General Requirements

10010 - General Requirements (Rev. 15, Issued: 06-30-06; Effective/Implementation Dates: 06-30-06) A. QIO Access to Information As specified in 42 CFR 480.111 through 480.113, you have access to medical records and other pertinent material that you need to carry out your statutory responsibilities. As specified in 42 CFR 480.114, your data collection is limited to the information needed to accomplish the purposes of Part B of title XI of the Act. The HIPAA Privacy Rule does not alter your authority to receive information that you require to perform the requirements of your Medicare contract. If medical/quality issues raised in the course of your review cannot be resolved by examining medical record information alone, request the additional information you need to make a determination. At its option, the facility may (but is not required to) provide you with internal documents such as incident reports. If the facility chooses not to submit the necessary information, make your determination with the information available. B. Responsibility to Protect Information As specified in 42 CFR 480.115, implement reasonable security measures to ensure the integrity of your information and prevent unauthorized access. • Confidentiality Plan -- Your written confidentiality plan must: - Address the regulatory requirements specified at 42 CFR 480.115; - Be sufficiently detailed to guide employees in day-to-day operations; - Include the security measures for protecting QIO electronic data and confidential information when it is offsite; and - Require prior approval by CMS for any use of data acquired, collected, or generated by you under your contract with CMS for purposes not included under your contract with CMS. • Training of Personnel -- Instruct your officers and employees and health care institution employees participating in your review activities of their responsibility to maintain the confidentiality of information. Train all personnel involved in transporting confidential information to handle the material properly. Document all training in your security records. Regulations at 42 CFR 480.115(c) state that the QIO must train participants of the “QIO review system” in the proper handling of confidential information. The “review system” is broadly defined and includes subcontractors, practitioners, and data support organizations. • Transportation of Confidential Information -- All confidential information transported offsite must be handled properly. Store confidential information located offsite under lock and key. At a minimum, place material being transported by car in the car's locked trunk and never leave the car unattended during loading and unloading. When using public transportation, carry confidential material in a locked briefcase or suitcase. Properly package confidential information mailed to or from offsite locations. Envelopes and other containers should consist of materials and be in sizes and shapes that facilitate mail handling and discourage breakage. Seal packages properly and use the type of tape that cannot be torn. Double-wrap packages to be mailed and identify on the inner wrapping that the material is confidential, and indicate who is authorized to open the package. At a minimum, send confidential information via first class mail. Use higher mailing levels when circumstances indicate the need for additional security. C. QIO's Notification Requirement Prior to disclosing your information, comply with any applicable notification requirements in 42 CFR 480.104(a) and 480.105. Also, comply with the general notice requirements specified in 42 CFR 480.116 for the notice you must send to patients, practitioners, and institutions under review. Specific exceptions to the notice requirements are found in 42 CFR 480.106. QIOs are not required to provide notice of disclosure to the provider if the disclosure is made: 1. As part of an investigation of fraud or abuse by the Office of the Inspector General (OIG) or General Accounting Office (GAO); 2. As part of an investigation of fraud or abuse by any other Federal or State fraud or abuse agency and the investigative agency specifies in writing that the information is related to a potentially prosecutable criminal offense; 3. As a QIO referral to OIG regarding probable fraud or abuse (generally, OIG becomes involved only after other attempts, such as corrective action plans, have been tried (and failed to correct a problem); or 4. In the event of imminent danger to individuals or public health. In this case the notification can be sent simultaneously with the disclosure. D. Verification and Amendment of QIO Information Citation 42 CFR 480.134 requires you to verify the accuracy of your information and make any necessary corrections. Individuals and facilities can request that you correct and amend pertinent information in your possession. At such request, advise the requesting individual/facility of your decision and any actions taken regarding the request. Make any corrections to your data that are needed, and if the data have already been disclosed, forward the amended information to the recipients if the change may affect decisions about a particular provider, practitioner, or case under review. E. Individual's Access to Information About Himself or Herself Beneficiary -- Disclose information to the beneficiary or his/her representative within 30 days after you receive a written request as specified in 42 CFR 480.132. A beneficiary is entitled to have access to information pertaining to him or her, including psychiatric records and records concerning alcohol/drug abuse. However, if knowledge of the information would be harmful to the beneficiary, disclose the information to his/her representative rather than to the beneficiary. Determine whether direct disclosure would harm the beneficiary, in accordance with 42 CFR 132(a)(2). Consistent with the disclosure authority at 42 CFR 480.132(a) and 480.132(b) (relating to requests that are connected with an initial denial determination), and as required by 42 CFR 478.24(a), upon request provide a beneficiary with an opportunity to examine the material you used as the basis for your initial denial determination. To comply with this requirement, provide the beneficiary with all pertinent material, not just the medical record. Include all practitioner-specific information concerning the services that the beneficiary received. Disclose the practitioner-specific information with or without the consent of the practitioners identified (see 480.133(b)). When a beneficiary's request for his/her medical record is not related to an appeal of your denial determination, as specified at 42 CFR 478.24(a), provide him/her with any applicable records in your possession, as required by 42 CFR 480.132(a). Before disclosing information under this authority, however, redact any material that explicitly or implicitly identifies practitioners or QIO reviewers (unless they have consented to disclosure), other patients, or QIO deliberations. Without prolonging the timeframes to release the records requested, you may encourage the beneficiary to seek the medical record from the appropriate hospital. If the beneficiary declines this advice, you are still bound to provide the records as specified above. • Practitioners and Reviewers -- Disclose information to practitioners and your reviewers as specified at 42 CFR 480.133(a)(1). You may also disclose information on a particular practitioner or reviewer to a third party if the individual identified in the information consents to or requests the disclosure. The disclosed information, however, cannot identify other individuals without their consent. • Health Care Facilities -- Disclose information to health care facilities as specified at 42 CFR 480.133(a)(1). Facility-specific information is non-confidential unless the material is part of your deliberations or contains confidential information as defined at 42 CFR 480.101(b). F. Disclosure To a Beneficiary's Representative Disclose information to the beneficiary's representative instead of directly to the beneficiary when required by 42 CFR 480.132. In seeking beneficiary information, a properly designated beneficiary representative may exercise the same rights and privileges as the beneficiary. If the beneficiary is deceased, disclose the information to the first appropriate individual according to the following order: • To the executor of the estate; • To the administrator of the estate; or • To an individual verified in writing to be the beneficiary's designated representative. The appointment and terms of the representation must be valid under State law, and the above order would be superseded by any State law that conflicts with it. If the beneficiary is mentally, legally, or physically unable to designate a representative, disclose the information to a person whom you determine is responsible for the patient. You must first attempt to make that determination based on the medical record. If the medical record does not provide the necessary information, you may rely upon the attending physician for the information. Disclose the information to the first appropriate individual according to the following order: • The beneficiary's legal guardian; • A relative or other person who receives social security or other governmental benefits on the beneficiary's behalf; • A relative or other person who arranges for the beneficiary's treatment, or exercises other responsibility for his/her affairs; • A representative of an agency or institution that did not furnish the services for which payment is claimed, but furnished other care, services, or assistance to the beneficiary; or • A representative of the provider or of the nonparticipating hospital claiming payment for services it has furnished if the provider or nonparticipating hospital is unable to have the claim signed by one of the above-listed individuals or entities. As specified at 42 CFR 424.37, when a party signs a claim or a request for a payment statement, he/she must also submit a brief statement that: • Describes his/her relationship to the beneficiary; and • Explains the circumstances that make it impractical for the beneficiary to sign the claim, statement, or request.