evekhm/cms_iom_500 huggingface dataset:
(Medicare General Information, Eligibility, and Entitlement)
Medicare contractors that perform health care activities involving the use of PHI on behalf of the Medicare FFS health plan are not  business associates of providers, physicians, suppliers, clearinghouses, or other health plans.  Likewise, providers, physicians, suppliers, clearinghouses, or other health plans are not  business associates of the Medicare contractor unless the provider, physician, supplier, clearinghouse, or other health plan is doing work on behalf of the Medicare contractor.  For these reasons, Medicare FFS contractors should not sign business associate agreements with any provider, physician, supplier, clearinghouse, or other plan unless the provider, physician, supplier, clearinghouse, or other health plan is doing work on the contractors behalf.   E. Trading Partner Agreements   Currently, Medicare contractors execute trading partner agreements (TPAs) with a number of payers, including Medigap insurers, Medicare supplemental/employee retiree health plans, multiple employer welfare trusts, TRICARE for Life, as well as State Medicaid Agencies, for the purpose of exchanging adjudicated Medicare claims for secondary liabili ty determination by those partners. This exchange of data is commonly referred to as the claims crossover process. For coordination of benefits (COB) purposes, Medicare contractors and trading partners are not business associates of each other since neit her entity is doing work on the others behalf; therefore, MAC s should not sign business associate agreements with COB trading partners that receive claims crossover data from them.   F. Notice of Privacy Practices   The HIPAA Privacy Rule requires each cove red entity to develop and provide a plain language notice that describes its legal duties, the uses and disclosures of protected health information that it may make, and individual privacy rights and how to exercise them.  The individual rights include the  right to inspect and copy protected health information, to amend protected health information, to request restrictions, confidential communications, an accounting of disclosures, a paper copy of the privacy notice, and how to file complaints.   Medicares privacy notice was provided to beneficiaries for the first time in the 2003 Medicare & You handbook and is provided in the handbook every year.  New enrollees receive the privacy notice in the handbook that is mailed to them within 30 days of Medicare entitlement.  Medicares privacy notice is also posted on Medicares Web site at www.medicare.gov .
(Medicare General Information, Eligibility, and Entitlement)
Medicares Notice of Privacy Practices informs beneficiaries who are interested in exercising individual rights to go to www.medicare.gov  or call 1 -800-MEDICARE.  Customer Service Representatives (CSR) at 1 -800-MEDICARE use scripts to answer questions regarding exercising individual rights and filing complaints.   Since Med icares privacy notice describes the uses and disclosures of PHI in the day -to-day operations of Medicare (including Medicare FFS contractors), FFS contractors are not required to develop a separate privacy notice for Medicare beneficiaries.   G. Individual  Rights and Complaints   NOTE:   For Individual Rights Under the Privacy Act of 1974, see 10 above.  The HIPAA Privacy Rule gives individuals rights with respect to their PHI.  These rights are listed in covered entities privacy notices.  The Notice of Pri vacy Practices for the Original Medicare Plan includes the right to:  1. See and get a copy of personal health information held by Medicare.   CMS Central Office is responsible for responding to beneficiary requests for access to records under the HIPAA Pri vacy Rule.  Medicare FFS contractors should only respond to those requests for information related to payment of a claim, for which they are already responsible under the contract under existing customer service procedures.   Simple telephone inquiries, such as asking about the status of a claim or requesting a duplicate Medicare Summary Notice, are not considered a HIPAA request for access and should be handled under existing customer service procedures.   2. Have personal health information amended if it i s wrong or missing, and Medicare agrees.  If Medicare disagrees, a statement of disagreement may be added to the personal health information.  Central office is responsible for handling beneficiary requests to amend the record under the HIPAA Privacy Rule.  Contractors will not be responding to requests to amend records.  Requests for changes to claims or payment records, such as an appeal or change of address request, are not considered HIPAA Privacy Rule requests for amendments, and should be handled according to current procedures.   Note, however, that if the request for amendment involves medical records, contractors should explain that, except in rare circumstances, only the source of the medical record (i.e., the provider) may make changes to the recor d.  3. Get a listing of those receiving personal medical information from Medicare.
(Medicare General Information, Eligibility, and Entitlement)
3. Get a listing of those receiving personal medical information from Medicare.   CMS Central Office is responsible for responding to beneficiary requests for an accounting of disclosures under the HIPAA Privacy Rule. Contractors will not be responding to requests for an accounting of disclosures.   The listing does not cover personal health information that was given to the individual or his or her personal representative, that was given out to pay for health care or Medicare operations, or that was given out for law enforcement purposes.  4. Ask Medicare to communicate in a different manner or at a different place, for example, by sending materials to a P.O. box instead of the address on file.   Current regulations and existing agreements with the Social Security Administration are extremely prescriptive, often governing precisely how CMS can respond to requests for confidential communications.  Operationally, CMS can only maintain one address at a time.  Because of this, routine change of address requests  should be handled according to current change of address procedures.   5. Ask Medicare to limit how personal health information is used and given out to pay claims and run the Medicare program.   CMS Central Office is responsible for responding to beneficia ry requests to restrict disclosure of PHI.  Contractors will not be responding to requests to restrict disclosure of PHI.   6. Get a separate paper copy of the privacy notice.  Contractors who receive requests for a paper copy of the Notice of Privacy Pract ices for the Original Medicare Plan should refer requestors to their Medicare & You handbook.   7. File a complaint.   Medicares Notice of Privacy Practices informs individuals of the right to file complaints about Medicares privacy practices with either M edicare or the Secretary of Health and Human Services.  The privacy notice refers individuals to www.medicare.gov  or 1-800-MEDICARE for further information on filing a complaint.   CMS is required to document in writ ten or electronic form the complaints received and their disposition. There is no requirement to respond in a particular manner or time frame.   For the privacy rights listed above where CMS Central Office is responsible for responding to the request, contr actors should advise beneficiaries to address their requests to:   HIPAA Privacy  P.O. Box 8050 U.S. Department of Health and Human Services  Centers for Medicare & Medicaid Services  7500 Security Boulevard  Baltimore, MD 21244- 1850  H. Privacy Authorizations
(Medicare General Information, Eligibility, and Entitlement)
HIPAA Privacy  P.O. Box 8050 U.S. Department of Health and Human Services  Centers for Medicare & Medicaid Services  7500 Security Boulevard  Baltimore, MD 21244- 1850  H. Privacy Authorizations   An authorization is a document that an individual uses to give a covered entity permission to disclose his or her PHI for a particular purpose (e.g., for marketing) or to a third party specified by the individual.  A covered entity is generally not requir ed to obtain an authorization for the use or disclosure of PHI for treatment, payment, or health care operations, as well as for certain public priority activities under specified conditions (e.g., health care oversight, law enforcement).  Contractors should inform providers that contractors are unable to make payment for Medicare claims if the provider fails to provide the information needed to process them.    The HIPAA Privacy Rule specifies certain core elements and required statements for a valid author ization.  Contractors may add more elements to their authorizations as long as the core elements and required statements remain and no provisions are added that conflict with these core elements and statements.   Contractors must also accept an authorization from another entity, provided it includes all of the core elements and required statements, and no provisions are added that conflict with these core elements and statements.   I. Core Elements and Required Statements for an Authorization  The core elemen ts of a valid authorization are:   1. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;   2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;   3. The name or other specific identification of the person(s) or class of persons, to whom the covered entity may make the requested use or disclosure;   4. A description of each purpose of the requested use or disclosure.  The statement, at the request of the individual is a sufficient description of the purpose when the beneficiary initiates the authorization and does not, or elects not to, provide a statement of the purpose;   5. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure; and
(Medicare General Information, Eligibility, and Entitlement)
5. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure; and   6. The signature of the individual and date.  If a personal representative of the individual signs the authorization, a description of such representatives authority to act for the individual must also be provided.  Although the HIPAA Privacy Rule requires only a description of the representatives authority to act for the individual, CMS is requiring that documentation showing the representatives authority be attached to the authorization (e.g., a Power of Attorney).   In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:   1. The individuals right to revoke the authoriz ation in writing, how the individual may revoke the authorization, and the exceptions to the right to revoke, e.g., You have the right to take back (revoke) your authorization at any time in writing, except to the extent that Medicare has already acted based on your permission.  To revoke your authorization, send a written request to: [Each Medicare contractor or CMS: Please insert Name, Address, and Telephone number of your organization here];   2. The inability to condition treatment, payment, enrollme nt or eligibility for benefits on the authorization, e.g., I understand refusal to authorize disclosure of my personal medical information will have no effect on my enrollment, eligibility for benefits, or the amount Medicare pays for the health services I receive;   3. The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected, e.g.: Your personal medical information that you authorize Medicare to disclose may be subject to  redisclosure and no longer protected by law.   In addition, the authorization must be written in plain language and a signed copy must be provided to the individual (or the individual should be advised to retain a copy).   The CMS is developing a standard authorization for beneficiaries or their personal representatives to request disclosure of PHI to third parties.  The standard will contain the elements for compliance with both the HIPAA Privacy Rule and Privacy Act requirements.  Contractors will be noti fied when the standard authorization is available.   J. Personal Representatives and Third Party Authorizations
(Medicare General Information, Eligibility, and Entitlement)
J. Personal Representatives and Third Party Authorizations   The HIPAA Privacy Rule requires covered entities to treat an individuals personal representative as the individual with respect to uses and di sclosures of the individuals PHI, as well as exercising the individuals privacy rights listed in the covered entitys Notice of Privacy Practices.  A personal representative may also authorize disclosures of an individuals PHI (see 190H above).   In addition to these formal designations of a personal representative, the HIPAA Privacy Rule permits a covered entity to disclose to any person identified by the individual the protected health information directly relevant to such persons involvement with the  individuals care or payment related to the individuals care.  Therefore, a verbal authorization is allowed under the HIPAA Privacy Rule for those individuals involved in the care of an individual.   Contractors should continue to handle routine inquiries , such as telephone requests for the status of claims, under existing customer service procedures that include verification of the individuals identity.  Therefore, with the beneficiarys verbal or written permission, contractors may continue to speak to third parties on behalf of the individual.  See Exhibit D -  Disclosure Desk Reference Guide for Call Centers for detailed instructions on disclosing PHI over the telephone.   Contractors may also continue to handle Congressional inquiries under existing cus tomer service procedures (see 10J above).   K. Administrative Requirements   As Medicares business associate, contractors are not subject to the administrative requirements of the HIPAA Privacy Rule.  However, under the Privacy Act, contractors must comply  with the privacy provisions specified in their contracts. Contractors are not required to designate a privacy official.  However, contractors are required to have in place a senior official or other responsible party to address the privacy concerns of the  organization and to establish an internal control system to monitor compliance with privacy requirements.  Similarly, as Medicares business associate, contractors are not subject to the HIPAA Privacy Rules requirement to train staff specifically on the HIPAA Privacy Rule.  However, under the Privacy Act, contractors are required to ensure that employees under stand their responsibility to protect the privacy and confidentiality of CMSs records.   It is CMS policy that any data collected on behalf of CMS in the administration of a Medicare contract belongs to CMS.  Any disclosure of individually identifiable information without prior consent from the individual to whom the information pertains, or without statutory or contract authorization, requires prior approval by CMS.
(Medicare General Information, Eligibility, and Entitlement)
200 - Removal of Medicare Number from Reimbursement Checks  (Rev. 21, Issued:  04- 29-05; Effective:  10 -01-05; Implementation:  10- 03-05)  Contractors (A/B MACS (A and B), A/B MACs (HHH ) and DME MACs) shall stop printing the Medicare Number on reimbursement checks to Medicare beneficiaries.   Reimbursement checks going to Medicare beneficiaries are subject to others (e.g. banks) seeing the Medicare Number.  CMS has determined that there is no business reason for the Medicare Number to be printed on the reimbursement check to the beneficiary.  Therefore, CMS is directing Medicare contractors to stop printing the Medicare Number on reimbursement checks to Medicare beneficiaries.   This change in policy does not affect the use of the Medicare Number by Medicare contractors.  The Medicare program uses the Medicare Number to meet administrative respo nsibilities to pay for health care and to operate the Medicare program.  In performance of these duties, Medicare is required to protect individual privacy and confidentiality in accordance with applicable laws, including the Privacy Act of 1974 and the Pr ivacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).   Exhibit A - Freedom of Information Act Request   Exhibit B - Summary Sheet for the  CMS Monthly FOIA Report   MAC/CENTRAL OFFICE COMPONENT SUMMARY SHEET FOR THE CMS MONTHLY FOIA REPORTS   Data on this Summary Sheet is a summation of the data from all Forms CMS -632-FOI completed during the month.
(Medicare General Information, Eligibility, and Entitlement)
MAC/CENTRAL OFFICE COMPONENT SUMMARY SHEET FOR THE CMS MONTHLY FOIA REPORTS   Data on this Summary Sheet is a summation of the data from all Forms CMS -632-FOI completed during the month.  INSTRUCTIONS  1. Enter the month and year that this summary sheet covers.  2. Enter, in the applicable space, appropriate identifying information concerning your unit. 3. Enter the total number of 632s completed during the identified month. 4. Enter the number of times the 632s showed a request was closed by the  cited action.  5. Enter the total of all staff hours used during the identified month. Use only whole numbers and fractions or decimals, e.g., 102 1/2 or 102.25, not 102 hours and fifteen minutes.  6. Enter the total of actual cost figures, based on the salaries of the staff involved. 7. Enter the total of copying charges.  8. Enter the mailing/postage costs.  9. Enter the total dollar amount of fees charged. This figure is not the same as actual costs.  10. Enter the total of all fees waived. (Unless the FOI Office, CMS has gran ted a waiver, this figure is a compilation of all fees which were waived because they were lower than CMS' $15.00 threshold).  11. Enter the name, office and address of the person who completed this summary sheet.  12. Enter the date the summary sheet was completed.  PLEASE FILL OUT COMPLETELY  1. Month: ________________ Year: __________  MAC: __________________________________________________   CENTRAL OFFICE COMPONENT: _____________________________________________  Total 632s: _________________  Actions:
(Medicare General Information, Eligibility, and Entitlement)
___________ D irect Reply (Records Sent)  _____________ No Records Found  ___________ Request Withdrawn  _____________ Not FOIA  ___________ Records Not Reasonably Described  _____________ Subpoena Denial  ___________ Fee Related Closure  _____________ Other   Staff Hours: ___________ Staff Charges: ____________ Copy Charges: ____________ Postage: ____________ Fees Charged: ____________ Fees Waived: ____________ Name/Phone: ____________________________________________  Office: _________________________________________________  Address: ________________________________________________ Date: __________  Exhibit C - Invoice of Fees for FOIA Services    Exhibit E - Medicare Authorization to Disclose Personal Health Information form and Information to Help You Fill Out the Medicare Authorization to Disclose Personal Health Information Form  Transmittals Issued for this Chapter   Rev #  Issue date  Subject  Impl date  CR#  R124GI  05/17/2019  Update to Publication (Pub.) 100 -01 to Provide Language -Only Changes for the New Medicare Card Project
(Medicare General Information, Eligibility, and Entitlement)
Rev #  Issue date  Subject  Impl date  CR#  R124GI  05/17/2019  Update to Publication (Pub.) 100 -01 to Provide Language -Only Changes for the New Medicare Card Project   06/18/2019  11240  R123GI  05/10/2019  Updates to Publication (Pub.) 100 -01, Medicare General Information, Eligibility, and Entitlement, Chapter 6, Disclosure of Information  06/11/2019  11218  R21GI  04/29/2005  Removal of Medicare Number from Reimbursement Checks  10/03/2005  3760  R07GI  06/25/2004  HIPAA Privacy Rules  N/A 2484  R01MGI  09/11/2002  Initial Publication of Manual  NA NA  Back to top of Chapter
(General Information, Eligibility, and Entitlement Manual)
General Information, Eligibility, and Entitlement Manual  Chapter 7 - Contract Administrative Requirements   Table of Contents  (Rev. 128, 11- 01-19)
(General Information, Eligibility, and Entitlement Manual)
Transmittals for Chapter 7  10 - Contracting and Subcontracting  Not yet available  20 - Publishing by Contractors and Restrictions on Promotional Activity  Not yet available  30 - Files Maintenance  30.10 -  Files Maintenance Program -  General  30.10.1 -  Description of Records Maintained  30.10.2 -  Definition of a Record  30.20 -  Implementing a Files Management Program 30.30 -  Record Retention and Disposal Schedule  30.30.1 -  Disposition Instructions - Destruction of Records  30.30.1.1 -  Disposition Instructions When Operating Under a Free ze 30.30.1.2 -  Disposition Instructions When Medicare Records are Microfilmed  30.30.1.3 -  Disposition for Paper -Only Medicare Records  30.30.1.4 -  Disposition for Medicare Records that are Imaged/Scanned  30.30.1.5 -  Disposition for Medicare Records When Potential Fraud or Overutilization has been Identified  30.30.2 -  Description of Records  30.40 -  Retention of Claims File Materials  30.40.1 -  Segment File Accumulation Period  30.40.2 -  Standard Retention Periods -  Microfilmed Claims  30.40.3 -  Reten tion Period Microfilmed Material  30.50 -  Microfilming of Files Material  30.50.1 -  Microfilming Procedures  30.50.2 -  Microfilming Index Label  30.50.3 -  Retention and Destruction of Microfilm  30.60 -  Annual Report of Medicare Records  30.70 -  Disposition of Non- Claims Materials  30.80 -  Standards for All Records Storage  Facilities  30.90 -  Exhibits  Exhibit 1 -  Preprinted Container Label  Exhibit 2 -  Minimum Label Data Required for Unlabeled Boxes  Exhibit 3 -  Records Transmittal and Receipt -  Standard Form 135 Exhibit 4 -  Reference Request -  Federal Records Center -  Optional Form 11  Exhibit 5 -  Certificate of Authenticity -  START  Exhibit 6 -  Certificate of Authenticity -  END  Exhibit 7 -  Correction Card  Exhibit 8 -  Start of Retake or Addition Certificate  Exhibit 9 -  Retake or Addition Certificate  Exhibit 10 -  Resolution Test Chart  Exhibit 11 -  Witness Disposal Certification (Sample)  Exhibit 12 -  Roll Report  Exhibit 13 -  Report of Medicare Records  Exhibit 14 -  Inspection Checklist --Standards for Records Storage Facilities  40  Shared System Maintainer, Part A/Part B (A/B)/Durable Medical Equipment (DME) Medicare Administrative Contractor (MAC) and the Single Testing Contractor (STC) Responsibilities for System Releases  40.1 -  Standardized Terminology f or Claims Processing Systems