Confidentiality

10.5.4 – Confidentiality (Rev. 121, Issued: 04-22-16, Effective: 04-22-16, Implementation: 04-22-16) MAOs must establish procedures to ensure the confidentiality and accuracy of all enrollee records, including medical records, as well as other health and enrollment information the MAO maintains. MAOs must ensure that they: • Abide by all Federal and state laws regarding confidentiality and disclosure of medical records or other health and enrollment information, including the HIPAA privacy rule at 45 CFR part 164 that require MAOs to report the loss of protected health information without delay and, in cases affecting 500 or more individuals, no later than 60 days after discovery. • The MAO must safeguard the privacy of any information that identifies a particular enrollee and have procedures that specify: o For what purpose(s) the information will be used within the organization; and o To whom and for what purpose(s) it will disclose the information outside the organization; • Ensure that medical information is released only in accordance with applicable Federal or state law or pursuant to court orders or subpoenas; • Maintain the records and information in an accurate and timely manner; and • Ensure timely access by enrollees to the records and information that pertain to them. For purposes of CMS audits of risk adjustment data, MAO network providers and deemed contracted providers (of PFFS plans) must be required, under their contracts or the plan’s Terms and Conditions of Payment, to provide medical records requested by the MAO. Medical records from providers also may be used by MAOs for the following purposes: • Advance determinations of coverage; • Plan coverage; • Medical necessity; • Proper billing; • Quality reporting; • Fraud and abuse investigations; and • Plan initiated internal risk adjustment validation. To encourage providers to submit enrollee medical records to the plan, an MAO may choose to send staff to assist in the record collection or to reimburse providers for the costs associated with furnishing the records. MAOs are prohibited from using medical record reviews to delay payments to providers. Both required and voluntary provision of medical records by providers must be consistent with HIPAA privacy statute and regulations (http://www.hhs.gov/ocr/privacy/).