(Medicare General Information, Eligibility, and Entitlement)

The HIPAA Privacy Rule specifies certain core elements and required statements for a valid author ization.  Contractors may add more elements to their authorizations as long as the core elements and required statements remain and no provisions are added that conflict with these core elements and statements.   Contractors must also accept an authorization from another entity, provided it includes all of the core elements and required statements, and no provisions are added that conflict with these core elements and statements.   I. Core Elements and Required Statements for an Authorization  The core elemen ts of a valid authorization are:   1. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;   2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;   3. The name or other specific identification of the person(s) or class of persons, to whom the covered entity may make the requested use or disclosure;   4. A description of each purpose of the requested use or disclosure.  The statement, at the request of the individual is a sufficient description of the purpose when the beneficiary initiates the authorization and does not, or elects not to, provide a statement of the purpose;   5. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure; and   6. The signature of the individual and date.  If a personal representative of the individual signs the authorization, a description of such representatives authority to act for the individual must also be provided.  Although the HIPAA Privacy Rule requires only a description of the representatives authority to act for the individual, CMS is requiring that documentation showing the representatives authority be attached to the authorization (e.g., a Power of Attorney).   In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:   1. The individuals right to revoke the authoriz ation in writing, how the individual may revoke the authorization, and the exceptions to the right to revoke, e.g., You have the right to take back (revoke) your authorization at any time in writing, except to the extent that Medicare has already acted based on your permission.  To revoke your authorization, send a written request to: [Each Medicare contractor or CMS: Please insert Name, Address, and Telephone number of your organization here];   2. The inability to condition treatment, payment, enrollme nt or eligibility for benefits on the authorization, e.g., I understand refusal to authorize disclosure of my personal medical information will have no effect on my enrollment, eligibility for benefits, or the amount Medicare pays for the health services I receive;   3. The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected, e.g.: Your personal medical information that you authorize Medicare to disclose may be subject to  redisclosure and no longer protected by law.   In addition, the authorization must be written in plain language and a signed copy must be provided to the individual (or the individual should be advised to retain a copy).   The CMS is developing a standard authorization for beneficiaries or their personal representatives to request disclosure of PHI to third parties.  The standard will contain the elements for compliance with both the HIPAA Privacy Rule and Privacy Act requirements.  Contractors will be noti fied when the standard authorization is available.   J. Personal Representatives and Third Party Authorizations   The HIPAA Privacy Rule requires covered entities to treat an individuals personal representative as the individual with respect to uses and di sclosures of the individuals PHI, as well as exercising the individuals privacy rights listed in the covered entitys Notice of Privacy Practices.  A personal representative may also authorize disclosures of an individuals PHI (see 190H above).   In addition to these formal designations of a personal representative, the HIPAA Privacy Rule permits a covered entity to disclose to any person identified by the individual the protected health information directly relevant to such persons involvement with the  individuals care or payment related to the individuals care.  Therefore, a verbal authorization is allowed under the HIPAA Privacy Rule for those individuals involved in the care of an individual.   Contractors should continue to handle routine inquiries , such as telephone requests for the status of claims, under existing customer service procedures that include verification of the individuals identity.  Therefore, with the beneficiarys verbal or written permission, contractors may continue to speak to third parties on behalf of the individual.  See Exhibit D -  Disclosure Desk Reference Guide for Call Centers for detailed instructions on disclosing PHI over the telephone.   Contractors may also continue to handle Congressional inquiries under existing cus tomer service procedures (see 10J above).   K. Administrative Requirements   As Medicares business associate, contractors are not subject to the administrative requirements of the HIPAA Privacy Rule.  However, under the Privacy Act, contractors must comply  with the privacy provisions specified in their contracts. Contractors are not required to designate a privacy official.  However, contractors are required to have in place a senior official or other responsible party to address the privacy concerns of the  organization and to establish an internal control system to monitor compliance with privacy requirements.  Similarly, as Medicares business associate, contractors are not subject to the HIPAA Privacy Rules requirement to train staff specifically on the HIPAA Privacy Rule.  However, under the Privacy Act, contractors are required to ensure that employees under stand their responsibility to protect the privacy and confidentiality of CMSs records.   It is CMS policy that any data collected on behalf of CMS in the administration of a Medicare contract belongs to CMS.  Any disclosure of individually identifiable information without prior consent from the individual to whom the information pertains, or without statutory or contract authorization, requires prior approval by CMS.  200 - Removal of Medicare Number from Reimbursement Checks  (Rev. 21, Issued:  04- 29-05; Effective:  10 -01-05; Implementation:  10- 03-05)  Contractors (A/B MACS (A and B), A/B MACs (HHH ) and DME MACs) shall stop printing the Medicare Number on reimbursement checks to Medicare beneficiaries.   Reimbursement checks going to Medicare beneficiaries are subject to others (e.g. banks) seeing the Medicare Number.  CMS has determined that there is no business reason for the Medicare Number to be printed on the reimbursement check to the beneficiary.  Therefore, CMS is directing Medicare contractors to stop printing the Medicare Number on reimbursement checks to Medicare beneficiaries.   This change in policy does not affect the use of the Medicare Number by Medicare contractors.  The Medicare program uses the Medicare Number to meet administrative respo nsibilities to pay for health care and to operate the Medicare program.  In performance of these duties, Medicare is required to protect individual privacy and confidentiality in accordance with applicable laws, including the Privacy Act of 1974 and the Pr ivacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).   Exhibit A - Freedom of Information Act Request   Exhibit B - Summary Sheet for the  CMS Monthly FOIA Report   MAC/CENTRAL OFFICE COMPONENT SUMMARY SHEET FOR THE CMS MONTHLY FOIA REPORTS   Data on this Summary Sheet is a summation of the data from all Forms CMS -632-FOI completed during the month.  INSTRUCTIONS  1. Enter the month and year that this summary sheet covers.  2. Enter, in the applicable space, appropriate identifying information concerning your unit. 3. Enter the total number of 632s completed during the identified month. 4. Enter the number of times the 632s showed a request was closed by the  cited action.  5. Enter the total of all staff hours used during the identified month. Use only whole numbers and fractions or decimals, e.g., 102 1/2 or 102.25, not 102 hours and fifteen minutes.  6. Enter the total of actual cost figures, based on the salaries of the staff involved. 7. Enter the total of copying charges.  8. Enter the mailing/postage costs.  9. Enter the total dollar amount of fees charged. This figure is not the same as actual costs.  10. Enter the total of all fees waived. (Unless the FOI Office, CMS has gran ted a waiver, this figure is a compilation of all fees which were waived because they were lower than CMS' $15.00 threshold).  11. Enter the name, office and address of the person who completed this summary sheet.  12. Enter the date the summary sheet was completed.  PLEASE FILL OUT COMPLETELY  1. Month: ________________ Year: __________  MAC: __________________________________________________   CENTRAL OFFICE COMPONENT: _____________________________________________  Total 632s: _________________  Actions:   ___________ D irect Reply (Records Sent)  _____________ No Records Found  ___________ Request Withdrawn  _____________ Not FOIA  ___________ Records Not Reasonably Described  _____________ Subpoena Denial  ___________ Fee Related Closure  _____________ Other   Staff Hours: ___________ Staff Charges: ____________ Copy Charges: ____________ Postage: ____________ Fees Charged: ____________ Fees Waived: ____________ Name/Phone: ____________________________________________  Office: _________________________________________________  Address: ________________________________________________ Date: __________  Exhibit C - Invoice of Fees for FOIA Services    Exhibit E - Medicare Authorization to Disclose Personal Health Information form and Information to Help You Fill Out the Medicare Authorization to Disclose Personal Health Information Form  Transmittals Issued for this Chapter   Rev #  Issue date  Subject  Impl date  CR#  R124GI  05/17/2019  Update to Publication (Pub.) 100 -01 to Provide Language -Only Changes for the New Medicare Card Project   06/18/2019  11240  R123GI  05/10/2019  Updates to Publication (Pub.) 100 -01, Medicare General Information, Eligibility, and Entitlement, Chapter 6, Disclosure of Information  06/11/2019  11218  R21GI  04/29/2005  Removal of Medicare Number from Reimbursement Checks  10/03/2005  3760  R07GI  06/25/2004  HIPAA Privacy Rules  N/A 2484  R01MGI  09/11/2002  Initial Publication of Manual  NA NA  Back to top of Chapter