(Medicare General Information, Eligibility, and Entitlement)

Some providers and suppliers document findings on medical forms pre -printed "confidential" or routinely stamp all records "confidential" whether or not such records are ever intended for disclosure to a contractor.  The contractor will accept such records only if the provider or supplier accompanies them with a signed statement indicating the following:    That the pr ovider or supplier understands the information is subject to disclosure to the patient under the Privacy Act, and    That any words or statements that the transmitted records are confidential may be disregarded if the patient or the patient's representative  requests them from the contractor or from CMS.   170.3 - Disclosure to Third parties for Proper Administration of the Health Insurance Program  (Rev. 1, 09- 11-02)  Disclosure by the provider or supplier to persons other than the individual or the individual's authorized representative of any records, reports, or other information about the individual is authorized without the individual's or their representative's consent under the following circumstances:   The disclosure is required in connection with any claim or other proceeding under the Social Security Act for the proper performance of the duties of:    Any officer or employee of the Department; or    Any officer or employee of a State agency, A/B MAC (A or HHH), provider of services, or other age ncy or organization participating in the administration of the program, by contract or agreement, in carrying out such contract or agreement.  These limitations apply whether or not the individual to whom the information pertains authorizes further disclosure to third parties (e.g., to a private medical plan).   170.4 - Disclosure to Third Parties for Other Than program Purposes  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19  The term Medicare beneficiary identifier (Mbi) i s a general term describing a beneficiary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new M edicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.   Information obtained from CMS or its contractor is confidential and may be disclosed only under conditions prescribed in rul es and regulations or on the express authorization of the Administrator of CMS.  However, certain limited information about a beneficiary's Medicare eligibility status and related claims information may be released to third party payers with the beneficiar y's express authorization.  The following information may be released subject to necessary authorization:    Medicare beneficiary identifier ;  Coinsurance and deductible status;   Dates of entitlement to Medicare;   Copies of Medicare claims forms;   Medicare repor t of eligibility; and   Explanation of Medicare Benefits (EOMB) or Medicare Summary Notice (MSN).   Providers should refer requests for other information to the contractor.  Contractors refer requests to the CMS regional office.   The provider or supplier wil l adhere to the following authorization guidelines to ensure that information is not released without the required authorization.  Authorization must:    Be in writing;   Be signed and dated by the individual or someone authorized to act on the individual's behalf;   Specify the name of the provider authorized to disclose information;   Specify what information the individual is authorizing the provider to disclose;   Specify the names of the third party payers to whom the information is being released;   Specify the purpose for which the information is being released;   Specify an expiration date for the authorization that should not exceed 2 years from the date it was signed; and   Specify that it may be revoked at any time.  170.5 - Disclosure of Claims Payment Information in Alcohol and Drug Abuse Cases  (Rev. 1, 09- 11-02)  The law requires providers to observe more stringent rules when disclosing medical information for claims processing purposes from the records of alcohol and drug abuse patients.  Since the standard consent statement on the provider billing form is not sufficient authority, under the law, to permit the provider to release information from the records of alcohol or drug abuse patients, more explicit consent statements are required.   Providers that part icipate in Medicare and alcohol and drug abuse prevention and treatment programs must obtain written consent in each alcohol or drug abuse case from beneficiaries to release medical information.  This written consent, which allows the provider to disclose the records of the patient, must include all of the following:    The name of the organization (e.g., hospital name) that is to make the disclosure;   The name or title of the person or organization to which disclosure is to be made (e.g., CMS, including the a ppropriate MAC, specified by name);   The name of the patient;   The purpose or need for the information to be disclosed (e.g., for processing a claim for Medicare payment and for such evaluation of the treatment program as is legally and administratively requ ired in the overall conduct of the Medicare program);   The specific extent or nature of information to be disclosed (e.g., all medical records regarding the beneficiary's treatment, hospitalization, and/or outpatient care including treatment for drug abuse or alcoholism);   A statement that the beneficiary may revoke their consent at any time to prohibit disclosures on or after date or revocation;   A statement specifying a date (not to exceed 2 years), event, or condition upon which consent expires without revocation;   The date on which the consent is signed; and   The signature of the patient or the signature of their authorized or legal representative.   If the beneficiary wishes, the consent statement may be expanded to permit disclosure by the provider to any other person, organization, or program (e.g., PRO), as appropriate.  Providers may also give authorization to CMS and its contractors to re -disclose specific information to third party payers for complementary insurance purposes.   The provider keeps the consent statement with the patient's medical and other records.   The duration of the consent statement is not to exceed 2 years after which it must be renewed by the beneficiary if further disclosures are necessary.   170.6 - Disclosure of Itemized Statement to an Individual for Any Item or Service Provided  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19  The term Medicare beneficiary identifier (Mbi) is a general term describing a beneficiary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.   A.  General   Section 4311 of the Balanced Budget Act of 1997 requires that if a Medicare beneficiary submits a written request to a health services provider for an itemized statement for any Medicare item  or service provided to that beneficiary, the provider must furnish this statement within 30 days of the request.  The law also states that a health services provider not furnishing this itemized statement may be subject to a civil monetary penalty of up t o $100 for each unfulfilled request.  Since most institutional health practices have established an itemized billing system for internal accounting procedures as well as for billing other payers, the furnishing of an itemized statement should not pose any significant additional burden.  B.  30- Day Period to Furnish Statement   The provider will furnish to the individual described above, or duly authorized representative, no later than 30 days after receipt of the request, an itemized statement describing each item or service provided to the individual requesting the itemized statement.   C.  Suggested Contents of Itemized Statement   Although 4311 of the Balanced Budget Act of 1997 does not specify the contents of an itemized statement, suggestions for the typ es of information that might be helpful for a beneficiary to receive on any statement include: beneficiary name, date(s) of service, description of item or service furnished, number of units furnished, provider charges, and an internal reference or trackin g number.  If Medicare has adjudicated the claim, additional information the provider can include are: amounts paid by Medicare, beneficiary responsibility for co- insurance, and Medicare beneficiary identifier .  The statement should also include a name and telephone number for the beneficiary to call if there are further questions.   D.  Penalty   A knowing failure to furnish the itemized statement shall be subject to a civil monetary penalty of up to $100 for each such failure.   180 - Cost to a Provider That Requests Information Available to the Public  (Rev. 1, 09- 11-02)  Providers are required to pay appropriate fees for information they request pertaining to other providers, Medicare contractors, or State agencies. A provider may c laim such fees as allowable costs only if it demonstrates to the contractor the information is necessary in developing and maintaining the operations of patient care facilities and activities.   190 - The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule  (Rev. 7, 06- 25-04)  A. General Information   To improve the efficiency and effectiveness of the health care system, HIPAA included provisions that required national standards for electronic health care transactions.  At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information.  Consequently, Congress incorporated into HIPAA provisions that mandated the adoption of Federal privacy protections for individually identifiable hea lth information.  The Department of Health and Human Services issued the regulation Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164, (the HIPAA Privacy Rule) to implement section 264 of HIPAA.  The HIPAA Pr ivacy Rule establishes a set of basic national privacy standards and fair information practices.  It sets a floor of ground rules for health care providers, health plans, and health care clearinghouses to follow to protect the privacy of an individuals pe rsonal health information.  The HIPAA Privacy Rule is based on the same fair information principles that are found in the Privacy Act of 1974 and are now generally extended to the public and private sectors of the health care delivery system.  The HIPAA Pr ivacy Rule applies to protected health information (PHI) held by covered entities, as defined by the Rule, while the Privacy Act protects records with individually identifiable information held by Federal agencies.  The Privacy Act continues to apply to Me dicare and Medicare fee- for-service (FFS) contractors in their day -to-day operations.   The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for providing outreach and technical assistance to covered entities (healt h plans, health care clearinghouses, and health care providers who conduct certain financial and administrative transactions electronically) and for enforcing the HIPAA Privacy Rule.  OCR maintains information on the HIPAA Privacy Rule at http://www.hhs.gov/ocr/hipaa/   B. How CMS Applies Laws Affecting the use and Disclosure of Personal Information   1. General rules   Since Medicare operates under both the Privacy Act and the HIPAA Privacy Rule, CMS has determined how the provisions interact with each other as it uses personally identifiable information in its day -to-day operations.  For example, a use or disclosure that is permitted under the HIPAA Privacy Rule (e.g., to facilitate cadaveric organ donati on and transplants), but not published in a Federal Register notice as a routine use in a CMS system of records would not be permitted for Medicare.  Similarly, if the disclosure is a routine use under the Privacy Act, but the HIPAA Privacy Rule prohibit s the disclosure, CMS will not make the disclosure.  Exemption 6 of the Freedom of Information Act (FOIA) permits Federal agencies to withhold personnel and medical files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.  When a FOIA request asks for documents that include personal information, CMS must apply Exemption 6 to preclude the release of, or must otherwise redact, identifying details before disclosing the remaining information.   2. Information About Deceased Individuals   The application of Exemption 6 of the FOIA to information about deceased individuals requires a different analysis than that applicable to living individuals because under the Privacy Act of 1974, privacy rights are extinguished at death.  However, under FOIA, it is entirely appropriate to consider the privacy interest of a decedents survivors under Exemption 6.  Under the HIPAA Privacy Rule, the personal health information of deceased as well as living persons is protected.  3. Requests f or Access to Records