate of a correctional institution or are in the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official if the PHI is necessary (i) for the institution to provide you with health care; (ii) to protect your health and safety or the health and safety of others; or (iii) for the safety and security of the correctional institution.

Food and Drug Administration
We may disclose your PHI to a person or entity subject to the jurisdiction of the Food and Drug Administration (“FDA”) regarding an FDA-regulated product or activity under their responsibility, for purposes related to the quality, safety, or effectiveness of such product or activity.

Specialized Government Functions
If you are a member of the armed forces, we may use or disclose your PHI for activities deemed necessary by appropriate military command authorities, or to a foreign military authority, if you are a member of that foreign military service. We may also use or disclose your PHI to authorized federal officials for lawful intelligence, counterintelligence and other national security activities, including the protective services for the President.

Treatment Alternatives
HCI may contact you to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.

When Disclosure Requires Your Written Authorization

We must generally obtain your written authorization before using or disclosing your PHI for any purpose not otherwise required or permitted by law. You have the right to revoke your authorization in writing at any time as further explained above in the “Your Authorization” section of this Notice.

Use of psychotherapy notes
We do not routinely obtain psychotherapy notes. However, if it is necessary to use or disclose them, we generally must obtain your written authorization. We may use and disclose such notes when needed to defend against litigation filed by you. Psychotherapy notes are separately filed notes about your conversations with your mental health professional during a counseling session. They do not include summary information about your mental health treatment.

Marketing of PHI
We do not use or disclose your PHI for marketing purposes. In any event, before we could use or disclose your PHI for marketing, we would have to obtain your written authorization and disclose whether remuneration will be received. Note that face-to-face communications made by HCI to you and promotional gifts of nominal value provided by HCI are not considered as marketing.

Sale of PHI
We do not sell your PHI. In any event, before we could sell your PHI, we would have to obtain your written authorization. For this purpose, sale of PHI generally means a disclosure of PHI where we directly or indirectly receive remuneration from or on behalf of the recipient of the PHI in exchange for the PHI but does not include a disclosure of PHI otherwise permitted by HIPAA.

Substance use disorder treatment records
Substance use disorder treatment records (“SUD Records”) created by the HCI or received from a program covered by 42 CFR Part 2 (a “Part 2 Program”), or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided under law. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD Record is used or disclosed.

If you provide HCI with consent, or if we receive SUD Records about you pursuant to a written consent you provided to the Part 2 Program to use and disclose your SUD Records for all future purposes of treatment, payment or health care operations, we may use and disclose your SUD Records for the purposes of treatment, payment or health care operations, as described above, consistent with such consent until we receive notification that you have revoked such consent in writing. In addition, we may further disclose those SUD Records in accordance with HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against you.

Fundraising
We do not use or disclose your PHI (including but not limited to SUD Records) for any fundraising activities whether for the benefit of HCI, or for or on behalf of others. In any event, before we could use or disclose your PHI for fundraising, we have to obtain your written authorization for such use or disclosure, and with respect to SUD Records and other PHI, give you the opportunity to elect not to receive any fundraising communications.

Additional restrictions on use and disclosure
Some federal and state laws may require special privacy protections that restrict the use and disclosure of certain sensitive health information such as alcohol and substance use disorder (including Part 2 Programs), biometric information, child or adult abuse or neglect, including sexual assault, communicable diseases, genetic information, HIV/AIDS, mental health, minors’ information, prescriptions, reproductive health, and sexually transmitted diseases. In such case, we will follow the more stringent or protective law, to the extent that it applies.

Redisclosure
Note that information that is disclosed by HCI in accordance with the HIPAA Privacy Rule is subject to redisclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule.

Your Rights

Access
You have the right to look at or get a copy of your Designated Record Set for as long as we maintain it. Designated Record Set includes medical and billing records as well as enrollment, payment, claims adjudication and case management records, with limited exceptions. You must make a request in writing to obtain access to your medical information to the Privacy Officer at the mailing address listed at the end of this Notice. We will respond to your request within 30 days, unless we require an additional 30 days. A reasonable fee may be charged.

If access is denied, you will be provided with a written denial setting forth the basis for the denial, a description of how you may exercise your review rights and a description of how you may complain to HCI and HHS.

Disclosure Accounting
You have the right to receive an accounting of disclosures of your PHI. The list will include instances in which we or our business associates disclosed your PHI for purposes other than treatment, payment, health care operations, and certain other disclosures. We will not provide you with an accounting of disclosures related to disclosures made to you or authorized by you in writing. You are entitled to an accounting of disclosures for the six (6) years prior to the date of your request.

To obtain an accounting of disclosures, you may submit a written request to the Privacy Officer at the mailing address listed at the end of this Notice. Your request must state the time period for which you want to receive a list of disclosures, which shall be no more than six (6) years from the date on which the list is requested. Your request should indicate in what form you want the list (e.g., on paper or electronically).

We will attempt to respond to your request for an accounting within 60 days, unless we require an additional 30 days. We will provide you with one free accounting every 12 months. A fee may be charged for any additional accountings within a 12-month period. You will be advised in advance of any fee that may be required so you have an opportunity to withdraw or amend your request.

Restriction Requests
You have the right to request that we place additional restrictions on our use or disclosure of your PHI for treatment, payment, or health care operations, or to the person(s) you identify. We are generally not required to agree to these additional restrictions, except for a request to restrict disclosures to a health plan for payment or health care operations purposes, if the PHI relates solely to a health care item or service that was paid out-of-pocket in full. If we agree to a restriction, we will abide by our agreement, except in the case of an emergency.

If you wish to request a restriction, you may submit your request in writing to our Privacy Officer at the mailing address listed at the end of this Notice. In your written request, you must specify: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limit(s) to apply (e.g., disclosures to your spouse).

Confidential Communications
You have the right to request that we communicate with you about your PHI by alternative means or to an alternative location. You must make your request in writing, and submit the written request to our Privacy Officer at the mailing address listed at the end of this Notice. We will accommodate your request if it is reasonable and accurately specifies the alternative means or location.

Amendment
You have the right to request that we amend your PHI or a record about you in a designated record set for as long as the PHI is maintained in the designated record set subject to certain exceptions. To do so, submit your request in writing to our Privacy Officer at the mailing address listed at the end of this Notice, and provide a reason for such a request. We will respond to your request within 60 days after we receive it and may extend the time by an additional 30 days, if necessary. If we make the amendment, we will notify you that the amendment was made and provide the amendment to any individual with whom the amendment needs to be shared, as well as any other person identified by you.

If we deny your request for an amendment, we will notify you in writing as to the reason for the denial and advise you of your rights to file a written statement of disagreement or a complaint. If you submit a statement of disagreement, we may prepare a written rebuttal. Your request for amendment, our denial, your statement, and our written rebuttal will be included with the relevant PHI in future disclosures.

Electronic Notice
Even if you access this Notice on our website or receive it by e-mail, you are entitled to receive it in written form. Please contact us using the information listed at the end of this Notice to obtain this Notice in written form.

Questions and Complaints

If you want more information about our privacy practices or have questions or concerns about this Notice or its contents, please contact our Privacy Officer at the mailing address listed at the end of this Notice. If you believe that your privacy rights have been violated, you may file a complaint with the Privacy Officer using the contact information listed at the end of this Notice. You also may also submit a complaint to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services upon request.

The Health Center supports your right to protect the privacy of your medical information. We will not retaliate against you in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

Contact Information

Privacy Officer
The New York Hotel Trades Council and
Hotel Association of New York City, Inc.
Health Center, Inc.
305 West 44th Street
New York, New York 10036
(212) 586-6400

Effective Date
This Notice is effective as of February 16, 2026. We reserve the right to change the terms of this Notice and to make any such changes effective for all PHI we maintain. If we make changes to this Notice, we will provide you with an updated version, including by informing you that an updated Notice has been posted on our website at https://www.hotelfunds.org/ or by mailing or emailing it to you.