The Privacy Act of 1974

10 - The Privacy Act of 1974 (Rev. 1, 09-11-02) A. General The purpose of the Privacy Act of 1974 is to provide safeguards for individuals against an invasion of privacy by Federal agencies. Among other things, Federal agencies are required to permit an individual to: • Determine what records pertaining to the individual are collected, used, or disseminated by such agencies; • Prevent records pertaining to the individual obtained by Federal agencies for a specific purpose from being used for another purpose without the individual's consent; and • Gain access to information pertaining to the individual in Federal agency records, and to correct such records when appropriate. Contractors considered to be Federal agencies for purposes of administering the Privacy Act must comply with its provisions. Contractors must: • Inform each individual from whom information is requested of their rights under the Privacy Act; • Describe the method of accessing an individual's records; • Prepare a method of accounting for disclosures; and • Devise a method of reviewing records at the request of individuals and making corrections if appropriate. Additional information concerning Medicare privacy policies can be accessed on the CMS Web site under the Privacy Policy link at the bottom of the web page. B. Definition of "Individual" "Individual" means a living person on whom CMS has any personal (as opposed to business) information. "Individual" does not include so-called persons such as sole proprietorships, partnerships, or corporations. Except for disclosure of and access to medical information about minors, a parent or legal guardian of a minor, or a legal guardian of someone the court has declared incompetent, has the same rights as the individual to the individual's records. No one may act on behalf of an individual who has not been declared incompetent by a court or gain access to his/her records under the Privacy Act without the individual's written consent. C. Physicians' and Suppliers' Rights to Access Under the Privacy Act Providers, physicians, and suppliers as business entities do not have access to business information about themselves under the Privacy Act, since the Privacy Act concerns individuals only. However, a physician or other supplier who is also an individual has the same access rights as any other individual to personal information maintained about themselves. Purely business information which is retrievable by the physician's unique identifier is not subject to the Privacy Act, but it may be disclosed to the physician to the extent that we would not deny the physician the information under the Freedom of Information Act (FOIA). D. Informing Individuals of Rights The contractor must inform the individual of his/her rights under the Privacy Act when it solicits any information directly from the beneficiary in connection with a Medicare claim. This would usually be a result of the failure of the individual or provider to furnish all the information required on a claims form. When information is collected by telephone, the contractor will give the individual a brief oral explanation. When information is requested by mail a written notice is used. E. Method of Accessing Individual Records - General The law requires that an agency must inform an individual, upon request, whether a system of records contains a record pertaining to the individual, permit the individual to review such record and to be accompanied for the purpose of reviewing the record by a person of his or her choice. Further, the individual is permitted to obtain a copy of such record in a comprehensible form at a reasonable cost. There is a charge of 10 cents per page with all fees under $25 waived. There is no charge for searching; nor is there a charge for a copy furnished as a means of permitting an individual access to their records. Each requester shall be asked for proof of identity as well as such general information as is necessary to determine where and how to look for records about the data subject Within 10 working days of receiving a request, the contractor must decide whether to release the records. The requested information must be furnished within 30 working days unless good cause exists. An example of "good cause" would be an inactive record filed in a records center that cannot be obtained within 30 days. The requester should be told of the delay and given an approximate date to expect the information. If an individual's request for information concerning themselves is not in the contractor's files, the contractor should advise the individual that it does not have the information and, if available elsewhere, that it is forwarding the request to the office which has it. The contractor should furnish any requested information available if the request cannot be satisfied in full. The contractor should identify requests under the Privacy Act that require referral to CMS for data in central office systems. As required by the Privacy Act, the contractor should send the request for processing, along with a copy of the interim response, to the systems manager listed in the Annual Publication: Systems of Records. F. Methods of Accessing Individual Medical Records The official responsible for the records, or their designated medical officer, may disclose medical information directly to the individual if the official determines, based on review of the medical evidence, that such disclosure is not likely to have an adverse effect. In such cases the responsible official will give the requested information to the individual and annotate the record to show that the disclosure was made. If the responsible official determines that direct disclosure of the medical record would be likely to have an adverse effect on the individual or does not consider themselves qualified to make such a determination, the official will disclose the medical information to the representative designated in writing by the individual. The representative must be a medical professional (licensed medical practitioner or nurse) who would be willing to review the record and discuss it with the individual. The contractor will retain a record showing the reason for its determination and a copy of the correspondence transmitting the information to the individual or to his/her medical representative. If there is sensitive medical information in the records and the individual refuses to name a medical professional or cannot afford the fee for the service, or if the designated medical professional refuses to serve, the contractor will refer the file to the CMS regional office. G. Disclosure of Medical Information Relating to Minors In order to protect the privacy of a minor, a parent or authorized guardian who requests access to the minor's medical record may not be given direct access to the record. Contractors shall ask a parent or guardian who requests access to such a record to designate a physician or other professional (other than a family member) to whom the record may be sent. The physician or health professional to whom the record is sent will be asked by the contractor to consider the effect that the disclosure of the record to the parent or guardian would have on the minor in determining whether the record should be made available to the parent or guardian. The contractor will prepare a response to the parent or guardian in substantially the following form: We have completed processing your request for access to the medical records of (name)__________________________, a minor The medical records have been sent to (name and address of designated health professional) in accordance with your instructions In each case where a minor's medical records are sent to a physician or health professional, reasonable efforts will be made by the contractor to so inform the minor. In the event the parent or guardian refuses to name a medical professional or cannot afford the fee for the service or the designated medical professional refuses to serve, the contractor will refer the file to the CMS regional office for appropriate action. H. Disclosure to Third Parties The Privacy Act permits disclosure to any third party with the written consent of the individual to whom the record pertains. It also permits disclosure in certain instances without the individual's consent. However, the contractor must not disclose information unless the disclosure is specifically authorized in this chapter, or the individual has consented to the disclosure in writing, or the CMS regional office authorizes the disclosure. I. Disclosures with Consent Except for those disclosures discussed below in §10L of this chapter, Disclosure Without Consent, information may not be disclosed without the written consent of the subject individual, or their legal guardian, or, in the case of a minor, their parent (a parent or legal guardian of a minor may not consent to the disclosure of medical information about the minor). Other persons, regardless of relationship (except members of Congress and representative payees), may not receive information about the individual without their consent. In addition, a person who receives information about an individual with the individual's consent may not authorize disclosure of that information to someone else. Awkward situations may develop from a refusal, in compliance with the Privacy Act, to divulge information to the child or spouse of an aged or infirm individual. In order to avoid lengthy and unproductive correspondence, the requester should be advised that the Privacy Act precludes our disclosing any information to anyone other than the individual to whom the information pertains without the specific written consent of that individual, but that the requested information will be sent directly to the individual concerned with an explanation of the inquiry received on their behalf. J. Disclosures to Members of Congress Information requested by members of Congress and their staffs may be disclosed as follows: • Where a member of Congress (or a staff member) inquires on behalf of a constituent, the contractor may respond to the member of Congress (MC) without the written consent of the individual, but must make a record of the disclosure. • Where the MC's inquiry is on behalf of a relative of the subject individual (but the inquirer is not the legal guardian of the individual, or the parent of the individual minor), the contractor should advise the MC that it can respond directly only to the individual unless the individual furnishes written consent to release the information about themselves to the MC (if we respond directly to the individual or with their consent, no accounting record is required). Where the inquirer is the legal guardian, or the parent of a minor, the contractor may disclose the information to the MC, but must make a record of the disclosure. • Where the MC's inquiry is in writing and does not indicate whether the request is from the subject individual, the contractor will contact the MC, usually by telephone, to clarify the situation. A copy of the reply (or a report of telephone call if the response is by telephone) will provide an adequate accounting record. The record should show the date of disclosure, the information disclosed, and to whom the disclosure was made. The contractor should file this record by name or social security claim number so that retrieval may be made expeditiously. K. Disclosure to Representative Payees An SSA-appointed representative payee is entitled to receive information on, or act on, behalf of a beneficiary to the extent necessary to protect the beneficiary's rights under title II or XVIII. L. Disclosure without Consent Below are listed the situations in which data on identifiable individuals may be released without the individual's consent. The disclosure is permitted if the disclosure would be: • To DHHS employees and officers who need the records to perform their duties; • Required by the FOIA; • To the Bureau of Census; • For research purposes under certain circumstances; • To the National Archives; • For law enforcement activities if the activity is authorized by law and the request is from the head of the agency and specifies the particular record desired and the law enforcement activity for which the record is sought; • For compelling circumstances affecting the health and safety of any person if notice of the disclosure is sent to the last known address of the individual; • To either House of Congress or to any congressional committee or subcommittee (see section I above for requests from members of Congress on behalf of constituents); • To the Comptroller General or an authorized representative to perform the duties of the General Accounting Office; • Pursuant to the order of a court of competent jurisdiction; • For a "routine use" - A "routine use" is a disclosure of information which may be made without the individual's written consent because the disclosure is compatible with the purpose for which the information was collected in the first place. An explanation of the purposes and uses of each "routine use" disclosure must be published in the Federal Register at least 30 days prior to the disclosure and at least annually thereafter. Current routine uses are: • Part B Payment Records • Payment Record Reference File • Tape containing amount, type, and cost of health care services. • Summary Records • Group Health Plan Membership Data • Identification Data • Group Health Membership Data • Group Health Membership List • Quality Assurance Program Releases and Corrections M. Accounting for Disclosure The Privacy Act requires that agencies account for disclosures of personal data to organizations outside DHHS or made in response to requests under the FOIA. The purposes of the accounting are: • To allow individuals to learn to whom records about themselves have been disclosed; and • To provide a basis for subsequently advising recipients of any amended or disputed records. The accounting must enable the contractor to tell the individual when and what information about the individual was released and to whom. It is not necessary to maintain a separate record of disclosures if such information can be retrieved from the contractor's operating records. An individual has the same access rights to an accounting of disclosures as to other information, with no exception. It is not mandatory to tell an individual about disclosures made to an agency for law enforcement purposes. (Refer requests for accountings that include disclosures to law enforcement agencies to the CMS regional office.) The contractor must maintain accounting records for 5 years, or the life of the basic record, whichever is longer. The lives of various basic records are furnished in Chapter 1 of the Claims Processing Manual. N. Reviewing and Correcting Records Individuals are permitted by the Privacy Act to request correction of any record pertaining to themselves. The contractor should have a method of reviewing records at the request of the individual and making corrections where appropriate. In reviewing an individual's request to amend a record, the contractor should, whenever practicable, complete the review and advise the individual of the results within 10 days of the receipt of the request. Prompt action should be taken wherever possible to reduce the administrative costs involved in issuing both a separate acknowledgment of the receipt of the request and a subsequent notice informing the individual of the action taken. If a contractor denies a request for correction, the individual can appeal to the system manager for the contractor's system of records. O. Penalties All employees must be aware of their responsibilities under the Privacy Act and guard against improper disclosure of personal information. Any officer or employee who willfully discloses individually identifiable information, the disclosure of which is prohibited by the Act, shall be guilty of a misdemeanor and fined not more than $5,000. P. Providers, Physicians, Suppliers, and the Privacy Act: 1. Confidentiality of Provider and Supplier Records Medicare information may not be accepted from providers, physicians, and other suppliers of services on a confidential basis, expressed or implied, since any medical information obtained by a contractor is subject to disclosure to the individual to whom it pertains. Contractors are to make sure their providers and other suppliers of services are aware that no medical information marked "confidential" will be accepted on that basis and that any medical information received by the contractor may be disclosed to the patient or his/her representative upon request, either directly or through designated professional medical personnel. If a provider, physician, or other supplier of services documents medical findings on medical forms preprinted "confidential" or the provider or other supplier of services routinely stamps all records "confidential," such records, when transmitted to the contractor are to be accompanied by a signed statement to the effect that the provider, physician or supplier understands that the information is subject to disclosure at the request of the patient or his/her representative under the Privacy Act. 2. Release of Eligibility Data to Providers and Suppliers When the Individual is Unable to Sign an Authorization In situations such as the admission to a hospital of an unconscious person, where the individual has not signed a statement authorizing the provider to pursue a Medicare claim, the disclosure of Medicare information to the provider should be treated as a routine use disclosure. If the individual has authorized the provider or supplier to pursue a Medicare claim, the release of information may be treated as a disclosure made with the beneficiary's consent.