Privacy Statement
Effective Date: July 15, 2020
Last Updated: July 15, 2020
Thank you for visiting our Website (hereinafter “Sites”), and for reviewing this Privacy Statement.
Shastatpa.com is a product of, and is provided to you by, Shasta Administrative Services (“SHASTA,” “us,” “our,” and/or “we”), a third-party administrator for its self-funded clients. SHASTA may only use the information that you provide through these Sites for purposes permitted or required by law, and as described in this statement.
PLEASE READ this Privacy Statement before you use the Sites. Your use of the Sites signifies to us that you have read and understood all of the terms of this Privacy Statement. Please refer to our Sites Terms of Use for information regarding your responsibilities when using these Sites.
Our Role as a Third Party Administrator. We provide or perform services on behalf of our clients. Because we operate as a service provider, or third party administrator, we may collect and process personal information, and in particular protected health information (defined below), on behalf and at the direction of our clients. In these circumstances, and for purposes of applicable data privacy laws, SHASTA is acting as a “service provider” or “third party administrator” carrying out the instructions of our clients with regard to any protected health information that we collect, or they provide, for us to process on their behalf.
In view of the foregoing, to the extent required by applicable data protection laws, our clients have primary responsibility for compliance with data privacy obligations over this protected health information, including maintaining their own privacy program to communicate to individuals how their protected health information is processed and shared. As such, our clients’ individual organizational privacy statements or Notices of Privacy Practices (which we may provide on their behalf) will govern the use of protected health information that we collect and process on their behalf.
As a third party administrator, we process protected health information on behalf of our clients, and in accordance with our clients’ written instructions as well as the terms of our contracts with our clients. This also means that where instructed or authorized by our clients, or permitted by law, we may share protected health information with third parties to carry out further processing of protected health information on our clients’ behalf. Further, as a third party administrator, we will assist our clients in complying with applicable data privacy laws to the extent any such laws cover the protected health information we process on their behalf. As such, unless required by an applicable data privacy law or instructed by a client, we may not respond directly to any requests from individuals who desire to exercise any applicable data privacy rights (as set forth in a Notice of Privacy Practices) with regard to their protected health information for which we are a only a third party administrator. Rather, where we are not permitted to respond directly to an individual’s request, we will refer any such requests to the client on whose behalf we process such protected health information.
To address privacy concerns you may have while visiting our interactive, customized Sites, this Privacy Statement describes how SHASTA may use information that you provide. If you do not want SHASTA to use information that you provide through these Sites as described in this Privacy Statement, you should disconnect from these Sites.
Please note that this Privacy Statement applies only to how SHASTA uses individually identifiable personal information that you provide when visiting these Sites.
Shastatpa.com may collect individually identifiable personal information when you register or login. These Sites do not track a user’s online activities over time and across third-party Sites. Because SHASTA does not employ tracking technology, we offer no response to “Do Not Track” requests transmitted by Web browsers. SHASTA reserves the right to use and share or disclose this information with others for Shasta.com. As described in greater detail below, SHASTA routinely gathers aggregate quantitative tracking information on Site activity, including the number of users and the pages visited.
This Privacy Statement is distinct from the Notice of Privacy Practices we provide on behalf of our clients, which describe in detail how SHASTA uses individually identifiable health information and protected health information that we may receive both online and offline to provide services to you and to manage payment obligations and health care operations. SHASTA publishes the Notice of Privacy Practices on behalf of our clients in accordance with the HIPAA Privacy Rule (“Privacy Rule,” a federal regulation officially known as the “Standards for the Privacy of Individually Identifiable Health Information”). Together, this Privacy Statement and the applicable Notice of Privacy Practices describe how SHASTA uses your individually identifiable personal information and health information.
When you communicate with us via our Sites, we collect information only if you provide it to us voluntarily or otherwise in the aggregate for our internal use related to Site analytics and operation. Portions of our Sites may allow you to provide us with online personal information in order to deliver requested materials, products or services to you or to respond to your questions. When we ask you to provide personal information on the Sites, we will explain, or otherwise make it evident, the reasons why you are asked to provide that information. Any online personal information that you provide or that we collect via our Sites is used exclusively for the purpose stated on the Web page where you submit your personal information, or as described in this Privacy Statement. SHASTA does not sell, license or disclose online personal information that you provide to us outside of SHASTA, its agents and affiliated companies.
Use of Personal Information for Promotional Giveaways, Sweepstakes, and Contests. Participation in promotional giveaways, sweepstakes, and contests (collectively referred to as “sweepstakes”) that SHASTA or its clients may administer online through these Sites, social media, or digital platforms may require you to provide your personal information and certain other information including an email address, phone number, and mailing address. The information you provide in relation to any sweepstakes will be used for purposes including administering the sweepstakes, distribution of prizes from the sweepstakes, and other purposes disclosed at the time of the sweepstakes. You should carefully review the “Official Rules” of any sweepstakes you participate in as they may contain additional information related to the use of personal information for purposes related to the sweepstakes.
Use of Automatically Collected Information. As indicated above, we use certain digital analytics tools that help us analyze usage and performance when you access and use the Sites. The information we collect automatically typically does not include any individuals’ names or contact information. Rather, as you navigate the Sites, these analytics tools automatically collect and store information about your access to and use of the Sites, such as: the date and time of your visit, the duration of your visit, the type of browser and browser language you use, your Internet Protocol (“IP”) address, mobile device ID, type of computer or other operating device used, the actions you take on the Sites, the websites (if any) from which you linked to the Sites, and the website(s) you visit after visiting the Sites. This information allows us to better understand the users of the Sites, and what content and features are of interest to them. It also helps us to maintain the security and operation of the Sites. We only ever use this information in the aggregate, and only for our internal analytics purposes, to diagnose problems with our servers, and to improve the quality, performance, and functionality of the Sites.
As permitted by the Privacy Rule, individually identifiable health information that you provide through this Site or that SHASTA creates or receives about you may be used or disclosed by SHASTA in connection with services provided to you by SHASTA, and for other purposes that are permitted or required by law. Under the Privacy Rule this information is called “protected health information.” Protected health information is individually identifiable health information, including demographic information, collected from you or created or received by a health care provider, a health plan, or a health care clearinghouse and relates to: (i) your past, present or future physical or mental health or condition; (ii) the provision of health care to you; or (iii) the past, present or future payment for the provision of health care to you. We refer to protected health information and individually identifiable health information interchangeably hereinafter in this Privacy Statement.
We are committed to protecting the privacy of your individually identifiable health information (including any online personal information that also constitutes individually identifiable health information), in addition to those provisions described in an applicable Notice of Privacy Practices, as follows:
SHASTA does not sell, transfer or disclose individually identifiable health information without your prior authorization, except when permitted or required by law. As used in this Web Privacy Statement, “required by law” includes the permissive and mandatory requirements of state and federal regulations that govern the use and disclosure of individually identifiable information, such as the federal regulation known as the Privacy Rule. Under the Privacy Rule, SHASTA is permitted to:
Disclose individually identifiable health information to our business associates who perform various functions or provide services on SHASTA’s behalf. To perform these functions or to provide services, business associates will receive, create, maintain, use, or disclose protected health information, but only after we require the business associates to agree in writing to contract terms designed to safeguard your information.
Use and disclose individually identifiable health information to support the services provided through these Sites, and to support the business functions provided by SHASTA. These services and functions may include:
Responding to your questions, or
Asking for your feedback on how effectively we are providing services.
SHASTA may use or disclose individually identifiable health information obtained through this Site to assist our business associates or other covered entities in their treatment, payment, or health care operation activities.
SHASTA may use your individually identifiable health information (including online personal information) to create aggregated anonymous information for the purposes of tailoring our Site to meet our customers’ needs and interests. Distribution and use of this aggregated, anonymous information will be restricted to SHASTA’s staff, management, agents and business associates who need aggregated statistical information about our users as a group, as well as the patterns of their Site usage.
SHASTA also may use your profile information on an aggregated basis to provide our editors with information that is useful in developing new features and content for the Site, and to provide our business associates, agents, or others permitted by law to receive aggregated information about our users and the usage patterns of the Site.
SHASTA reserves the right to perform statistical analyses of user behavior on an aggregate basis in order to measure interest in, and use of the various areas of the Site, and to inform business associates, agents, or others permitted by law to receive such information.
This Privacy Statement is effective as of the date listed at the top of this page. SHASTA may need to change this Privacy Statement from time to time to address new issues and to reflect changes on our Site, to our privacy practices, or for other operational, legal, or regulatory reasons. Please refer back to this Privacy Statement regularly, because your use of the Site signifies that you have read and understand this Privacy Statement and agree to abide and be bound by the Terms of Use, as amended from time to time.
In the unlikely event that SHASTA is acquired, merges with another entity or sells portions of its assets, our databases (which may contain your protected health information and online personal information) will be among transferred assets.
This Privacy Statement applies only to the personal information collected through the Sites or otherwise given to us by you through offline contact. The Site contains links to third-party websites that are not owned or controlled by us. These links are provided solely as a convenience to you and not as an endorsement or recommendation by SHASTA for the content on such third-party websites, or as an indication of any affiliation, sponsorship, or endorsement of or by such third-party websites. We are not responsible for and have not reviewed the privacy practices of these third-party websites, or the owners or operators of these third-party websites, the products or services they offer, or the tracking technologies they use. These third-party sites may have their own privacy policies or no policy at all. This Privacy Statement and the Terms of Use do not apply to such other sites. SHASTA has no control over the content displayed on such sites, nor over the measures, if any, that are taken by such sites to protect the privacy of user information. You should review any linked third-party websites, products, or services for their own privacy practices to determine what information about you may be collected and used when you use such third-party websites, products, or services.
Although parents are free to seek information available on the Site concerning the health of their children, no person under 18 years old is permitted to use these Sites. SHASTA does not direct this Site to children under the age of 18 years, or knowingly collect information from children under 18. Adults should not assist minors in accessing the Site. When users enter personal information on our Site, the user is representing to us that he/she is an adult and 18 years or older. We will be pleased to work with parents and guardians to delete from our records personal information a child may improperly disclose.
These Sites use commercially-reasonable physical, electronic, and administrative security measures to assist in protecting against the loss, misuse, and unauthorized alteration of personal information that is under our control. This includes the use of Secure Socket Layer (“SSL”) encryption technology to enhance data privacy and help prevent loss, misuse or alteration of information. This encryption technology, however, does not absolutely guarantee or safeguard the total privacy of user information that has been voluntarily disclosed to the Sites. As a result, we do not and cannot guarantee the security of our servers, the means by which personal information is transmitted between your computer or device and our servers, or any personal information provided to us or to any third party to or in connection with the Sites or otherwise.
Contact. If you have any questions or want additional information about this Privacy Statement or the Terms of Use, please visit the Contact page on the Sites.