(Medicare General Information, Eligibility, and Entitlement)

The contractor will prepare a response  to the parent or guardian in substantially the following form:  We have completed processing your request for access to the medical records of (name)__________________________, a minor   The medical records have been sent to (name and address of designated  health professional) in accordance with your instructions   In each case where a minor's medical records are sent to a physician or health professional, reasonable efforts will be made by the contractor to so inform the minor.  In the event the parent or g uardian refuses to name a medical professional or cannot afford the fee for the service or the designated medical professional refuses to serve, the contractor will refer the file to the CMS regional office for appropriate action.   H. Disclosure to Third Parties   The Privacy Act permits disclosure to any third party with the written consent of the individual to whom the record pertains.  It also permits disclosure in certain instances without the individual's consent.  However, the contractor must not disc lose information unless the disclosure is specifically authorized in this chapter, or the individual has consented to the disclosure in writing, or the CMS regional office authorizes the disclosure.  I. Disclosures with Consent   Except for those disclosure s discussed below in 10L of this chapter, Disclosure Without Consent, information may not be disclosed without the written consent of the subject individual, or their legal guardian, or, in the case of a minor, their parent (a parent or legal guardian of a minor may not consent to the disclosure of medical information about the minor).  Other persons, regardless of relationship (except members of Congress and representative payees), may not receive information about the individual without their consent.  In addition, a person who receives information about an individual with the individual's consent may not authorize disclosure of that information to someone else.  Awkward situations may develop from a refusal, in compliance with the Privacy Act, to divulge  information to the child or spouse of an aged or infirm individual.  In order to avoid lengthy and unproductive correspondence, the requester should be advised that the Privacy Act precludes our disclosing any information to anyone other than the individual to whom the information pertains without the specific written consent of that individual, but that the requested information will be sent directly to the individual concerned with an explanation of the inquiry received on their behalf.  J. Disclosures t o Members of Congress   Information requested by members of Congress and their staffs may be disclosed as follows:    Where a member of Congress (or a staff member) inquires on behalf of a constituent, the contractor may respond to the member of Congress (MC)  without the written consent of the individual, but must make a record of the disclosure.    Where the MC's inquiry is on behalf of a relative of the subject individual (but the inquirer is not the legal guardian of the individual, or the parent of the individual minor), the contractor should advise the MC that it can respond directly only to the individual unless the individual furnishes written consent to release the information about themselves to the MC (if we respond directly to the individual or with th eir consent, no accounting record is required).  Where the inquirer is the legal guardian, or the parent of a minor, the contractor may disclose the information to the MC, but must make a record of the disclosure.    Where the MC's inquiry is in writing and does not indicate whether the request is from the subject individual, the contractor will contact the MC, usually by telephone, to clarify the situation.  A copy of the reply (or a report of telephone call if the response is by telephone) will provide an a dequate accounting record.  The record should show the date of disclosure, the information disclosed, and to whom the disclosure was made.  The contractor should file this record by name or social security claim number so that retrieval may be made expedit iously.  K. Disclosure to Representative Payees   An SSA -appointed representative payee is entitled to receive information on, or act on, behalf of a beneficiary to the extent necessary to protect the beneficiary's rights under title II or XVIII.   L. Disclo sure without Consent   Below are listed the situations in which data on identifiable individuals may be released without the individual's consent.  The disclosure is permitted if the disclosure would be:    To DHHS employees and officers who need the records to perform their duties;  Required by the FOIA;   To the Bureau of Census;   For research purposes under certain circumstances;   To the National Archives;   For law enforcement activities if the activity is authorized by law and the request is from the head of the  agency and specifies the particular record desired and the law enforcement activity for which the record is sought;   For compelling circumstances affecting the health and safety of any person if notice of the disclosure is sent to the last known address of  the individual;   To either House of Congress or to any congressional committee or subcommittee (see section I above for requests from members of Congress on behalf of constituents);   To the Comptroller General or an authorized representative to perform the duties of the General Accounting Office;   Pursuant to the order of a court of competent jurisdiction;   For a "routine use" -  A "routine use" is a disclosure of information which may be made without the individual's written consent because the disclosure is compatible with the purpose for which the information was collected in the first place.  An explanation of the purposes and uses of each "routine use" disclosure must be published in the Federal Register at least 30 days prior to the disclosure and at least  annually thereafter. Current routine uses are:    Part B Payment Records   Payment Record Reference File   Tape containing amount, type, and cost of health care services.   Summary Records   Group Health Plan Membership Data   Identification Data   Group Health Members hip Data   Group Health Membership List   Quality Assurance Program Releases and Corrections   M. Accounting for Disclosure  The Privacy Act requires that agencies account for disclosures of personal data to organizations outside DHHS or made in response to requests under the FOIA.  The purposes of the accounting are:    To allow individuals to learn to whom records about themselves have been disclosed; and    To provide a basis for subsequently advising recipients of any amended or disputed records.   The accounting must enable the contractor to tell the individual when and what information about the individual was released and to w hom.  It is not necessary to maintain a separate record of disclosures if such information can be retrieved from the contractor's operating records.   An individual has the same access rights to an accounting of disclosures as to other information, with no exception.  It is not mandatory to tell an individual about disclosures made to an agency for law enforcement purposes. (Refer requests for accountings that include disclosures to law enforcement agencies to the CMS regional office.)   The contractor must m aintain accounting records for 5 years, or the life of the basic record, whichever is longer.  The lives of various basic records are furnished in Chapter 1 of the Claims Processing Manual .  N. Reviewing and Correcting Records   Individuals are permitted by the Privacy Act to request correction of any record pertaining to themselves.  The contractor should have a method of reviewing records at the request of the individual and making correct ions where appropriate.  In reviewing an individual's request to amend a record, the contractor should, whenever practicable, complete the review and advise the individual of the results within 10 days of the receipt of the request.  Prompt action should be taken wherever possible to reduce the administrative costs involved in issuing both a separate acknowledgment of the receipt of the request and a subsequent notice informing the individual of the action taken.  If a contractor denies a request for correction, the individual can appeal to the system manager for the contractor's system of records.   O. Penalties   All employees must be aware of their responsibilities under the Privacy Act and guard against improper disclosure of personal information.  Any off icer or employee who willfully discloses individually identifiable information, the disclosure of which is prohibited by the Act, shall be guilty of a misdemeanor and fined not more than $5,000.  P. Providers, Physicians, Suppliers, and the Privacy Act:   1. Confidentiality of Provider and Supplier Records   Medicare information may not be accepted from providers, physicians, and other suppliers of services on a confidential basis, expressed or implied, since any medical information obtained by a contractor is subject to disclosure to the individual to whom it pertains.  Contractors are to make sure their providers and other suppliers of services are aware that no medical information marked "confidential" will be accepted on that basis and that any medical in formation received by the contractor may be disclosed to the patient or his/her representative upon request, either directly or through designated professional medical personnel.  If a provider, physician, or other supplier of services documents medical fi ndings on medical forms preprinted "confidential" or the provider or other supplier of services routinely stamps all records "confidential," such records, when transmitted to the contractor are to be accompanied by a signed statement to the effect that the  provider, physician or supplier understands that the information is subject to disclosure at the request of the patient or his/her representative under the Privacy Act.   2. Release of Eligibility Data to Providers and Suppliers When the Individual is Unab le to Sign an Authorization   In situations such as the admission to a hospital of an unconscious person, where the individual has not signed a statement authorizing the provider to pursue a Medicare claim, the disclosure of Medicare information to the provider should be treated as a routine use disclosure.  If the individual has authorized the provider or supplier to pursue a Medicare claim, the release of information may be treated as a disclosure made with the beneficiary's consent.  10.1 - Disclosure of Information  (Rev. 1, 09- 11-02)  The following sections contain instructions concerning the confidentiality and disclosure of information acquired and maintained by CMS, contractors (i.e., Medicare Administrative Contractors), providers, and State agencies in the administration of the health insurance program.  These instructions comply with the statutes and regulations governing disclosure of information, specifically section 1106 of the Social Security Act, the Freedom of Information Act (5 USC 552) and implementing HHS FOIA regulations  at 45 CFR Part 5, and CMS Confidentiality and Disclosure regulations at 42 CFR 401.101, et seq.  10.2 - Procedures for Handling Requests  (Rev. 1, 09- 11-02)  The Freedom of Information Act (FOIA) requires that within 20 working days of the receipt of a wri tten request for records (or information known to be contained within an agency record), Federal agencies must decide whether the records/information will or will not be disclosed.  By HHS regulation, only the CMS Freedom of Information Officer can make th is decision,  However, the CMS Freedom of Information Officer with the concurrence of the Office of the Assistant Secretary for Public Affairs, HHS, has delegated authority to Medicare contractors to directly release certain categories of frequently reques ted documents that the CMS Freedom of Information Officer has previously reviewed and decided to always release.  These records are called "direct release" records.  Some are identified within this manual; others are established by the CMS Freedom of Infor mation Officer in administrative issuances.   Accordingly, within 20 working days of receipt of an FOI request, if the contractor is authorized to release all or at least some of the requested records, it will advise the requester in writing whether the req uest will be wholly or partially fulfilled.   The CMS does not permit the contractor to issue a written denial of any request for information, except in response to the contractor's direct receipt of a state or local court subpoena duces tecum that seeks re cords on a beneficiary or individual practitioner that are contained in a Privacy Act System of Records, when such subpoena is not accompanied by a valid authorization to release the records signed by the subject of records. (See 40.1B .)  CMS requires the contractor to refer to the RO all requests for which the contractor does not have clear authority to release the records/information.  Therefore, if the contractor receives a written reques t for records, the contractor must determine within 2 days of the receipt of the request whether it is clearly authorized to disclose the information.  When able to furnish the requested materials, the contractor will furnish it whenever possible, within 20 working days.  If it is not possible to furnish the materials within 20 working days, the contractor will immediately send the requester a substantive response that states that the records will be released, and explains the reason for the delay.   If the contractor is not clearly authorized to release the information, it notifies the RO immediately and refers the request to the RO for handling.  It sends the request, along with one set of the requested records, immediately to the RO by first class mail, an d clearly identifies the request as a Freedom of Information Act request.   The contractor acknowledges to the requester any request referred to the RO, using the following language:   Dear:   We have referred your (date) Freedom of Information Act request for (specify type of information requested) to: (name of the CMS Regional Office FOIA Coordinator, address of CMS RO, and telephone number of the CMS RO Coordinator).  Any questions you may have relative to your request should be directed to that office.   Sincerely yours,