Disclosure to Third Parties for Other Than program Purposes

170.4 - Disclosure to Third Parties for Other Than program Purposes (Rev. 124, Issued: 05-17-19, Effective: 06-18-19, Implementation: 06-18-19 The term Medicare beneficiary identifier (Mbi) is a general term describing a beneficiary's Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes. Information obtained from CMS or its contractor is confidential and may be disclosed only under conditions prescribed in rules and regulations or on the express authorization of the Administrator of CMS. However, certain limited information about a beneficiary's Medicare eligibility status and related claims information may be released to third party payers with the beneficiary's express authorization. The following information may be released subject to necessary authorization: • Medicare beneficiary identifier; • Coinsurance and deductible status; • Dates of entitlement to Medicare; • Copies of Medicare claims forms; • Medicare report of eligibility; and • Explanation of Medicare Benefits (EOMB) or Medicare Summary Notice (MSN). Providers should refer requests for other information to the contractor. Contractors refer requests to the CMS regional office. The provider or supplier will adhere to the following authorization guidelines to ensure that information is not released without the required authorization. Authorization must: • Be in writing; • Be signed and dated by the individual or someone authorized to act on the individual's behalf; • Specify the name of the provider authorized to disclose information; • Specify what information the individual is authorizing the provider to disclose; • Specify the names of the third party payers to whom the information is being released; • Specify the purpose for which the information is being released; • Specify an expiration date for the authorization that should not exceed 2 years from the date it was signed; and • Specify that it may be revoked at any time.