(Medicare General Information, Eligibility, and Entitlement)

Medicare General Information, Eligibility, and Entitlement  Chapter 6 - Disclosure of Information   Table of Contents  (Rev. 123, 05- 10-19) (Rev. 124, 05- 17-19)   Transmittals for Chapter 6  10 - The Privacy Act of 1974 10.1 -  Disclosure of Information 10.2 -  Procedures for Handling Requests  10.3 -  Processing Freedom of Information (FOI) Requests  10.4 -  Reporting FOI Activity  20 - Case Numbering  21 - Fees for Information (Contractors)  21.1 -  Fees  21.2 -  Billing of Fees and Charges  21.3 -  Requests Fulfilled Without Remittance  30 - Disclosure of Program Materials (Contractors) 30.1 -  Manuals, PMs, and Other CMS Materials  30.2 -  Internal Guidelines  40 - Disclosure of Information about Identifiable Beneficiaries (Contractors)  40.1 -  Prohibition Against Disclosure  40.2 -  The Authority for Disclosure  50 - Disclosure Necessary for Proper Administration of the Health Insurance Program  60 -  Disclosure of Information 70 - Disclosure of Information after the Death of a Beneficiary (Contractors)  80 - Disclosure to Third Parties for Other than Program Purposes (Contractors)  80.1 -  Release for Title XVIII Claims Info rmation for Complementary Insurance Purposes (Contractors)  90 - Matching MAC Health Insurance  100 -  Disclosure to State Agencies or to Contractors Acting for State Agencies Administering Programs Receiving Gra nts in Aid (Contractors)  100.1 -  Information That May Be Disclosed and Authorization Required 100.2 -  Procedures for Supplying Title XVIII Information to State Agencies  100.3 -  Disclosure to Title V and Title XIX Agencies of Information Indicating Unprofessional or Unethical Practices by Physicians and Other Practitioners  100.4 -  Disclosure to Title XIX Agencies of Physician Charge Information  100.5 -  Electronic Reporting of Crossover Claims  110 -  Disclosure to Peer Review Organizations (PROs)  120 -  Disclosure to the Internal Revenue Service (Contractors)  130 -  Disclosure to the Office for the Civilian Health and Medical Program of the Uniformed Services (TRICARE) by Contractors  130.1 -  General  130.2 -  Type of Information  130.3 -  Proc edures for Release  140 -  Disclosure of Information About Providers and Suppliers by CMS  140.1 -  Disclosure Necessary for Proper Administrative of the Medicare Program (CMS) 140.2 -  Disclosure of Medicare Reports  140.3 -  Disclosure of Information About Named Physicians and Other Suppliers of Service (RO's)  140.4 -  Disclosure of Names of Providers, Physicians, and Suppliers of Servic es 140.4.1 -  Names of Providers Terminated from Program Participation (A/B MACs (B) ) or DME MACs  140.4.2 -  Names of Providers, Suppliers, and Physicians Found Guilty of Fraud (CMS) 140.4.3 -  Names of Physicians on Second Opinion Lists (Contractors)  140.4.4 -  Referral to State Licensing Boards, Medical Review Boards, and Professional Societies  140.4.5 -  Disclosure of Med icare Statistics  150 -  Disclosure of Reports About Named Contractors  150.1 -  Disclosure by ROs of Annual Reports of Contractors Performance (RCP)  150.2 -  Disclosure of Medicare Audit Reports to the Press and Public (Audit Agency)  160 -  Disclosure of Statistics (CMS or Contractors)  160.1 -  Information That the Contractor May Disclose  160.2 -  Information That May Be Released Upon Authorization by the Regional Office  170 -  Disclosure of Health Insurance Information by Providers  170.1 -  Disclosure of Health Insurance Information to a Beneficiary or in Connection With a Claim 170.2 -  Disclosure to Contractors  170.3 -  Disclosure to Third parties for Proper Administration of the Health Insurance Program  170.4 -  Disclosure to Third Parties  for Other Than program Purposes  170.5 -  Disclosure of Claims Payment Information in Alcohol and Drug Abuse Cases  170.6 -  Disclosure of Itemized Statement to an Individual for Any Item or Service Provided 180 -  Cost to a Provider That Requests Information Available to the Public  190 -  The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule  200 -  Removal of Medicare Number from Reimburseme nt Checks  Exhibit A -  Freedom of Information Act Request  Exhibit B -  Summary Sheet for the CMS Monthly FOIA Report  Exhibit C -  Invoice of Fees for FOIA Services  Exhibit E -  Medicare Authorization to Disclose Personal Health Information Form and Information to Help You Fill Out the Medicare Authorization to Disclose Personal Health Information Form   10 - The Privacy Act of 1974 (Rev. 1, 09- 11-02)  A. General   The purpose of the Privacy Act of 1974 is to provide safeguards for individuals against an invasion of privacy by Federal agencies.  Among other things, Federal agencies are required to permit an i ndividual to:    Determine what records pertaining to the individual are collected, used, or disseminated by such agencies;    Prevent records pertaining to the individual obtained by Federal agencies for a specific purpose from being used for another purpose without the individual's consent; and    Gain access to information pertaining to the individual in Federal agency records, and to correct such records when appropriate.   Contractors considered to be Federal agencies for purposes of administering the Privacy Act must comply with its provisions.  Contractors must:    Inform each individual from whom information is requested of their rights under the Privacy Act;    Describe the method of accessing an individual's records;    Prepare a method of accounting for  disclosures; and    Devise a method of reviewing records at the request of individuals and making corrections if appropriate.  Additional information concerning Medicare privacy policies can be accessed on the CMS Web site under the Privacy Policy link at the bottom of the web page.   B. Definition of "Individual"   "Individual" means a living person on whom CMS has any personal (as opposed to business) information.  "Individual" does not include so- called persons such as sole proprietorships, partnerships, or corporations.  Except for disclosure of and access to medical information about minors, a parent or legal guardian of a minor, or a legal guardian of someone the court has declared incompetent, has the same rights as the individual to the individual's re cords.  No one may act on behalf of an individual who has not been declared incompetent by a court or gain access to his/her records under the Privacy Act without the individual's written consent.  C. Physicians' and Suppliers' Rights to Access Under the P rivacy Act   Providers, physicians, and suppliers as business entities do not have access to business information about themselves under the Privacy Act, since the Privacy Act concerns individuals only.  However, a physician or other supplier who is also an individual has the same access rights as any other individual to personal information maintained about themselves.  Purely business information which is retrievable by the physician's unique identifier is not subject to the Privacy Act, but it may be disc losed to the physician to the extent that we would not deny the physician the information under the Freedom of Information Act (FOIA).   D. Informing Individuals of Rights   The contractor must inform the individual of his/her rights under the Privacy Act when it solicits any information directly from the beneficiary in connection with a Medicare claim.  This would usually be a result of the failure of the individual or provider to furnish all the information required on a claims form.  When information is collected by telephone, the contractor will give the individual a brief oral explanation.  When information is requested by mail a written notice is used.   E. Method of Accessing Individual Records -  General   The law requires that an agency must inform an individual, upon request, whether a system of records contains a record pertaining to the individual, permit the individual to review such record and to be accompanied for the purpose of reviewing the record by a person of his or her choice.  Further, the individual is permitted to obtain a copy of such record in a comprehensible form at a reasonable cost.  There is a charge of 10 cents per page with all fees under $25 waived.  There is no charge for searching; nor is there a charge for a copy furnished as a means of permitting an individual access to their records.   Each requester shall be asked for proof of identity as well as such general information as is necessary to determine where and how to look for records about the data subject Within 10 working da ys of receiving a request, the contractor must decide whether to release the records.  The requested information must be furnished within 30 working days unless good cause exists.  An example of "good cause" would be an inactive record filed in a records center that cannot be obtained within 30 days.  The requester should be told of the delay and given an approximate date to expect the information.   If an individual's request for information concerning themselves is not in the contractor's files, the contra ctor should advise the individual that it does not have the information and, if available elsewhere, that it is forwarding the request to the office which has it.  The contractor should furnish any requested information available if the request cannot be satisfied in full.  The contractor should identify requests under the Privacy Act that require referral to CMS for data in central office systems.  As required by the Privacy Act, the contractor should send the request for processing, along with a copy of t he interim response, to the systems manager listed in the Annual Publication:  Systems of Records.   F. Methods of Accessing Individual Medical Records   The official responsible for the records, or their designated medical officer, may disclose medical info rmation directly to the individual if the official determines, based on review of the medical evidence, that such disclosure is not likely to have an adverse effect.  In such cases the responsible official will give the requested information to the individual and annotate the record to show that the disclosure was made.   If the responsible official determines that direct disclosure of the medical record would be likely to have an adverse effect on the individual or does not consider themselves qualified to make such a determination, the official will disclose the medical information to the representative designated in writing by the individual.  The representative must be a medical professional (licensed medical practitioner or nurse) who would be willing to review the record and discuss it with the individual.  The contractor will retain a record showing the reason for its determination and a copy of the correspondence transmitting the information to the individual or to his/her medical representative.   If there is sensitive medical information in the records and the individual refuses to name a medical professional or cannot afford the fee for the service, or if the designated medical professional refuses to serve, the contractor will refer the file to the C MS regional office.   G. Disclosure of Medical Information Relating to Minors   In order to protect the privacy of a minor, a parent or authorized guardian who requests access to the minor's medical record may not be given direct access to the record.  Contr actors shall ask a parent or guardian who requests access to such a record to designate a physician or other professional (other than a family member) to whom the record may be sent.  The physician or health professional to whom the record is sent will be asked by the contractor to consider the effect that the disclosure of the record to the parent or guardian would have on the minor in determining whether the record should be made available to the parent or guardian.   The contractor will prepare a response  to the parent or guardian in substantially the following form:  We have completed processing your request for access to the medical records of (name)__________________________, a minor   The medical records have been sent to (name and address of designated  health professional) in accordance with your instructions   In each case where a minor's medical records are sent to a physician or health professional, reasonable efforts will be made by the contractor to so inform the minor.  In the event the parent or g uardian refuses to name a medical professional or cannot afford the fee for the service or the designated medical professional refuses to serve, the contractor will refer the file to the CMS regional office for appropriate action.   H. Disclosure to Third Parties   The Privacy Act permits disclosure to any third party with the written consent of the individual to whom the record pertains.  It also permits disclosure in certain instances without the individual's consent.  However, the contractor must not disc lose information unless the disclosure is specifically authorized in this chapter, or the individual has consented to the disclosure in writing, or the CMS regional office authorizes the disclosure.  I. Disclosures with Consent