evekhm/cms_iom_500 huggingface dataset:
(Medicare General Information, Eligibility, and Entitlement)
G. Disclosure of Medical Information Relating to Minors   In order to protect the privacy of a minor, a parent or authorized guardian who requests access to the minor's medical record may not be given direct access to the record.  Contr actors shall ask a parent or guardian who requests access to such a record to designate a physician or other professional (other than a family member) to whom the record may be sent.  The physician or health professional to whom the record is sent will be asked by the contractor to consider the effect that the disclosure of the record to the parent or guardian would have on the minor in determining whether the record should be made available to the parent or guardian.   The contractor will prepare a response  to the parent or guardian in substantially the following form:  We have completed processing your request for access to the medical records of (name)__________________________, a minor   The medical records have been sent to (name and address of designated  health professional) in accordance with your instructions   In each case where a minor's medical records are sent to a physician or health professional, reasonable efforts will be made by the contractor to so inform the minor.  In the event the parent or g uardian refuses to name a medical professional or cannot afford the fee for the service or the designated medical professional refuses to serve, the contractor will refer the file to the CMS regional office for appropriate action.   H. Disclosure to Third Parties   The Privacy Act permits disclosure to any third party with the written consent of the individual to whom the record pertains.  It also permits disclosure in certain instances without the individual's consent.  However, the contractor must not disc lose information unless the disclosure is specifically authorized in this chapter, or the individual has consented to the disclosure in writing, or the CMS regional office authorizes the disclosure.  I. Disclosures with Consent
(Medicare General Information, Eligibility, and Entitlement)
I. Disclosures with Consent   Except for those disclosure s discussed below in 10L of this chapter, Disclosure Without Consent, information may not be disclosed without the written consent of the subject individual, or their legal guardian, or, in the case of a minor, their parent (a parent or legal guardian of a minor may not consent to the disclosure of medical information about the minor).  Other persons, regardless of relationship (except members of Congress and representative payees), may not receive information about the individual without their consent.  In addition, a person who receives information about an individual with the individual's consent may not authorize disclosure of that information to someone else.  Awkward situations may develop from a refusal, in compliance with the Privacy Act, to divulge  information to the child or spouse of an aged or infirm individual.  In order to avoid lengthy and unproductive correspondence, the requester should be advised that the Privacy Act precludes our disclosing any information to anyone other than the individual to whom the information pertains without the specific written consent of that individual, but that the requested information will be sent directly to the individual concerned with an explanation of the inquiry received on their behalf.  J. Disclosures t o Members of Congress   Information requested by members of Congress and their staffs may be disclosed as follows:    Where a member of Congress (or a staff member) inquires on behalf of a constituent, the contractor may respond to the member of Congress (MC)  without the written consent of the individual, but must make a record of the disclosure.    Where the MC's inquiry is on behalf of a relative of the subject individual (but the inquirer is not the legal guardian of the individual, or the parent of the individual minor), the contractor should advise the MC that it can respond directly only to the individual unless the individual furnishes written consent to release the information about themselves to the MC (if we respond directly to the individual or with th eir consent, no accounting record is required).  Where the inquirer is the legal guardian, or the parent of a minor, the contractor may disclose the information to the MC, but must make a record of the disclosure.    Where the MC's inquiry is in writing and does not indicate whether the request is from the subject individual, the contractor will contact the MC, usually by telephone, to clarify the situation.
(Medicare General Information, Eligibility, and Entitlement)
 Where the MC's inquiry is in writing and does not indicate whether the request is from the subject individual, the contractor will contact the MC, usually by telephone, to clarify the situation.  A copy of the reply (or a report of telephone call if the response is by telephone) will provide an a dequate accounting record.  The record should show the date of disclosure, the information disclosed, and to whom the disclosure was made.  The contractor should file this record by name or social security claim number so that retrieval may be made expedit iously.  K. Disclosure to Representative Payees   An SSA -appointed representative payee is entitled to receive information on, or act on, behalf of a beneficiary to the extent necessary to protect the beneficiary's rights under title II or XVIII.   L. Disclo sure without Consent   Below are listed the situations in which data on identifiable individuals may be released without the individual's consent.  The disclosure is permitted if the disclosure would be:    To DHHS employees and officers who need the records to perform their duties;  Required by the FOIA;   To the Bureau of Census;   For research purposes under certain circumstances;   To the National Archives;   For law enforcement activities if the activity is authorized by law and the request is from the head of the  agency and specifies the particular record desired and the law enforcement activity for which the record is sought;   For compelling circumstances affecting the health and safety of any person if notice of the disclosure is sent to the last known address of  the individual;   To either House of Congress or to any congressional committee or subcommittee (see section I above for requests from members of Congress on behalf of constituents);   To the Comptroller General or an authorized representative to perform the duties of the General Accounting Office;   Pursuant to the order of a court of competent jurisdiction;   For a "routine use" -  A "routine use" is a disclosure of information which may be made without the individual's written consent because the disclosure is compatible with the purpose for which the information was collected in the first place.  An explanation of the purposes and uses of each "routine use" disclosure must be published in the Federal Register at least 30 days prior to the disclosure and at least  annually thereafter. Current routine uses are:
(Medicare General Information, Eligibility, and Entitlement)
 Part B Payment Records   Payment Record Reference File   Tape containing amount, type, and cost of health care services.   Summary Records   Group Health Plan Membership Data   Identification Data   Group Health Members hip Data   Group Health Membership List   Quality Assurance Program Releases and Corrections   M. Accounting for Disclosure  The Privacy Act requires that agencies account for disclosures of personal data to organizations outside DHHS or made in response to requests under the FOIA.  The purposes of the accounting are:    To allow individuals to learn to whom records about themselves have been disclosed; and    To provide a basis for subsequently advising recipients of any amended or disputed records.   The accounting must enable the contractor to tell the individual when and what information about the individual was released and to w hom.  It is not necessary to maintain a separate record of disclosures if such information can be retrieved from the contractor's operating records.   An individual has the same access rights to an accounting of disclosures as to other information, with no exception.  It is not mandatory to tell an individual about disclosures made to an agency for law enforcement purposes. (Refer requests for accountings that include disclosures to law enforcement agencies to the CMS regional office.)   The contractor must m aintain accounting records for 5 years, or the life of the basic record, whichever is longer.  The lives of various basic records are furnished in Chapter 1 of the Claims Processing Manual .  N. Reviewing and Correcting Records   Individuals are permitted by the Privacy Act to request correction of any record pertaining to themselves.  The contractor should have a method of reviewing records at the request of the individual and making correct ions where appropriate.  In reviewing an individual's request to amend a record, the contractor should, whenever practicable, complete the review and advise the individual of the results within 10 days of the receipt of the request.  Prompt action should be taken wherever possible to reduce the administrative costs involved in issuing both a separate acknowledgment of the receipt of the request and a subsequent notice informing the individual of the action taken.  If a contractor denies a request for correction, the individual can appeal to the system manager for the contractor's system of records.   O. Penalties
(Medicare General Information, Eligibility, and Entitlement)
O. Penalties   All employees must be aware of their responsibilities under the Privacy Act and guard against improper disclosure of personal information.  Any off icer or employee who willfully discloses individually identifiable information, the disclosure of which is prohibited by the Act, shall be guilty of a misdemeanor and fined not more than $5,000.  P. Providers, Physicians, Suppliers, and the Privacy Act:   1. Confidentiality of Provider and Supplier Records   Medicare information may not be accepted from providers, physicians, and other suppliers of services on a confidential basis, expressed or implied, since any medical information obtained by a contractor is subject to disclosure to the individual to whom it pertains.  Contractors are to make sure their providers and other suppliers of services are aware that no medical information marked "confidential" will be accepted on that basis and that any medical in formation received by the contractor may be disclosed to the patient or his/her representative upon request, either directly or through designated professional medical personnel.  If a provider, physician, or other supplier of services documents medical fi ndings on medical forms preprinted "confidential" or the provider or other supplier of services routinely stamps all records "confidential," such records, when transmitted to the contractor are to be accompanied by a signed statement to the effect that the  provider, physician or supplier understands that the information is subject to disclosure at the request of the patient or his/her representative under the Privacy Act.   2. Release of Eligibility Data to Providers and Suppliers When the Individual is Unab le to Sign an Authorization   In situations such as the admission to a hospital of an unconscious person, where the individual has not signed a statement authorizing the provider to pursue a Medicare claim, the disclosure of Medicare information to the provider should be treated as a routine use disclosure.  If the individual has authorized the provider or supplier to pursue a Medicare claim, the release of information may be treated as a disclosure made with the beneficiary's consent.  10.1 - Disclosure of Information  (Rev. 1, 09- 11-02)
(Medicare General Information, Eligibility, and Entitlement)
10.1 - Disclosure of Information  (Rev. 1, 09- 11-02)  The following sections contain instructions concerning the confidentiality and disclosure of information acquired and maintained by CMS, contractors (i.e., Medicare Administrative Contractors), providers, and State agencies in the administration of the health insurance program.  These instructions comply with the statutes and regulations governing disclosure of information, specifically section 1106 of the Social Security Act, the Freedom of Information Act (5 USC 552) and implementing HHS FOIA regulations  at 45 CFR Part 5, and CMS Confidentiality and Disclosure regulations at 42 CFR 401.101, et seq.  10.2 - Procedures for Handling Requests  (Rev. 1, 09- 11-02)  The Freedom of Information Act (FOIA) requires that within 20 working days of the receipt of a wri tten request for records (or information known to be contained within an agency record), Federal agencies must decide whether the records/information will or will not be disclosed.  By HHS regulation, only the CMS Freedom of Information Officer can make th is decision,  However, the CMS Freedom of Information Officer with the concurrence of the Office of the Assistant Secretary for Public Affairs, HHS, has delegated authority to Medicare contractors to directly release certain categories of frequently reques ted documents that the CMS Freedom of Information Officer has previously reviewed and decided to always release.  These records are called "direct release" records.  Some are identified within this manual; others are established by the CMS Freedom of Infor mation Officer in administrative issuances.   Accordingly, within 20 working days of receipt of an FOI request, if the contractor is authorized to release all or at least some of the requested records, it will advise the requester in writing whether the req uest will be wholly or partially fulfilled.
(Medicare General Information, Eligibility, and Entitlement)
The CMS does not permit the contractor to issue a written denial of any request for information, except in response to the contractor's direct receipt of a state or local court subpoena duces tecum that seeks re cords on a beneficiary or individual practitioner that are contained in a Privacy Act System of Records, when such subpoena is not accompanied by a valid authorization to release the records signed by the subject of records. (See 40.1B .)  CMS requires the contractor to refer to the RO all requests for which the contractor does not have clear authority to release the records/information.  Therefore, if the contractor receives a written reques t for records, the contractor must determine within 2 days of the receipt of the request whether it is clearly authorized to disclose the information.  When able to furnish the requested materials, the contractor will furnish it whenever possible, within 20 working days.  If it is not possible to furnish the materials within 20 working days, the contractor will immediately send the requester a substantive response that states that the records will be released, and explains the reason for the delay.   If the contractor is not clearly authorized to release the information, it notifies the RO immediately and refers the request to the RO for handling.  It sends the request, along with one set of the requested records, immediately to the RO by first class mail, an d clearly identifies the request as a Freedom of Information Act request.   The contractor acknowledges to the requester any request referred to the RO, using the following language:   Dear:   We have referred your (date) Freedom of Information Act request for (specify type of information requested) to: (name of the CMS Regional Office FOIA Coordinator, address of CMS RO, and telephone number of the CMS RO Coordinator).  Any questions you may have relative to your request should be directed to that office.   Sincerely yours,
(Medicare General Information, Eligibility, and Entitlement)
Any questions you may have relative to your request should be directed to that office.   Sincerely yours,   The contractor sends a copy of the acknowledgment letter with the request to the RO.  The contractor is not required to create records to comply with requests for information.  Contractors may answer requests that require creation of reco rds by stating that the requested records do not exist and that the FOIA does not require agencies to recreate records in order to respond to a request.  Include the appeal rights statement set forth below in the response.  (Note that deletion of non -releasable information from an existing record is not considered creation of a records, no matter how extensive or time consuming the deletion process might be.  Respond to requests that require creation of records using the following language:   Dear:   This is in response to your request dated ____, seeking access to (specify the subject(s) of requested record). Because you seek access to one or more agency records, or information contained in such records, we have considered your request under the Freedom of Information Act (FOIA) (5USC 552).  We are unable to comply with your request because the agency does not maintain a records that is responsive to your request and because, under FOIA, we are not required to create records or to furnish information in a par ticular form or format is not readily reproducible employing reasonable efforts.  If you have reason to disagree with this decision, you may appeal. Your appeal should be mailed, within 30 days of the date of this letter, to the   Deputy Administrator  Cent ers for Medicare & Medicaid Services,  Room C5- 16-03, 7500 Security Boulevard, Baltimore, Maryland 21244- 1850.  Please mark your envelope "Freedom of Information Act Appeal," and enclose a copy of this letter.   10.3 - Processing Freedom of Information Act ( FOIA) Requests (Rev. 1, 09- 11-02)
(Medicare General Information, Eligibility, and Entitlement)
Please mark your envelope "Freedom of Information Act Appeal," and enclose a copy of this letter.   10.3 - Processing Freedom of Information Act ( FOIA) Requests (Rev. 1, 09- 11-02)  Form CMS -632-FOI (Exhibit A)  serves as a cover sheet for FOI requests.  The form is designed to expedite the handling of requests and to provide the information necessary for reporting purposes.  For each FOI request, the contractor will complete a Form CMS -632-FOI.  Completion instr uctions for the form are included on the reverse side.  The contractor may furnish estimated costs if actual postage costs are not readily available.   Order Form CMS -632-FOI routinely on an annual basis using the CMS 1961 Forms Order.  Direct any interim r equests for Form CMS -632-FOI to CMS Forms Distribution Officer, Forms Management and Distribution, Office of Internal Customer Support.  Interim requests must be submitted in writing.   10.4 - Reporting Freedom of Information Act Activity  (Rev. 1, 09- 11-02)  The contractor's authority to directly release certain kinds of records includes the responsibility for complete and accurate reporting on the use of this authority.  The following are reporting requirements for Medicare contractors:    Fill out completely  and accurately a Form CMS -632-FOIA for each "direct release."    Maintain in either hardcopy or electronic form a Freedom of Information Daily Log on a daily basis.  This log must include the case control number, date of incoming letter, requester's name, s ubject of the request, the date received in the FOIA unit, the date the response was mailed and the invoiced fee.    Prepare, on a monthly basis, the Summary Sheet for the CMS Monthly FOIA Report ( Exhibit B ).  This Summary Sheet  aggregates data from the individual Form CMS -632.   Submit the Daily Log and Summary Sheet for a given month to your RO FOIA Coordinator by the end of the fifth work day of the following month.    Retain copies of all completed Forms CMS -632-FOI in accordance with record retention requirements for FOIA Administrative Files.
(Medicare General Information, Eligibility, and Entitlement)
 Retain copies of all completed Forms CMS -632-FOI in accordance with record retention requirements for FOIA Administrative Files.   20 - Case Numbering   Since many requesters make multiple FOIA requests, name identification is not adequate to assure proper tracking, or fiscal accounting.  Therefore, CMS employs a Case  Numbering System which includes unique identifiers for each releasing activity.    Use the Case Numbering System for all FOIA cases.    Use the case number in item one of the Form CMS -632-FOI and in the "case number" block at the top left of the Form CMS -633 Invoice of Fees for FOIA Services (Exhibit C) .  Requesters will be asked to put the case number on checks rendered for payment of FOIA services and on any correspondence relating to that case.   1. All cas e numbers in this system consist of ten characters.  These characters maybe numeric or alphabetical and are determined as follows:   a. Case numbers for requests responded to directly by contractors begin with an Arabic number for the Region.   Region  Case  Number  Region  Case  Number  Boston  1 Dallas  6 New York  2 Kansas City  7 Philadelphia  3 Denver  8 Atlanta  4 San Francisco  9 Chicago  5 Seattle  0  NOTE:   Only one space is designated to indicate the responding regional office or contractor within the region.  Therefore, Seattle is represented by "0" rather than by "10".   b. For example, a request responded to directly by any A/B MAC (B) within Region 1 would begin with the digit "1":   1---------   c. In all case numbers, the second character is the last digit of the calendar year in which the request is received by the responding activity.  , continuing the example above, for a 2001 request in Region 1:  11--------   d. Characters three through six indicate the contractor within the region.  A request answered by a contractor would use the last four digits of the contractor number in positions three through six.  Thus, a request responded to directly by Blu e Cross and Blue Shield of Rhode Island (A/B MAC (B) number 00870) would be:   110870----   e. The last four characters indicate the consecutively assigned case number, beginning with "0001".  Thus, the first request responded to by that A/B MAC (B) in calen dar year 2002 would be:   1108700002