evekhm/cms_iom_500 huggingface dataset:
(Medicare General Information, Eligibility, and Entitlement)
Requests which include a provider population beyond the jurisdiction of the contractor may involve data which have not been made available by CMS for public release.  Requests for such combined data will be handled by the RO, which, if it approves the release, will furnish the requestor with the appropriate combined data and alert the contractor s involved regarding the release.   170 - Disclosure of Health Insurance Information by Providers  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19  The term Medicare beneficiary identifier (Mbi) is a general term describing a benef iciary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.   Records and information, acquired in the administration of the Medicare program, may be disclosed only under prescribed rules and regulations or under the authority of the Administrator of CMS.  Information furnished specifically for purposes of a claim under the health insurance program is subject to these rules and regulations.  These regulations apply to Governmental or private agencies that participate in pr ogram administration.  These entities include the following:    Institutions;  Agencies;   Person(s) providing services; and   Providers of services.   The type of information includes, but is not limited to, the following:    The individual's Medicare beneficiary identifier ;  Facts regarding the individual's entitlement to health insurance benefits; and   Medical and other information obtained from CMS, a MAC (contractor).   Information not subject to these rules and regulations includes information in the provider's own records, such as the following:    Name;   Date of Birth;  Sex;  Marital status; and   Address.   A provider's own records are, however, subject to requirements listed in the "Conditions of Participation", that "Patient's records be kept confidential (20 CFR Pa rt 405.126).  These records may also be subject to State or local laws governing disclosure.
(Medicare General Information, Eligibility, and Entitlement)
Providers are also responsible for following conditions for coverage.  A provider or supplier that receives a request for disclosure of information about a Medica re beneficiary, Medicare claim, or related information that it may not disclose, should refer the requestor to the appropriate contractor for further consideration of the request.  170.1 - Disclosure of Health Insurance Information to a Beneficiary or in Connection With a Claim  (Rev. 1, 09- 11-02)  Information such as Medicare entitlement or eligibility data may be disclosed to a beneficiary or their authorized representative (this includes the beneficiary's representative payee).   170.2 - Disclosure to Contractors (Rev. 1, 09- 11-02)  Providers and suppliers may not forward medical information to contractors on a confidential basis, expressed, or implied, since, under the Privacy Act, any medical information obtained by a contractor is subject to disclosure to the individual to whom the information pertains or to another person authorized by the individual to have access to it.  Some providers and suppliers document findings on medical forms pre -printed "confidential" or routinely stamp all records "confidential" whether or not such records are ever intended for disclosure to a contractor.  The contractor will accept such records only if the provider or supplier accompanies them with a signed statement indicating the following:    That the pr ovider or supplier understands the information is subject to disclosure to the patient under the Privacy Act, and    That any words or statements that the transmitted records are confidential may be disregarded if the patient or the patient's representative  requests them from the contractor or from CMS.   170.3 - Disclosure to Third parties for Proper Administration of the Health Insurance Program  (Rev. 1, 09- 11-02)  Disclosure by the provider or supplier to persons other than the individual or the individual's authorized representative of any records, reports, or other information about the individual is authorized without the individual's or their representative's consent under the following circumstances:   The disclosure is required in connection with any claim or other proceeding under the Social Security Act for the proper performance of the duties of:    Any officer or employee of the Department; or    Any officer or employee of a State agency, A/B MAC (A or HHH), provider of services, or other age ncy or organization participating in the administration of the program, by contract or agreement, in carrying out such contract or agreement.
(Medicare General Information, Eligibility, and Entitlement)
These limitations apply whether or not the individual to whom the information pertains authorizes further disclosure to third parties (e.g., to a private medical plan).   170.4 - Disclosure to Third Parties for Other Than program Purposes  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19  The term Medicare beneficiary identifier (Mbi) i s a general term describing a beneficiary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new M edicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.   Information obtained from CMS or its contractor is confidential and may be disclosed only under conditions prescribed in rul es and regulations or on the express authorization of the Administrator of CMS.  However, certain limited information about a beneficiary's Medicare eligibility status and related claims information may be released to third party payers with the beneficiar y's express authorization.  The following information may be released subject to necessary authorization:    Medicare beneficiary identifier ;  Coinsurance and deductible status;   Dates of entitlement to Medicare;   Copies of Medicare claims forms;   Medicare repor t of eligibility; and   Explanation of Medicare Benefits (EOMB) or Medicare Summary Notice (MSN).   Providers should refer requests for other information to the contractor.  Contractors refer requests to the CMS regional office.   The provider or supplier wil l adhere to the following authorization guidelines to ensure that information is not released without the required authorization.  Authorization must:
(Medicare General Information, Eligibility, and Entitlement)
Providers should refer requests for other information to the contractor.  Contractors refer requests to the CMS regional office.   The provider or supplier wil l adhere to the following authorization guidelines to ensure that information is not released without the required authorization.  Authorization must:    Be in writing;   Be signed and dated by the individual or someone authorized to act on the individual's behalf;   Specify the name of the provider authorized to disclose information;   Specify what information the individual is authorizing the provider to disclose;   Specify the names of the third party payers to whom the information is being released;   Specify the purpose for which the information is being released;   Specify an expiration date for the authorization that should not exceed 2 years from the date it was signed; and   Specify that it may be revoked at any time.  170.5 - Disclosure of Claims Payment Information in Alcohol and Drug Abuse Cases  (Rev. 1, 09- 11-02)  The law requires providers to observe more stringent rules when disclosing medical information for claims processing purposes from the records of alcohol and drug abuse patients.  Since the standard consent statement on the provider billing form is not sufficient authority, under the law, to permit the provider to release information from the records of alcohol or drug abuse patients, more explicit consent statements are required.   Providers that part icipate in Medicare and alcohol and drug abuse prevention and treatment programs must obtain written consent in each alcohol or drug abuse case from beneficiaries to release medical information.  This written consent, which allows the provider to disclose the records of the patient, must include all of the following:
(Medicare General Information, Eligibility, and Entitlement)
 The name of the organization (e.g., hospital name) that is to make the disclosure;   The name or title of the person or organization to which disclosure is to be made (e.g., CMS, including the a ppropriate MAC, specified by name);   The name of the patient;   The purpose or need for the information to be disclosed (e.g., for processing a claim for Medicare payment and for such evaluation of the treatment program as is legally and administratively requ ired in the overall conduct of the Medicare program);   The specific extent or nature of information to be disclosed (e.g., all medical records regarding the beneficiary's treatment, hospitalization, and/or outpatient care including treatment for drug abuse or alcoholism);   A statement that the beneficiary may revoke their consent at any time to prohibit disclosures on or after date or revocation;   A statement specifying a date (not to exceed 2 years), event, or condition upon which consent expires without revocation;   The date on which the consent is signed; and   The signature of the patient or the signature of their authorized or legal representative.   If the beneficiary wishes, the consent statement may be expanded to permit disclosure by the provider to any other person, organization, or program (e.g., PRO), as appropriate.  Providers may also give authorization to CMS and its contractors to re -disclose specific information to third party payers for complementary insurance purposes.   The provider keeps the consent statement with the patient's medical and other records.   The duration of the consent statement is not to exceed 2 years after which it must be renewed by the beneficiary if further disclosures are necessary.   170.6 - Disclosure of Itemized Statement to an Individual for Any Item or Service Provided  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19
(Medicare General Information, Eligibility, and Entitlement)
170.6 - Disclosure of Itemized Statement to an Individual for Any Item or Service Provided  (Rev.  124, Issued: 05- 17-19, Effective: 06- 18-19, Implementation: 06- 18-19  The term Medicare beneficiary identifier (Mbi) is a general term describing a beneficiary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.   A.  General   Section 4311 of the Balanced Budget Act of 1997 requires that if a Medicare beneficiary submits a written request to a health services provider for an itemized statement for any Medicare item  or service provided to that beneficiary, the provider must furnish this statement within 30 days of the request.  The law also states that a health services provider not furnishing this itemized statement may be subject to a civil monetary penalty of up t o $100 for each unfulfilled request.  Since most institutional health practices have established an itemized billing system for internal accounting procedures as well as for billing other payers, the furnishing of an itemized statement should not pose any significant additional burden.  B.  30- Day Period to Furnish Statement   The provider will furnish to the individual described above, or duly authorized representative, no later than 30 days after receipt of the request, an itemized statement describing each item or service provided to the individual requesting the itemized statement.   C.  Suggested Contents of Itemized Statement
(Medicare General Information, Eligibility, and Entitlement)
C.  Suggested Contents of Itemized Statement   Although 4311 of the Balanced Budget Act of 1997 does not specify the contents of an itemized statement, suggestions for the typ es of information that might be helpful for a beneficiary to receive on any statement include: beneficiary name, date(s) of service, description of item or service furnished, number of units furnished, provider charges, and an internal reference or trackin g number.  If Medicare has adjudicated the claim, additional information the provider can include are: amounts paid by Medicare, beneficiary responsibility for co- insurance, and Medicare beneficiary identifier .  The statement should also include a name and telephone number for the beneficiary to call if there are further questions.   D.  Penalty   A knowing failure to furnish the itemized statement shall be subject to a civil monetary penalty of up to $100 for each such failure.   180 - Cost to a Provider That Requests Information Available to the Public  (Rev. 1, 09- 11-02)  Providers are required to pay appropriate fees for information they request pertaining to other providers, Medicare contractors, or State agencies. A provider may c laim such fees as allowable costs only if it demonstrates to the contractor the information is necessary in developing and maintaining the operations of patient care facilities and activities.   190 - The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule  (Rev. 7, 06- 25-04)  A. General Information   To improve the efficiency and effectiveness of the health care system, HIPAA included provisions that required national standards for electronic health care transactions.  At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information.  Consequently, Congress incorporated into HIPAA provisions that mandated the adoption of Federal privacy protections for individually identifiable hea lth information.  The Department of Health and Human Services issued the regulation Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164, (the HIPAA Privacy Rule) to implement section 264 of HIPAA.  The HIPAA Pr ivacy Rule establishes a set of basic national privacy standards and fair information practices.  It sets a floor of ground rules for health care providers, health plans, and health care clearinghouses to follow to protect the privacy of an individuals pe rsonal health information.
(Medicare General Information, Eligibility, and Entitlement)
The HIPAA Privacy Rule is based on the same fair information principles that are found in the Privacy Act of 1974 and are now generally extended to the public and private sectors of the health care delivery system.  The HIPAA Pr ivacy Rule applies to protected health information (PHI) held by covered entities, as defined by the Rule, while the Privacy Act protects records with individually identifiable information held by Federal agencies.  The Privacy Act continues to apply to Me dicare and Medicare fee- for-service (FFS) contractors in their day -to-day operations.   The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for providing outreach and technical assistance to covered entities (healt h plans, health care clearinghouses, and health care providers who conduct certain financial and administrative transactions electronically) and for enforcing the HIPAA Privacy Rule.  OCR maintains information on the HIPAA Privacy Rule at http://www.hhs.gov/ocr/hipaa/   B. How CMS Applies Laws Affecting the use and Disclosure of Personal Information   1. General rules   Since Medicare operates under both the Privacy Act and the HIPAA Privacy Rule, CMS has determined how the provisions interact with each other as it uses personally identifiable information in its day -to-day operations.  For example, a use or disclosure that is permitted under the HIPAA Privacy Rule (e.g., to facilitate cadaveric organ donati on and transplants), but not published in a Federal Register notice as a routine use in a CMS system of records would not be permitted for Medicare.  Similarly, if the disclosure is a routine use under the Privacy Act, but the HIPAA Privacy Rule prohibit s the disclosure, CMS will not make the disclosure.  Exemption 6 of the Freedom of Information Act (FOIA) permits Federal agencies to withhold personnel and medical files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.  When a FOIA request asks for documents that include personal information, CMS must apply Exemption 6 to preclude the release of, or must otherwise redact, identifying details before disclosing the remaining information.   2. Information About Deceased Individuals
(Medicare General Information, Eligibility, and Entitlement)
2. Information About Deceased Individuals   The application of Exemption 6 of the FOIA to information about deceased individuals requires a different analysis than that applicable to living individuals because under the Privacy Act of 1974, privacy rights are extinguished at death.  However, under FOIA, it is entirely appropriate to consider the privacy interest of a decedents survivors under Exemption 6.  Under the HIPAA Privacy Rule, the personal health information of deceased as well as living persons is protected.  3. Requests f or Access to Records   The FOIA and Privacy Act requests will continue to be handled according to current procedures and timeliness standards.  A FOIA request for access to public records requires CMS, as a Federal agency, to provide the fullest possible di sclosure of its records to the public, subject to certain exceptions (e.g., proprietary information, national defense risks).  The Privacy Act requires CMS to provide individuals access to their personal information maintained in a System of Records.  Note  that an individuals request under the Privacy Act to access his or her records must specify a Privacy Act System of Records and must be addressed to the system manager identified in the Federal Register notice.   A HIPAA Privacy Rule request for access is  separate from both FOIA and the Privacy Act and has its own timeliness standards associated with it.  Requests for access under the HIPAA Privacy Rule will be handled by CMS Central Office (see section G below).   4. State Law Preemption Under HIPAA   Medi care is a national program that is administered under Federal statute and regulation.  CMS administers Medicare through Medicare FFS contractors that are required to operate in accordance with statutory and regulatory requirements and CMS administrative direction.   When considering the provisions of HIPAA, Congress expressly intended to defer to more stringent state laws if those laws conflict with provisions in the HIPAA Privacy Rule.  The HIPAA Privacy Rule therefore explicitly preempts conflicting state law provisions, unless they are more stringent or more protective of the individuals rights.  Since the Federal law expressly preserves more stringent state laws, and because of the complexity of this issue, contractors should ask CMS for guidance as issues arise.   C. CMS Programs that are Covered Entities Under HIPAA
(Medicare General Information, Eligibility, and Entitlement)
C. CMS Programs that are Covered Entities Under HIPAA   The Federal health programs that CMS administers are health plans as defined in HIPAA and are covered entities subject to the HIPAA Privacy Rule.  These health plans are:   Part A or Part B of the Medicare program under Title XVIII;    The Medicaid program under Title XIX;    The State Childrens Health Insurance Program (SCHIP); and    The Medicare Advantage (formerly Medicare+Choice (M+C)) program and other Medicare health plans.   The CMS is directly responsible for ensuring that the Medicare Fee- For-Service (FFS) program, also known as the Original Medicare Plan, complies with the HIPAA Privacy Rule.  For the Medicaid and SCHIP programs, the appropriate State Agency is responsible for ensurin g compliance with privacy requirements.  Medicare Advantage (formerly M+C) plans are covered entities subject to the HIPAA Privacy Rule in their own right and responsible for their own compliance.   D. Business Associates  Most health care providers and hea lth plans do not carry out all of their health care activities and functions by themselves; they require assistance from a variety of contractors and other businesses.  By definition, a business associate is a person or entity that performs or assists in the performance of a function or activity involving the use or disclosure of individually identifiable health information on behalf of a covered entity.   Medicare FFS contractors that perform health care activities involving the use of PHI on behalf of the Medicare FFS health plan (i.e., claims processing functions) are business associates of the Medicare FFS health plan (the covered entity).  The HIPAA Privacy Rule allows providers and plans to give PHI to their business associates as long as they have sati sfactory assurances and document those assurances, typically by contract, that business associates will safeguard the information.  Medicare contracts have been modified to include the business associate provisions.  These provisions also address the contr actors responsibility to ensure that subcontractors or agents to whom they disclose Medicare data agree, by contract, to safeguard any PHI as well.  Contracts continue to include language that applies to contractors who maintain or operate a Privacy Act p rotected systems of records on Medicares behalf.