MCS is committed to safeguard your Protected Health Information (PHI).  We are required by Law to maintain the privacy, security and confidentiality of your PHI, to provide you with this Notice of our legal duties and privacy practices with respect to PHI, and to inform affected individuals following a reportable breach of unsecured PHI.  

MCS is required to abide by the terms of this Notice.  However, we reserve the right to change or modify the terms of this Notice, and to make the provisions in our revised Notice effective for all PHI that we maintain. In the event, the terms of this Notice are revised, we will post a copy of the amended Notice in our Internet site, and will mail a printed copy of this document to our subscribers by its effective date.  Any type of information that MCS can collect and/or disclose, and that is considered non-public financial personal information as defined in Regulation Number 75 of the Office of the Commonwealth of Puerto Rico’s Insurance Commissioner, will also be considered as PHI as defined in 45 CFR Part 164, Section 164.501, and Chapter 14 – Protection of Health Information of the Puerto Rico Health Insurance Code – 26 L.P.R.A. 9231 and sigs., as amended.   

PHI is information that can identify you (name, last name, social security number); including demographic information (like address, zip code), obtained from you through a request or other document in order to obtain a service, created and received by a health care provider, a medical plan, intermediaries who submit claims for medical services, business associates, and that is related to (1) your health and physical or mental condition, past, present, or future; (2) the provision of medical care to you, or (3) past, present, or future payments for the provision of such medical care.  For purposes of this Notice, this information will be called PHI.  This Notice of Privacy Practices has been written and amended, so that it will comply with the HIPAA Privacy Regulation.  Any term not defined in this Notice will hold the same meaning as in the HIPAA Privacy Regulation.  We have also implemented policies and procedures for the handling of PHI, which you may examine, at your request. 


MCS may use and disclose PHI for the following purposes:
Treatment: For the provision, coordination, or supervision of your medical care, and other related services.  For example, the plan may disclose medical information to your health care provider for treatment, if so requested. 

Payment: To collect or provide payment for medical care, including collections and claims handling.  For example, the plan may use or disclose PHI in order to pay claims for health services rendered, or to provide eligibility information to your health care provider when you receive treatment.

Health care operations: To support our business functions. For example, for legal and audit processes, fraud and abuse detection, compliance, business planning and development, administrative activities, and businesses management. The plan might use or disclose your PHI in order to provide you with appointment or meeting reminders, information about treatment alternatives, or other health related benefits and services.  Also, we may disclose your health information to the sponsor of a health plan, in accordance with
Section 164.504(f) of the Privacy Regulation.  However, MCS is prohibited from using or disclosing PHI that is genetic information for underwriting related activities, in accordance with Section 164.520(b)(1)(iii) of the Privacy Regulation.     

Covered Entities
In order to perform our duties as insurance or benefit administrator, we may use or disclose PHI among the following entities: MCS Healthcare Holdings, LLC., MCS Life Insurance Company, MCS-Health Management Options (MCS-HMO), and MCS Advantage, Inc.

Business Associates
We contract with persons and organizations (business associates) so they can perform certain functions in our name, or to provide certain types of services. Business associates may receive, create, maintain, use, or disclose PHI, but only after they agree in writing to properly safeguard such information.  


Required by Law
We may use or disclose your PHI whenever Federal, State, or Local Laws require its use or disclosure.  In this Notice, the term “as required by Law” is defined the same as in the HIPAA Privacy regulation. 

Public health activities
We may use or disclose your PHI for public health activities, including the statistical report on illnesses and vital information, among others. 

Health oversight activities
We may use or disclose your PHI to those government agencies that regulate health care related activities.  

Food and Drug Administration (FDA)
We may use or disclose your PHI to the FDA in order to prevent an imminent threat to the health or national security in relation to adverse events involving food, supplements, products and product defects, among others.

Abuse or neglect
We may use or disclose your PHI to a government official authorized to receive reports of abuse or neglect against minors or adults or domestic violence situations.

Legal proceedings
We may use or disclose your PHI during the course of any judicial or administrative proceedings: (1) in response to an order from a court or administrative tribunal (provided that the covered entity discloses only the PHI expressly specified by such order); or (2) in response to a subpoena, discovery request, or other lawful process. 

Law enforcement officials
We may use or disclose your PHI to law enforcement officials.  For example, we may provide information necessary to report a crime, or to locate or identify a suspect, a fugitive, material witness or missing person, or necessary to provide evidence of a crime committed on our premises. 

Medical examiners, funeral directors, and organ donation cases
We may use or disclose your PHI to a medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law.  We may also disclose your information to a funeral director, as necessary to carry out its duties with respect to a decedent and to other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue.

We may use or disclose your PHI for research purposes, if an Institutional Review Board or an Ethics Committee: (1) has reviewed the research proposal and has established protocols to protect your information’s confidentiality, and (2) has approved the research as part of a limited data set, which does not include individual identifiers. 

To avert a serious threat to health or safety
We may use or disclose your PHI in order to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. 

Correctional institutions
We may disclose PHI to a correctional institution or a law enforcement official having lawful custody of an inmate: (1) for the provision of health care to the inmate; (2) in order to protect the health and safety of the inmate or other persons, or (3) in order to protect the health and safety of the entire correctional institution.

Worker’s compensation
We may use or disclose your PHI to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault. 

Disaster relief
We may disclose your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.  This way, your family may be provided with information about your health condition and your location in case of a disaster, or any other emergency.

Military activity, national security, protective services
We may disclose your PHI to appropriate military command authorities if you are a member of the Armed Forces, or a veteran.  Also, to authorized federal officials for the conduct of national security activities, lawful intelligence, counter-intelligence, or other national security and intelligence activities for the protection of the President, and other authorities, or heads of state.

Other persons participating in your health care
We may disclose limited PHI to a friend or family member who is involved with your care, or who is responsible for payment of medical services.  If you are not in person, if you are disabled, or it is an emergency, we will use our professional judgment in the disclosure of information that we understand will be in your better interest.

Information about your health care benefits
We may contact you in order to provide appointment reminders or information about treatment alternatives or other health related benefits and services that may be of interest to you.

Disclosures to you
We are required to disclose to you most of your PHI.  This includes, but is not limited to, all information related to your claims history. 

Disclosures to an authorized representative
We will disclose your PHI to a person designated by you as your authorized representative, and who qualifies for this designation in accordance with applicable laws of the Commonwealth of Puerto Rico. However, before we disclose PHI to your authorized representative, you must provide us with a written document designating this person as such, along with any other support documents (like a power of attorney or an Advanced Statement of Will Regarding Treatment).  A paper form is available for this purpose through our service centers and through our Internet site.         

Even when you designate an authorized representative, , HIPAA Privacy Regulations allow us not to treat this person as your authorized representative if, in our professional judgment, conclude that: (1) you have been or may be subject to domestic violence, abuse, or neglect by such person; (2) treating such person as your authorized representative could endanger you, or (3) we, in the exercise of professional judgment, decide that it is not in your best interest to treat this person as your authorized representative. 

With your authorization:
You may authorize us in writing to use or disclose your PHI to other persons, for any other purpose.  The authorization must be signed and dated by you, it must indicate the person or entity authorized to receive the information, a short description of the information been disclosed, and expiration date for the authorization.  Additionally, the following uses and disclosures require an authorization, in accordance with Section 164.508(a)(2) – (a)(4) of the Privacy Regulation: (a) For psychotherapy notes, which are notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record.  (b) For marketing activities, which involve communications about a product or service that encourage recipients of said communications to purchase or use the product or service.  (c) Sale of PHI, which involves the disclosure of PHI by a covered entity or business associate in exchange for direct or indirect remuneration.  You have the right to revoke the authorization in writing, in accordance with Section 164.508(b)(5) of the Privacy Regulation.  The revocation will be in effect for future uses and disclosures of your PHI, but it will not apply to information that we have already used or disclosed.  Unless you submit a written authorization, we may not use or disclose your PHI for any other reason not described in this Notice.

Disclosures to the Secretary of Health and Human Services
We are required to disclose your PHI to the Secretary of Health and Human Services in order to determine if we are in compliance with HIPAA regulations. 


Right to request a restriction
You have the right to request a restriction to certain uses and disclosures of PHI as provided in Section 164.522(a) of the Privacy Regulation.  However, we are not required to agree to any restriction that you request, except in case of a disclosure restricted under Section 164.522(a)(1)(vi) of the same regulation.  If we agree to a restriction, we will comply with the same, unless the information is needed in order to provide you with emergency treatment.  You may request a restriction by completing a request form, available at our service centers and through our Internet site.     

Right to confidential communications
You may request that we communicate with you concerning your PHI using an alternate method or physical location.  For example, you may request that we contact you only at your work address, or that of one of your relatives.  You may request confidential communications by completing a request form, available at our service centers and through our Internet site. 

Right to access
You have the right to inspect and copy your personal, financial, insurance, or health information, within the limits and exceptions provided by law.  In order to access your information, contact our Call Center to submit your request. We will validate your identity before providing assistance. You may also visit any of our Service Centers in order to submit a written request for a copy or to review your PHI.  We will provide you with access within 5 business days.    We may deny access to inspect or copy your PHI under certain limited circumstances.   

Right to amend
If you believe that your PHI, and that we keep in our files and/or systems, is incomplete or incorrect, you may request that we amend it.  You may submit a request to amend your PHI by completing a request form, available at our service centers or through our Internet site.   

Right to an accounting of disclosures
You have the right to request an accounting of certain disclosures of your PHI made by MCS, for events not related to medical treatment, payment for medical services, health care operations, or in compliance with your authorization.  You may request an accounting of disclosures by completing a request form available at our service centers or through our Internet site.             

Right to a printed copy of this Notice
You have the right to obtain a paper copy of this Notice of Privacy Practices at your request, even after agreeing to receive a copy in electronic form.     

You have the right to file a complaint with MCS and the Secretary of the Department of Health and Human Services (DHHS), if you believe that your privacy rights have been violated.  All complaints must: (1) be filed in writing; (2) include the name of the covered entity that is the subject of the complaint; (3) describe the acts or omissions believed to be in violation of the standards, and (4) be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred.  We will not penalize nor retaliate against you for filing a complaint with the Secretary of DHHS, or with MCS.   

MCS complies with applicable Federal civil rights laws and do not discriminate on the basis of race, color, national origin, age, disability, or sex. MCS does not exclude people or treat them differently because of race, color, national origin, age, disability, or sex. MCS provides free aids and services to people with disabilities to communicate effectively with us, such as: qualified sign language interpreters, written information in other formats (large print, audio, accessible electronic formats, other formats). MCS provides free language services to people whose primary language is not English, such as: qualified interpreters, and information written in other languages. If you need these services, contact our Call Center. If you believe that MCS has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, or sex, you can file a grievance with: MCS Call Center, PO BOX 191720, San Juan, PR 00919-1720, 787-281-2800 (Metro Area), 1-888-758-1616 (toll free), 1-866-627-8182 (TTY users). You can file a grievance in person or by mail. If you need help filing a grievance, our Call Center is available to help you. You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights electronically through the Office for Civil Rights Complaint Portal, available at, or by mail or phone at: U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201, 1-800-368-1019, 800-537-7697 (TDD). Complaint forms are available at

ATTENTION: If you speak English, language assistance services, free of charge, are available to you. Call 1.888.758.1616 (TTY: 1.866.627.8182). ATENCIÓN: Si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame al 1.888.758.1616 (TTY: 1.866.627.8182). 注意:如果您使用繁體中文,您可以免費獲得語言援助服務。請致電 1.888.758.1616(TTY: 1.866.627.8182

You may request additional information about this Notice of Privacy Practices, or file a complaint with MCS at the following address:

Attention: Privacy Officer
Box 9023547
San Juan, PR 00902-3547

Telephone line for Privacy and Security
Metropolitan Area: (787) 620-3186
Toll Free: 1-877-627-0004

This Notice of Privacy Practices is effective on September 22, 2013. 

June 14, 2017 


My Account
Log out
Register to My MCS
I'm an Employer
I'm a Provider