Statutory and Regulatory Requirements

10000 - Statutory and Regulatory Requirements (Rev. 15, Issued: 06-30-06; Effective/Implementation Dates: 06-30-06) A. Part B of Title XI of the Social Security Act (the Act) This part contains several provisions that affect the confidentiality of your information. • Sections 1154, 1156, and 1160 of the Act provide the statutory bases for the acquisition, protection, and disclosure of your information. • Section 1160 of the Act also establishes the scope of your authority to disclose information for program purposes, including any required mandatory disclosures. It also addresses your responsibility to protect your information from unauthorized disclosure and provides penalties for unauthorized disclosure. Section 1160(a) specifies that you are not governed by the disclosure provisions contained in the Freedom of Information Act. B. Regulations at 42 CFR Part 480 These regulations implement the above referenced provisions of the Act and describe your authority to disclose information and your responsibility to protect it from unauthorized disclosure. C. Sections 1171 - 1179 of Part C of Title XI of the Act (Added by §§262 and 264 of the Health Insurance Portability and Accountability Act (HIPAA) (Public Law 104-191)) These sections require the Secretary to adopt standards to facilitate a national electronic health data system, including standards for certain administrative transactions, code sets, and health identifiers, and standards necessary to protect the privacy and security of health data. These standards apply to all health plans, including Medicare and the State Medicaid plans, as well as all health care providers that conduct electronic transactions that meet the standards adopted by the Secretary. D. Regulations at 45 CFR Parts 160, 162, and 164 These regulations (the Privacy Rule) implement the requirements of §§1171-1179 of the Act and §264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). For purposes of the Privacy Rule, the Centers for Medicare & Medicaid Services (CMS) have made the following statements regarding submission of protected health information to Quality Improvement Organizations (QIOs): • Medicare Quality Improvement Organizations (QIOs) perform certain review and other functions for the Centers for Medicare & Medicaid Services (CMS) under contracts with CMS. These functions are required under Part B of Title XI of the Social Security Act. Part B of Title XI also requires that Medicare providers and suppliers (which are, in general, covered entities under HIPAA) disclose information on Medicare beneficiaries to QIOs so that QIOs can perform the requirements under their Medicare contracts. If a Medicare provider or supplier is a covered entity, it is subject to the Privacy Rule which implements provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and generally cannot disclose protected health information on Medicare beneficiaries or other patients without the permission of the patients, unless the Privacy Rule otherwise allows disclosure. If a disclosure is required by law, however, the Privacy Rule allows the disclosure without the patient’s permission under 45 CFR 164.512(a). Therefore, when a covered entity discloses to a QIO information on Medicare beneficiaries that the QIO needs in order to perform under its contract with CMS, patient permission is not required. • You must enter into a business associate agreement, as defined by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, for any activities assigned to you whereby you are using or receiving protected health information on behalf of CMS for CMS’ covered functions, such as “payment” or “health care operations” activities. No business associate agreement is required for uses or disclosures of protected health information by a QIO that are for CMS’ “health oversight activities.” When you are performing any quality improvement or Medicare review activities related to payment, you must abide by the HIPAA Privacy Rule. For any activities related to payment, there must be a Business Associates Agreement between CMS and you. Your contract with the Secretary serves as the Business Associate Agreement. The HIPAA Privacy Rule defines a health oversight agency to include a Federal or other governmental agency or authority that is authorized by law to oversee the health care system (whether public or private), or government programs in which health information is necessary to determine eligibility or compliance with program standards (45 CFR 164.501). Oversight agencies also include a person or entity acting under a contract with the public agency. Under 42 CFR 164.512(d), a covered entity may disclose protected health information to a health oversight agency without the patient’s permission for oversight activities authorized by law, including oversight of compliance with program standards. • Part B of Title XI requires Medicare QIOs, as CMS’ contractors, to conduct activities necessary for appropriate oversight of the health care system. Specifically, Medicare QIOs are health oversight agencies to the extent that they are acting under contract with Medicare to oversee the health care system in general or in compliance with quality standards under Medicare. This includes collecting and reviewing quality performance measures from hospitals regarding Medicare and non-Medicare patients, such as reports on surgical infection prevention, acute myocardial infarction, and influenza and pneumococcal immunization. When a QIO is acting as a health oversight agency, a covered entity may make disclosures to the QIO for health care oversight purposes without patient permission. E. Section 1157 of the Act This section provides certain protections to those who disclose information to you. No person providing information to QIOs will be held, by reason of having provided such information, to have violated any criminal law or to be civilly liable under any State or Federal law, unless the information provided is unrelated to the performance of the contract of the QIO, or if the information is false and the person or entity providing the information knew, or had reason to believe, that the information was false. The statutes and regulations cited above apply only to information collected, acquired, or generated by you as a result of your Medicare review activities. These provisions do not apply to non-Medicare information generated by your activities under another contract (e.g., Medicaid review, another contract with CMS, a contract with another Federal agency).