Quality Improvement Organization Manual 
Chapter 10 - Confidentiality and Disclosure 
 
 
Table Of Contents 
(Rev. 15, 06-30-06) 
 
Transmittals for Chapter 10 
 
ACQUISITION, PROTECTION, AND DISCLOSURE OF QIO INFORMATION 
 
10000 - Statutory and Regulatory Requirements 
10010 - General Requirements 
10020 - Non-confidential Information 
10030 - Confidential Information 
10040 - Disclosure of QIO Deliberations 
10050 - Disclosure of Confidential QIO Information to Officials and Agencies 
10060 - Disclosure of QIO Information Involving Beneficiary Complaints 
10070 - Disclosure of QIO Information for Research Purposes -- Quality Review Study 
(QRS) Information 
10080 - Disclosure of QIO Sanction Information 
10090 - Re-disclosure of QIO Information 
 
EXHIBITS 
 
Exhibit 10-1 - Model Data Use Agreement 
Exhibit 10-2 - Model Letter 
Exhibit 10-3 - Model Language  10000 - Statutory and Regulatory Requirements 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  Part B of Title XI of the Social Security Act (the Act) 
 
This part contains several provisions that affect the confidentiality of your information. 
 
  Sections 1154, 1156, and 1160 of the Act provide the statutory bases for the 
acquisition, protection, and disclosure of your information. 
 
  Section 1160 of the Act also establishes the scope of your authority to disclose 
information for program purposes, including any required mandatory disclosures.  
It also addresses your responsibility to protect your information from 
unauthorized disclosure and provides penalties for unauthorized disclosure.  
Section 1160(a) specifies that you are not governed by the disclosure provisions 
contained in the Freedom of Information Act. 
 
B.  Regulations at 42 CFR Part 480 
 
These regulations implement the above referenced provisions of the Act and describe 
your authority to disclose information and your responsibility to protect it from 
unauthorized disclosure. 
 
C.  Sections 1171 - 1179 of Part C of Title XI of the Act (Added by 262 and 264 of the 
Health Insurance Portability and Accountability Act (HIPAA) (Public Law 104-191)) 
 
These sections require the Secretary to adopt standards to facilitate a national electronic 
health data system, including standards for certain administrative transactions, code sets, 
and health identifiers, and standards necessary to protect the privacy and security of 
health data.  These standards apply to all health plans, including Medicare and the State 
Medicaid plans, as well as all health care providers that conduct electronic transactions 
that meet the standards adopted by the Secretary. 
 
D.  Regulations at 45 CFR Parts 160, 162, and 164 
 
These regulations (the Privacy Rule) implement the requirements of 1171-1179 of the 
Act and 264(c) of the Health Insurance Portability and Accountability Act of 1996 
(HIPAA). 
 
For purposes of the Privacy Rule, the Centers for Medicare & Medicaid Services (CMS) 
have made the following statements regarding submission of protected health information 
to Quality Improvement Organizations (QIOs): 
 
  Medicare Quality Improvement Organizations (QIOs) perform certain review and 
other functions for the Centers for Medicare & Medicaid Services (CMS) under 
contracts with CMS.  These functions are required under Part B of Title XI of the  Social Security Act.  Part B of Title XI also requires that Medicare providers and 
suppliers (which are, in general, covered entities under HIPAA) disclose 
information on Medicare beneficiaries to QIOs so that QIOs can perform the 
requirements under their Medicare contracts.  If a Medicare provider or supplier 
is a covered entity, it is subject to the Privacy Rule which implements provisions 
of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and 
generally cannot disclose protected health information on Medicare beneficiaries 
or other patients without the permission of the patients, unless the Privacy Rule 
otherwise allows disclosure.  If a disclosure is required by law, however, the 
Privacy Rule allows the disclosure without the patients permission under 45 CFR 
164.512(a).  Therefore, when a covered entity discloses to a QIO information on 
Medicare beneficiaries that the QIO needs in order to perform under its contract 
with CMS, patient permission is not required. 
 
  You must enter into a business associate agreement, as defined by the Health 
Insurance Portability and Accountability Act (HIPAA) Privacy Rule, for any 
activities assigned to you whereby you are using or receiving protected health 
information on behalf of CMS for CMS covered functions, such as payment or 
health care operations activities.  No business associate agreement is required 
for uses or disclosures of protected health information by a QIO that are for 
CMS health oversight activities.  When you are performing any quality 
improvement or Medicare review activities related to payment, you must abide by 
the HIPAA Privacy Rule.  For any activities related to payment, there must be a 
Business Associates Agreement between CMS and you.  Your contract with the 
Secretary serves as the Business Associate Agreement.  The HIPAA Privacy Rule 
defines a health oversight agency to include a Federal or other governmental 
agency or authority that is authorized by law to oversee the health care system 
(whether public or private), or government programs in which health information 
is necessary to determine eligibility or compliance with program standards (45 
CFR 164.501).  Oversight agencies also include a person or entity acting under a 
contract with the public agency.  Under 42 CFR 164.512(d), a covered entity may 
disclose protected health information to a health oversight agency without the 
patients permission for oversight activities authorized by law, including 
oversight of compliance with program standards. 
 
  Part B of Title XI requires Medicare QIOs, as CMS contractors, to conduct 
activities necessary for appropriate oversight of the health care system.  
Specifically, Medicare QIOs are health oversight agencies to the extent that they 
are acting under contract with Medicare to oversee the health care system in 
general or in compliance with quality standards under Medicare.  This includes 
collecting and reviewing quality performance measures from hospitals regarding 
Medicare and non-Medicare patients, such as reports on surgical infection 
prevention, acute myocardial infarction, and influenza and pneumococcal 
immunization.  When a QIO is acting as a health oversight agency, a covered 
entity may make disclosures to the QIO for health care oversight purposes 
without patient permission.   
E.  Section 1157 of the Act 
 
This section provides certain protections to those who disclose information to you.  No 
person providing information to QIOs will be held, by reason of having provided such 
information, to have violated any criminal law or to be civilly liable under any State or 
Federal law, unless the information provided is unrelated to the performance of the 
contract of the QIO, or if the information is false and the person or entity providing the 
information knew, or had reason to believe, that the information was false. 
 
The statutes and regulations cited above apply only to information collected, acquired, or 
generated by you as a result of your Medicare review activities.  These provisions do not 
apply to non-Medicare information generated by your activities under another contract 
(e.g., Medicaid review, another contract with CMS, a contract with another Federal 
agency). 
 
10010 - General Requirements 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  QIO Access to Information 
 
As specified in 42 CFR 480.111 through 480.113, you have access to medical records 
and other pertinent material that you need to carry out your statutory responsibilities.  As 
specified in 42 CFR 480.114, your data collection is limited to the information needed to 
accomplish the purposes of Part B of title XI of the Act.  The HIPAA Privacy Rule does 
not alter your authority to receive information that you require to perform the 
requirements of your Medicare contract.  If medical/quality issues raised in the course of 
your review cannot be resolved by examining medical record information alone, request 
the additional information you need to make a determination.  At its option, the facility 
may (but is not required to) provide you with internal documents such as incident reports.  
If the facility chooses not to submit the necessary information, make your determination 
with the information available. 
 
B.  Responsibility to Protect Information 
 
As specified in 42 CFR 480.115, implement reasonable security measures to ensure the 
integrity of your information and prevent unauthorized access. 
 
  Confidentiality Plan -- Your written confidentiality plan must: 
 
-  Address the regulatory requirements specified at 42 CFR 480.115; 
 
-  Be sufficiently detailed to guide employees in day-to-day operations; 
 
-  Include the security measures for protecting QIO electronic data and 
confidential information when it is offsite; and   
-  Require prior approval by CMS for any use of data acquired, collected, or 
generated by you under your contract with CMS for purposes not included 
under your contract with CMS. 
 
  Training of Personnel -- Instruct your officers and employees and health care 
institution employees participating in your review activities of their responsibility 
to maintain the confidentiality of information.  Train all personnel involved in 
transporting confidential information to handle the material properly.  Document 
all training in your security records.  Regulations at 42 CFR 480.115(c) state that 
the QIO must train participants of the QIO review system in the proper 
handling of confidential information.  The review system is broadly defined and 
includes subcontractors, practitioners, and data support organizations. 
 
  Transportation of Confidential Information -- All confidential information 
transported offsite must be handled properly.  Store confidential information 
located offsite under lock and key.  At a minimum, place material being 
transported by car in the car's locked trunk and never leave the car unattended 
during loading and unloading.  When using public transportation, carry 
confidential material in a locked briefcase or suitcase. 
 
Properly package confidential information mailed to or from offsite locations.  Envelopes 
and other containers should consist of materials and be in sizes and shapes that facilitate 
mail handling and discourage breakage.  Seal packages properly and use the type of tape 
that cannot be torn.  Double-wrap packages to be mailed and identify on the inner 
wrapping that the material is confidential, and indicate who is authorized to open the 
package. 
 
At a minimum, send confidential information via first class mail.  Use higher mailing 
levels when circumstances indicate the need for additional security. 
 
C.  QIO's Notification Requirement 
 
Prior to disclosing your information, comply with any applicable notification 
requirements in 42 CFR 480.104(a) and 480.105.  Also, comply with the general notice 
requirements specified in 42 CFR 480.116 for the notice you must send to patients, 
practitioners, and institutions under review.  Specific exceptions to the notice 
requirements are found in 42 CFR 480.106.  QIOs are not required to provide notice of 
disclosure to the provider if the disclosure is made: 
 
1.  As part of an investigation of fraud or abuse by the Office of the Inspector 
General (OIG) or General Accounting Office (GAO); 
 
2.  As part of an investigation of fraud or abuse by any other Federal or State 
fraud or abuse agency and the investigative agency specifies in writing that 
the information is related to a potentially prosecutable criminal offense;   
3.  As a QIO referral to OIG regarding probable fraud or abuse (generally, OIG 
becomes involved only after other attempts, such as corrective action plans, 
have been tried (and failed to correct a problem); or 
 
4.  In the event of imminent danger to individuals or public health.  In this case 
the notification can be sent simultaneously with the disclosure. 
 
D.  Verification and Amendment of QIO Information 
 
Citation 42 CFR 480.134 requires you to verify the accuracy of your information and 
make any necessary corrections. 
 
Individuals and facilities can request that you correct and amend pertinent information in 
your possession.  At such request, advise the requesting individual/facility of your 
decision and any actions taken regarding the request.  Make any corrections to your data 
that are needed, and if the data have already been disclosed, forward the amended 
information to the recipients if the change may affect decisions about a particular 
provider, practitioner, or case under review. 
 
E.  Individual's Access to Information About Himself or Herself 
 
Beneficiary -- Disclose information to the beneficiary or his/her representative within 30 
days after you receive a written request as specified in 42 CFR 480.132.  A beneficiary is 
entitled to have access to information pertaining to him or her, including psychiatric 
records and records concerning alcohol/drug abuse.  However, if knowledge of the 
information would be harmful to the beneficiary, disclose the information to his/her 
representative rather than to the beneficiary.  Determine whether direct disclosure would 
harm the beneficiary, in accordance with 42 CFR 132(a)(2). 
 
Consistent with the disclosure authority at 42 CFR 480.132(a) and 480.132(b) (relating to 
requests that are connected with an initial denial determination), and as required by 42 
CFR 478.24(a), upon request provide a beneficiary with an opportunity to examine the 
material you used as the basis for your initial denial determination.  To comply with this 
requirement, provide the beneficiary with all pertinent material, not just the medical 
record.  Include all practitioner-specific information concerning the services that the 
beneficiary received.  Disclose the practitioner-specific information with or without the 
consent of the practitioners identified (see 480.133(b)). 
 
When a beneficiary's request for his/her medical record is not related to an appeal of your 
denial determination, as specified at 42 CFR 478.24(a), provide him/her with any 
applicable records in your possession, as required by 42 CFR 480.132(a).  Before 
disclosing information under this authority, however, redact any material that explicitly 
or implicitly identifies practitioners or QIO reviewers (unless they have consented to 
disclosure), other patients, or QIO deliberations. 
  Without prolonging the timeframes to release the records requested, you may encourage 
the beneficiary to seek the medical record from the appropriate hospital.  If the 
beneficiary declines this advice, you are still bound to provide the records as specified 
above. 
 
  Practitioners and Reviewers -- Disclose information to practitioners and your 
reviewers as specified at 42 CFR 480.133(a)(1).  You may also disclose 
information on a particular practitioner or reviewer to a third party if the 
individual identified in the information consents to or requests the disclosure.  
The disclosed information, however, cannot identify other individuals without 
their consent. 
 
  Health Care Facilities -- Disclose information to health care facilities as specified 
at 42 CFR 480.133(a)(1).  Facility-specific information is non-confidential unless 
the material is part of your deliberations or contains confidential information as 
defined at 42 CFR 480.101(b). 
 
F.  Disclosure To a Beneficiary's Representative 
 
Disclose information to the beneficiary's representative instead of directly to the 
beneficiary when required by 42 CFR 480.132.  In seeking beneficiary information, a 
properly designated beneficiary representative may exercise the same rights and 
privileges as the beneficiary. 
 
If the beneficiary is deceased, disclose the information to the first appropriate individual 
according to the following order: 
 
  To the executor of the estate; 
 
  To the administrator of the estate; or 
 
  To an individual verified in writing to be the beneficiary's designated 
representative. 
 
The appointment and terms of the representation must be valid under State law, and the 
above order would be superseded by any State law that conflicts with it. 
 
If the beneficiary is mentally, legally, or physically unable to designate a representative, 
disclose the information to a person whom you determine is responsible for the patient.  
You must first attempt to make that determination based on the medical record.  If the 
medical record does not provide the necessary information, you may rely upon the 
attending physician for the information.  Disclose the information to the first appropriate 
individual according to the following order: 
 
  The beneficiary's legal guardian; 
    A relative or other person who receives social security or other governmental 
benefits on the beneficiary's behalf; 
 
  A relative or other person who arranges for the beneficiary's treatment, or 
exercises other responsibility for his/her affairs; 
 
  A representative of an agency or institution that did not furnish the services for 
which payment is claimed, but furnished other care, services, or assistance to the 
beneficiary; or 
 
  A representative of the provider or of the nonparticipating hospital claiming 
payment for services it has furnished if the provider or nonparticipating hospital is 
unable to have the claim signed by one of the above-listed individuals or entities. 
 
As specified at 42 CFR 424.37, when a party signs a claim or a request for a payment 
statement, he/she must also submit a brief statement that: 
 
  Describes his/her relationship to the beneficiary; and 
 
  Explains the circumstances that make it impractical for the beneficiary to sign the 
claim, statement, or request. 
 
10020 - Non-confidential Information 
(Rev. 6, 08-01-03) 
 
A.  Types of Non-confidential Information  
 
Non-confidential information generally includes any information that does not meet the 
definition of confidential information found in 42 CFR 480.101(b).  It includes, but is not 
limited to, those items specified in 42 CFR 480.120(a). 
 
Facility-specific information that does not contain your deliberations or confidential 
information (as defined by 42 CFR 480.101(b)) is non-confidential. 
 
B.  Disclosure of Non-confidential Information  
 
Disclose non-confidential information, upon request, as specified in 42 CFR 480.120.  As 
provided by 42 CFR 480.121, you may also disclose non-confidential information on 
your own initiative. 
 
Upon request, disclose material such as lists of your meetings and dates of their 
occurrence as long as there is no confidential information included in the material.  
Disclose summaries of proceedings of your meetings if the material contains no 
confidential information. 
 
  10030 - Confidential Information 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  Definition of Confidential Information 
 
Confidential information is defined at 42 CFR 480.101(b). 
 
B.  Disclosure of Confidential Information 
 
Disclose confidential information only as authorized under 42 CFR 480.130 through 
480.143.  For all information gathered or developed as part of a Quality Review Study 
(QRS), follow the requirements at 42 CFR 480.140 (All Health Care Quality 
Improvement activities are defined as QRSs). 
 
As specified at 42 CFR 480.135(a), the QIO is to disclose confidential information as 
necessary to fulfill its duties and functions under title XI of the Act.  This includes any 
disclosures needed to properly complete the appeals process.  As specified in 42 CFR 
480.135(c)(1), disclose confidential information to another QIO when the material is 
related to patients, providers, or practitioners who are subject to review by the other QIO.  
This includes sanction information as well as any other pertinent information. 
 
Disclose practitioner-specific information about potential and confirmed quality concerns 
to the involved practitioner and to the facility where the services were furnished (See 
7200-7250).  Each facility should designate specific officials to receive your notices 
and other confidential disclosures. 
 
C.  Information About Interns and Residents 
 
Your disclosure of practitioner-specific information involving interns and residents is 
restricted in the same manner as other practitioner-specific information.  Generally, you 
cannot disclose an intern's/resident's quality problems to program officials, attending 
physicians, or residency/intern program accrediting bodies without the consent of the 
affected individual.  If the residency/intern program is operated by the involved hospital, 
however, quality review findings that you disclose to the hospital may be shared by the 
hospital with residency/intern program officials as internal communications, when 
appropriate. 
 
D.  Disclosure of Confidential Information To Elected Officials 
 
See 5010B.1. 
 
10040 - Disclosure of QIO Deliberations 
(Rev. 6, 08-01-03) 
 
Regardless of any other provision, disclose your deliberations only as specified in 42 
CFR 480.139(a).   
10050 - Disclosure of Confidential QIO Information to Officials and 
Agencies 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  Disclosure to the Department of Health & Human Services (DHHS) 
 
Upon request, disclose confidential information to DHHS as specified at 42 CFR 
480.130, except for your QIO deliberations and QRS data, which are governed by 42 
CFR 480.139 and 480.140 respectively.  For example, a QIO can disclose QRS 
information with identifiers of a specific practitioner or institution with the written 
request or consent of the specific practitioner or institution (see 42 CFR 480.140(2)(d)). 
 
B.  Disclosure for Purposes of Monitoring and Evaluation 
 
Upon request, disclose confidential information to CMS or any person, organization, or 
agency authorized by DHHS or Federal statute to monitor your performance as specified 
in 42 CFR 480.131.  The information that you are required to disclose includes copies of 
medical records of Medicare beneficiaries that are maintained by health care facilities or 
health care practitioners. 
 
C.  Disclosure to Consultants and Subcontractors 
 
As specified in 42 CFR 480.135(b), disclose information to consultants and 
subcontractors when the individual/organization needs the information to provide you 
with specified services.  Consultants and subcontractors should receive the same training 
and information as your employees. 
 
D.  Disclosure to Intermediaries and Carriers 
 
Disclose confidential information to intermediaries and carriers as specified in 42 CFR 
480.136, which authorizes disclosure of information relevant to the intermediary's or 
carrier's responsibility for making proper payment determinations.  This includes 
disclosures needed to coordinate medical review activities between you and the 
intermediary or carrier. 
 
E.  Disclosures to Federal and State Enforcement Agencies 
 
As specified at 42 CFR 480.137, disclose information related to investigations of fraud or 
abuse of the Medicare or Medicaid programs to Federal and State enforcement agencies. 
 
F.  Disclosure to Licensing, Certification, and Accreditation Bodies 
 
Disclose information to licensing and certification bodies as specified in 42 CFR 
480.138(a)(1).  A licensing or certification body has access to any confidential 
information directly related to its official duties, including sanction recommendations that  you forward to OIG.  Unless the disclosure is an exception specified at 42 CFR 480.106, 
comply with the notification requirements at 42 CFR 480.105 before disclosing your 
information. The citation at 42 CFR 480.140(a)(1) requires that a QIO disclose, onsite, 
to accreditation agencies as is required for them to carry out the functions that are within 
their jurisdiction under State law. 
 
G.  Disclosures to Other QIOs 
 
A QIO may disclose to another QIO information on patients and practitioners who are 
subject to review by the other QIO only if that data are needed to carry out their 
Statement of Work or necessary to complete a special study awarded from CMS as a 
quality improvement initiative.  Additionally, you may share identifiable data about 
patients, practitioners, or providers in your State with another QIO so long as that QIO 
applies the same confidentiality restrictions to your data that it is required to apply to its 
own. 
 
H.  Disclosures to Medical Review Boards 
 
Disclose to medical review boards established under 1881 of the Act information on 
patients, practitioners, and institutions receiving or furnishing end stage renal disease 
services. 
 
10060 - Disclosure of QIO Information Involving Beneficiary 
Complaints 
(Rev. 6, 08-01-03) 
 
Section 1154(a)(14) of the Act requires you to conduct an appropriate review of all 
written complaints from Medicare beneficiaries or their designated representatives about 
the quality of Medicare services.  Ensure that any disclosure of information is consistent 
with applicable provisions of 42 CFR Part 480. 
 
10070 - Disclosure of QIO Information for Research Purposes -- Quality 
Review Study (QRS) Information 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  Independent Research Activities 
 
You cannot disclose information that explicitly identifies institutions, practitioners, or 
your reviewers without their consent.  You may disclose non-QRS information after 
deleting all confidential identifiers and any other information from which identification 
of an individual can be deduced.  You must release de-identified information derived 
from information gathered as part of a QRS to individuals or organizations that request 
this information.  De-identified means that all explicit and implicit identifiers of patients, 
practitioners, and providers (which include health plans) have been removed, encrypted, 
or otherwise modified to ensure that the identity of individuals or institutions may not be 
determined.  Once the information has been de-identified, it becomes non-confidential  and the requirements of 42 CFR 480.120(a)(8) and 10020 of the QIO Manual apply.  
Specifically, you must conform to the following conditions to have such information de-
identified for release. 
 
When requesting de-identification of QRS information for release, you must: 
 
  Obtain prior approval from your Project Officer (PO). 
 
  Conclude a Data Use Agreement (DUA) with the researcher prior to de-
identification (See Exhibit 10-1 - Model Data Use Agreement).  When it is 
completed, your PO should receive a copy. 
 
  The DUA should specify both the length of time the researcher will need the data 
for the active analyses and, if applicable, the length of time you must retain the 
dataset following the active analyses (See below) (The intent of this requirement 
is to minimize the possibility that the researcher might mistakenly use the data for 
a purpose not covered by the Agreement). 
 
  Request that the Standard Data Processing System (SDPS) contractor prepare the 
de-identified dataset.  You may not independently de-identify data.  Procedures 
for requesting the SDPS contractor's assistance are outlined in SDPS 
Memorandum 01-232-GN. 
 
  At the request of the researcher and with the approval of your PO, request the 
SDPS contractor to link its data with other data provided by the researcher so long 
as all explicit and implicit identifiers are removed from the resulting dataset. 
 
OR 
 
  At the request of the researcher and with the approval of your PO, request the 
SDPS contractor to link its data with CMS data so long as all explicit and implicit 
identifiers are removed from the resulting dataset.  For CMS datasets, the 
researcher does not have to provide an actual data file; however, the researcher 
must: 
 
-  Submit a data request package to CMS Office of Information Services 
(OIS) for the CMS data that will be linked with the QIO data.  The request 
package must include:  a detailed request letter, project summary/protocol, 
proof of funding, and CMS DUA.  If the project is Federally funded, it 
must also include a request/support letter from the Federal PO and the 
Federal PO must sign the CMS DUA.  Additionally, provide OIS evidence 
of the approved QIO DUA. 
 
-  Once the request has been reviewed and approved by OIS, OIS will notify 
the Office of Clinical Standards and Quality (OCSQ) of its approval.   Once OIS approval for the use of the QIO data is confirmed, the SDPS 
contractor can perform the data pull and match. 
 
  At the request of the researcher, archive the dataset in the offline electronic 
medium provided by the SDPS contractor for up to 5 additional years following 
the completion of the active analyses.  This retention period must be specified in 
the DUA. 
 
  If the user wishes to access the archived data for purposes of validating his 
conclusions, he must request a return of the dataset in writing.  The request must 
specify the purpose for the request, the length of time needed for that purpose, and 
when the data will be returned. 
 
  In the event that your contract with CMS is terminated prior to the termination of 
either the active analysis period or the retention period specified in the DUA, 
provide full documentation to the new QIO, which will conclude a new DUA with 
the researcher.  If a new agreement is not concluded, the user forfeits all rights 
and privileges specified in this agreement and must return the data immediately. 
 
  Maintain a record of all de-identified data provided and ensure that they are 
returned or destroyed as required in the DUA (The intent is to ensure that 
unneeded data are destroyed and not retained indefinitely). 
 
  Should the same researcher wish to use the dataset for another project or should 
another researcher request the same dataset from you, prior to its release, you 
must conclude another DUA and provide your PO with a copy of that agreement. 
 
  You may charge a fee for this service.  This fee may not exceed the amount 
necessary to recover the cost to you and the SDPS contractor for providing the 
information (see 42 CFR 480.104(c)). 
 
This policy does not permit you to de-identify data provided by CMS for purposes of 
performing your contract (see Section H of your Contract). 
 
B.  Use of CMS-provided Data and/or Statutory Authority to Obtain Medical Records 
 
You may not use information provided by CMS or information acquired through the 
statutory authority to obtain medical records granted by your Contract for any purpose 
other than one specifically authorized by that Contract.  For example, you may not use 
Medicare Provider Analysis & Review (MedPAR) or enrollment data obtained from 
CMS to provide a random sample for a researcher, nor may you use your Contract 
authority to obtain medical records and related information for purposes other than those 
provided for in that Contract. 
 
If you request medical information in any capacity other than that of a QIO, as specified 
in your QIO contract with CMS, any request to a practitioner, provider, or beneficiary  must clearly indicate that you are requesting the information outside your capacity as a 
QIO.  In addition, include the following language within any such request: 
 
  "You are not required to provide the information requested in this letter.  Neither 
your Medicare benefits nor your participation in the Medicare program will be 
affected should you decide not to participate." 
 
This language is not required when a researcher is your employee (either part or full-
time) and the activities being carried out relate directly to a Quality Improvement Project 
that you are conducting and which is funded by your QIO Contract. 
 
C.  Provider and/or Practitioner Ability to Designate an Agent to Receive Certain 
Information 
 
If a provider or practitioner, in writing, designates another party (e.g., corporate owner) 
as their agent for the receipt of specific data which they may obtain from you, you may, 
upon the written request of the provider(s) or practitioner(s), transmit the specified data to 
the agent either in lieu of or in addition to transmitting it to the provider(s) or 
practitioner(s).  You must receive from the provider or practitioner both a designation of 
the agent and a request to send specific data to the agent.  These items may be contained 
in the same written instrument (See Exhibit 10-2 - Model Letter).  In addition, when the 
requested data is sent to the agent, the agent must be advised of important information 
about re-disclosing data received from a QIO or Network (See Exhibit 10-3 - Model 
Language).  You should inform your CMS PO of such arrangements and maintain 
adequate documentation of the arrangement.  You may charge the reasonable costs of the 
disclosure in accordance with the provisions of 42 CFR 480.104(c). 
 
D.  DHHS Research Activities 
 
Research entities acting as employees or subcontractors of DHHS have access to your 
non-QRS confidential information when it is needed to accomplish DHHS' objectives.  
Provide this information in the manner and form required by DHHS in accordance with 
42 CFR 480.130. 
 
10080 - Disclosure of QIO Sanction Information 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
As specified in 42 CFR 480.142, disclose sanction reports to OIG, CMS, and State and 
Federal agencies that investigate and prosecute fraud and abuse.  Disclose relevant 
sanction information, including sanction reports, to licensing, certification, and 
accreditation bodies under the authority and limitations specified in 1160(b)(1)(C) of the 
Social Security Act, 42 CFR 1004.70(c), and 480.138(a)(1). 
 
Concurrent with your final notice, provide the affected practitioner or other person with a 
copy of the complete sanction report and recommendations that you are submitting to 
OIG (see 9000-9070 and 42 CFR 1004.70(b)).   
The sanction information that can be disclosed to licensing, certification, and 
accreditation bodies under the authority of 42 CFR 480.138(a)(1) includes only those 
portions of the file that the body needs to conduct its official duties (e.g., a synopsis of 
the particular case).  Do not include the entire medical record or unnecessary information 
such as an overview of the sanction process.  Determine, on a case-by-case basis, whether 
release of patient-specific information is appropriate. 
 
10090 - Re-disclosure of QIO Information 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
A.  Re-disclosure of Non-confidential Information 
 
There are no statutory or regulatory restrictions that limit a recipient's re-disclosure of 
your non-confidential information. 
 
B.  Re-disclosure of Confidential Information 
 
No recipient of your confidential information may re-disclose the information except 
under the limited circumstances authorized by 42 CFR 480.107. 
 
Recipients of your confidential information (beneficiaries, practitioners, and providers) 
may re-disclose information about themselves provided the re-disclosure does not 
explicitly or implicitly identify another individual. 
 
C.  Notifying Recipients About Re-disclosing Confidential Information 
 
The regulation at 42 CFR 480.104(a)(2) requires you to inform recipients, in writing, that 
they cannot re-disclose confidential information you disclose to them except as permitted 
under 42 CFR 480.107.  Your written notice should also advise the recipient of the 
penalties for unauthorized disclosures. 
 
Explain in your notice to the recipient that, except as authorized at 42 CFR 480.107, 
confidential information cannot be re-disclosed unless the practitioner or provider who 
initiated the request and who would be identified, consents to or requests the re-
disclosure.  Otherwise, all confidential personal identifiers must be removed.  The notice 
can be a separate attachment to the information provided, or you can include the notice 
in your response to the recipient.  Beneficiaries do not have the right to consent to having 
their information provided to a third party. 
 
As part of your responsibility to educate practitioners and providers about your review 
process (see 42 CFR 480.116), conduct activities that inform individuals and facilities in 
your area of the rules and restrictions applicable to confidential information.  Improper 
re-disclosures of confidential information are generally inadvertent rather than 
intentional.  Accordingly, provide educational programs to avoid problems. 
  Exhibit 10-1 - Model Data Use Agreement 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
Agreement for Use of Health Care Data: 
 
In order to ensure the integrity, security, and confidentiality of information maintained by 
the (QIO Name), in compliance with their Medicare Quality Improvement Organization 
for (State Name) Contract #(Fill In) and with the confidentiality requirements as outlined 
in 42 CFR 480 and clause H.8. of their Contract, and to permit appropriate disclosure and 
use of such data as permitted by law, (QIO Name) and (Name of User) enter into this 
agreement to comply with the following specific paragraphs: 
 
1.  This agreement is by and between the (QIO Name), a Federally-designated 
Quality Improvement Organization under contract to the Centers for Medicare & 
Medicaid Services (CMS) Contract #(Fill In), and (Name of User) hereinafter 
termed "User." 
 
2.  This Agreement addresses the conditions under which (QIO Name) will disclose 
and the User will obtain and use the (QIO Name) data file(s) specified in 
paragraph 7.  This agreement supersedes any and all agreements between the 
parties with respect to the use of the data from the files specified in paragraph 7 
specified herein.  Further, the terms of this Agreement can be changed only by a 
written modification to this agreement or by the parties adopting a new 
agreement.  The parties agree further that instructions or interpretations issued to 
the User concerning this Agreement or the data specified herein, shall not be valid 
unless issued in writing by the (QIO Name) point-of-contact specified in 
paragraph 5 or the (QIO Name) signatory to this Agreement shown in paragraph 
24. 
 
3.  The parties mutually agree that (QIO Name) retains all ownership rights to the 
data file(s) referred to in this Agreement, and that the User does not obtain any 
right, title, or interest in any of the data furnished by (QIO Name). 
 
4.  The parties mutually agree that the following named individual is designated as 
"Custodian" of the file(s) on behalf of the User and will be personally responsible 
for the observance of all conditions of use and for establishment and maintenance 
of security arrangements as specified in this Agreement to prevent unauthorized 
use.  The User agrees to notify (QIO Name) within 15 days of any changes of 
custodianship.  The parties mutually agree that (QIO Name) may disapprove the 
appointment of a custodian or may require the appointment of a new custodian at 
any time. 
 
  (Name of Custodian) (Title of Custodian) 
  (Company/Organization) 
  (Street Address) 
  (City/State/ZIP Code)    (Phone Number - Including Area Code) (Email Address) 
 
5.  The parties mutually agree that the following named individual will be designated 
as "point-of-contact" for the Agreement on behalf of (QIO Name). 
 
  (Name of Contact) (Title of Contact) 
  (Company/Organization) 
  (Street Address) 
  (City/State/ZIP Code) 
  (Phone Number - Including Area Code) (Email Address) 
 
6.  The User represents and warrants, and in furnishing the data file(s) specified in 
paragraph 7 (QIO Name) relies upon such representation and warranty, that such 
data file(s) will be used solely for the following purpose(s):  (The following 
material is included as an example) 
 
  To support HSPHs Agency for Healthcare Quality Research (AHQR) 
grant "Validating Guidelines for the Care of AMI Patients." 
 
  The User represents and warrants further that the facts and statements 
made in any study or research protocol or project plan submitted to the 
(Name of Funding Entity) for each purpose are complete and accurate.  
Further, the User represents and warrants that said study protocol(s) or 
project plans, as have been approved by (Name of Funding Entity), 
represent the total use(s) to which the data file(s) specified in paragraph 
will be put. 
 
  The User represents and warrants further that, except as specified in an 
Attachment to this Agreement or except as (QIO Name) shall authorize in 
writing, the User shall not disclose, release, reveal, show, or otherwise 
grant access to the data covered by this Agreement to any person.  The 
User shall not sell, rent, lease, or loan the data covered by the Agreement 
to any person.  The User agrees that, within the User organization, access 
to the data covered by this Agreement shall be limited to the minimum 
number of individuals necessary to achieve the purpose stated in this 
section and to those individuals on a need-to-know basis only. 
 
  The User represents and warrants further that he shall not report any 
analyses that would require using either a patient, practitioner, or provider 
identifier (whether explicit or implicit) (e.g., physician specialty, hospital 
bed size, etc.) to obtain additional information. 
 
7.  The following (QIO Name) furnished data file(s) is/are covered under this 
Agreement:  (The following material is included as an example) 
 
  File:  Year(s):    CCP National Data Sample:  2/94 - 2/95 
  CCP National Data Sample:  2/95 - 7/95 
  Inpatient claims (Part A) for these beneficiaries identified in CCP National 
Data Sample including claims for the index AMI Admissions and all 
hospitalizations within a year of the index Admission:  1/1/93 - 12/31/96 
 
8.  The parties mutually agree that the aforesaid file(s) (and/or any derivative file(s)) 
may be retained by the User until (Enter Date), hereinafter known as the "end of 
active analyses date."  Should the active analyses be completed before that date, 
the User agrees to notify (QIO Name) within 30 days of the completion of the 
active analyses for the purpose specified in paragraph 6. 
 
  The (QIO Name) agrees to archive an electronic, offline version of the 
data and resulting datasets for a period not to exceed 5 years from the 
completion of active analyses date and to provide the User with access to 
the data during that period.  The User agrees to request access to the 
archived data in writing, to specify the purpose of the request and the 
length of time the data will be needed, and acknowledges that all 
provisions of this Data Use Agreement apply during any period in which 
he has access to the archived data (This paragraph to be inserted only in 
those cases where the User requests that the data be archived). 
 
  At the end of the active analyses, (QIO Name) will notify the User either 
to return all data files to (QIO Name) at the Users expense or to destroy 
such data.  If (QIO Name) elects to have the User destroy the data, the 
User agrees to certify the destruction of the files in writing within 30 days 
of receiving (QIO Name) instruction.  A statement certifying this action 
must be sent to (QIO Name).  If (QIO Name) elects to have the data 
returned, the User agrees to return all files to (QIO Name) within 30 days 
of receiving notice to that effect.  The User agrees that no data, or any 
parts thereof, furnished by (QIO Name) shall be retained when the 
aforementioned file(s) are returned or destroyed unless authorization in 
writing for the retention of such file(s) has been received from the QIO's 
Project Officer and the person designated in paragraph 24 of this 
Agreement.  The User acknowledges that stringent adherence to the end of 
active analyses date included in the first paragraph of Clause 8 is required, 
and that the User shall ask (QIO Name) for instructions under this 
paragraph if instructions have not been received after 30 days after the end 
of active analyses date. 
 
  If the (QIO Name) and User have agreed that the data are to be retained, 
the QIO will destroy the data and datasets at or after the agreed-upon date 
for termination of the archiving period. 
 
9.  The User agrees to establish appropriate administrative, technical, and physical 
safeguards to protect the data and to prevent unauthorized use or access to it.  The  safeguards shall provide a level and scope of security that is not less than the level 
and scope of security established by the (QIO Name) Security and Confidentiality 
Policy (attached).  The User acknowledges that the use of unsecured 
telecommunications, including the Internet, to transmit individually identifiable or 
deducible information derived from the file(s) specified in paragraph 7 is 
prohibited.  Further, the User agrees that the data must not be physically moved or 
transmitted in any way from the site indicated in paragraph 4 without written 
approval from (QIO Name). 
 
10. The User agrees that the authorized representatives of (QIO Name) will be 
granted access to premises where the aforesaid file(s) are kept for the purpose of 
inspecting security arrangements to confirm whether the User is in compliance 
with the security requirements specified in paragraph 9. 
 
11. The User agrees that no findings, listing, or information derived from the file(s) 
specified in paragraph 7 may be released if such findings, listing, or information 
contains any combination of data elements that might allow the deduction of a 
beneficiarys, practitioner's, or provider's identification without first obtaining 
written authorization from the appropriate Project Officer or the person 
designated in paragraph 24 of this Agreement.  Examples of such data elements 
include, but are not limited to, geographic indicator, age, sex, diagnosis, 
procedure, admission/discharge date(s), date of death, medical specialty, provider 
zip code, profit/non-profit status of provider, etc.  The User agrees further that 
(QIO Name) shall be the sole judge as to whether any finding, listing, 
information, or any combination of data extracted or derived from (QIO Name)s 
files identifies or would, with reasonable effort, permit one to identify a 
beneficiary, practitioner, or provider or to deduce the identity of a beneficiary, 
practitioner, or provider to a reasonable degree of certainty. 
 
12. The User agrees that, absent express written authorization from the appropriate 
Project Officer or the person designated in paragraph 24 of this Agreement to do 
so, the User shall make no attempt to link records included in the file(s) specified 
in paragraph 7 to any other identifiable source of information.  This includes 
attempts to link to other (QIO Name) data file(s).  The inclusion of linkage of 
specific files in a study protocol approved in accordance with paragraph 6 is 
considered express written authorization from (QIO Name). 
 
13. The User agrees to submit to (QIO Name) a copy of all findings within 30 days of 
making such findings.  The parties mutually agree that the User has "made 
findings" with respect to the data covered by this Agreement when the User 
prepares any report or other writing for submission to any third party (including, 
but not limited to, any manuscript to be submitted for publication) concerning any 
purpose specified in paragraph 6 (regardless of whether the report or other writing 
expressly refers to such purpose, to (QIO Name) or the files specified in 
paragraph 7 or any data derived from such files).  The User agrees not to submit 
such findings to any third party until receiving CMS and the (QIO Name)  approval to do so.  CMS and the (QIO Name) agree to make determination about 
approval and to notify the User within 4 to 6 weeks after receipt of findings.  CMS 
and the (QIO Name) review of the findings is for the sole purpose of assuring that 
data confidentiality is maintained and that individual beneficiaries could not be 
identified.  CMS and the (QIO Name) may withhold approval for publication only 
if it determines that the format in which data are presented may result in 
identification of individual beneficiaries.  The User agrees further to submit its 
findings to (QIO Name) within 30 days of receiving notice from (QIO Name) to 
do so. 
 
14. The User agrees to include the following statement in any report of findings: 
 
  "The author acknowledges the assistance of the (QIO Name) and the 
Centers for Medicare & Medicaid Services (CMS) in providing data which 
made this research possible.  The conclusions presented are solely those of 
the author and do not represent those of (QIO Name) or CMS." 
 
15. The User understands and agrees that they may not reuse original or derivative 
data file(s) without prior written approval from the appropriate Project Officer or 
the person designated in paragraph 24 of this Agreement. 
 
16. The parties mutually agree that the following specified Attachments are part of 
this Agreement. 
 
17. The User agrees that in the event (QIO Name) determines or has a reasonable 
belief that the User has made or may have made disclosure of the aforesaid file(s) 
that is not authorized by this Agreement or other written authorization from the 
appropriate Project Officer or the person designated in paragraph 24 of this 
Agreement, (QIO Name), in its sole discretion, may require the User to: 
 
  Promptly investigate and report to (QIO Name) the Users determination 
regarding any alleged or actual unauthorized disclosure; 
 
  Promptly resolve any problems identified by the investigation to the 
satisfaction of the QIOs Project Officer; 
 
  If requested by (QIO Name), submit a formal response to an allegation of 
unauthorized disclosure; 
 
  If requested by (QIO Name), submit a corrective action plan with steps 
designed to prevent any future unauthorized disclosures; and 
 
  If requested by (QIO Name), return data files to (QIO Name). 
 
18. The User understands that as a result of (QIO Name)s determination or 
reasonable belief that unauthorized disclosures have taken place, (QIO Name)  may refuse to release further data to the User for a period of time to be determined 
by (QIO Name).  The User further understands that (QIO Name) will advise other 
QIOs of the situation and enlist their participation in this refusal to release data to 
the User. 
 
19. The User hereby acknowledges that if the information specified in this agreement 
is being utilized for research purposes supported by an award of an agency of the 
Department of Health & Human Services (DHHS), and if the User materially fails 
to fulfill its confidentiality obligations under the terms of its award agreement 
with that agency, DHHS has the authority under 45 CFR Part 74 to temporarily 
withhold cash payments, disallow funding and matching credit for all or part of 
the cost of the grant activity, suspend or terminate the grant in whole or in part, 
withhold further awards for the grant project or program, and other available legal 
remedies (see 45 CFR 74.62(a)(1)-(5)).  DHHS officials may also attach special 
award conditions on future grants when a grantee has not conformed to the terms 
and conditions of a previous award, or "is not otherwise responsible" (see 45 CFR 
74.14(a)(4)-(5)), and may place the name of the grantee on a "Departmental Alert 
List," to be consulted by all DHHS Grants Management Officials and program 
officials prior to awarding grants (See Grants Policy Directive Part 2.01.C.1).  
The strongest sanctions available to a DHHS agency responding to grantee 
misconduct are debarment or suspension, which preclude a grantee from receiving 
awards not just from DHHS, but government-wide (See 45 CFR 74.13). 
 
20. If (QIO Name) ceases to serve as a QIO contractor before the expiration of the 
term of this agreement, (QIO Name) shall provide a copy of this agreement and 
all data or datasets in its possession to the successor QIO.  It is the parties' 
understanding that, should (QIO Name) cease to serve as the QIO for (Name of 
State) before the expiration of the term of this agreement, the Centers for 
Medicare & Medicaid Services will direct the successor QIO to execute a new 
Data Use Agreement prior to the cessation of (QIO Name) Agreement containing 
terms and conditions substantially identical to those contained herein.  The User 
agrees to execute a new Data Use Agreement prior to the cessation of the contract 
between the Centers for Medicare & Medicaid Services and (QIO Name).  Upon a 
failure to timely execute a new agreement, the User shall return any data or 
datasets in the User's possession to (QIO Name). 
 
21. By signing this Agreement, the User agrees to abide by all provisions set out in 
this Agreement for protection of the data file(s) specified in paragraph 7, and 
acknowledges having received notice of potential penalties for violation of the 
terms of the Agreement. 
 
22. On behalf of the User, the undersigned individual hereby attests that he or she is 
authorized to enter into this Agreement and agrees to all the terms specified 
herein. 
 
  (Name of Authorized Individual) (Title of Authorized Individual)    (Company/Organization) 
  (Street Address) 
  (City/State/ZIP Code) 
  (Phone Number - Including Area Code) (Email Address) 
  (Signature) (Date) 
 
23. The Custodian, as named in paragraph 4, hereby acknowledges his/her 
appointment as Custodian of the aforesaid file(s) on behalf of the User, and agrees 
personally and in a representative capacity to comply with all of the provisions of 
this Agreement on behalf of the User. 
 
  (Name of User) 
  (Signature) (Date) 
 
24. On behalf of (QIO Name), the undersigned individual hereby attests that he or she 
is authorized to enter into this Agreement and agrees to all the terms specified 
herein. 
 
  (Name of (QIO Name) Representative) 
  (Title of (QIO Name) Representative) 
(Signature) (Date) 
 
Exhibit 10-2 - Model Letter 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
Request for a QIO or ESRD Network to Disclose Information to a Facilitys Agent: 
 
[Name of Provider/ESRD Facility] (The Facility) has entered into an agreement, in 
accordance with State law, with [e.g., Name of Corporate Owner] for [Name of 
Corporate Owner] to serve as the agent (the Agent) of the Facility for purposes of 
receiving certain kinds of data on the Facilitys behalf from [Name of the Quality 
Improvement Organization/ESRD Network].  The Agent is subject to the same 
requirements under Federal law as the Facility for purposes of receiving and re-disclosing 
the data.  I request that [Name of Quality Improvement Organization/ESRD Network] 
send the following data to the Agent. 
 
(List Specific Reports) for provider number ____________________ 
 
I have designated [Name of the Corporate Owner] as the Agent for the purpose described 
above for a period of 3 years from the date of my signature unless this designation is 
rescinded in writing before that date. 
 
[Signature of Facility Administrator] 
 
Attachment 
  Exhibit 10-3 - Model Language 
(Rev. 15, Issued: 06-30-06; Effective/Implementation Dates:  06-30-06) 
 
Important Information About Disclosing and Re-disclosing Data Received from a 
Quality Improvement Organization or ESRD Network: 
 
Under Federal law, a Quality Improvement Organization or ESRD Network must hold in 
confidence and not disclose to any person data or information that it has acquired in 
exercising its duties and functions, except as provided under various specific exceptions 
that appear in 1160 of the Social Security Act (the Act) (42 U.S.C. 1320c-9), the 
Quality Improvement Organization confidentiality regulations at 42 CFR 480 and 
accompanying Manual Provisions. 
 
A Quality Improvement Organization or ESRD Network can provide to an Agent only 
that data which it is authorized to disclose to the Facility under Federal law. 
 
There are specific limitations on re-disclosing any data received from a Quality 
Improvement Organization or ESRD Network under 1160 of the Act and at 42 CFR 
480.107, and 480.140.  Any person who discloses information not authorized under 
these provisions will, if convicted, be subject to a fine of up to $1000, or be imprisoned 
for no more than 6 months, or both, and will pay the costs of prosecution.  Transmittals Issued for this Chapter 
 
Rev #  Issue Date  Subject  Impl Date  CR# 
R15QIO  06/30/2006  Revisions to Chapter 10, Confidentiality and  06/30/2006 N/A 
Disclosure 
R6QIO  08/01/2003  Miscellaneous Revisions  N/A  N/A 
Back to top of chapter