Prohibition Against Disclosure

40.1 - Prohibition Against Disclosure (Rev. 1, 09-11-02) Section 1106 of the Social Security Act prohibits disclosure of any file, record, report, or other paper, or any information obtained at any time by the Secretary or an officer or employee of DHHS in the course of discharging their duties under the Act, except as prescribed by regulations. Where manual instructions permit disclosure, assume that related regulations have been published. The same prohibition applies to information received by any person outside DHHS, from the Secretary, or an officer or employee of DHHS. The prohibition applies to any agency, organization (e.g., contractors), or institution, or any of its officers or employees, in the fulfillment of a contract or agreement with the Secretary. A. Disclosure of Provider or Physician Records The prohibition also relates to any information received from DHHS, a contractor, or any person or entity that furnishes services under arrangements with a provider or accepts an assignment under the program. However, patient records in the possession of a provider or physician are not subject to the prohibition against disclosure or to the Departmental rules and regulations concerning confidentiality merely because the patient is entitled to Medicare benefits. Disclosure of provider or physician records not in the possession of CMS or a contractor may, however, be subject to applicable State or local laws, or to hospital rules governing disclosure. B. Authority for Refusal to Disclose Information Denial of all or portions of requested records can only be made by the CMS Freedom of Information Officer. Therefore, when a request for information is received, disclosure of which is prohibited under these guidelines, the contractor will follow §10.2 above. The CMS FOIA Officer has authorized Medicare contractors to issue a denial on his/her behalf in the following situation: If any officer, employee, agent or subcontractor is served a subpoena or other compulsory process requiring the production of records or information on a beneficiary or individual practitioner that are contained in a Privacy Act System of records and such a request is not accompanied by a valid authorization to release the records signed by the subject of the records, he/she will decline to produce the records or information. He/she will base the refusal on §1106 of the Social Security Act and on 5 USC §552a, 5 USC §552, 45 CFR Part 2 and 45 CFR Part 5. The contractor will notify the RO immediately. If the contractor directly receives such a subpoena, it uses the following language to respond: Dear Sir or Madam: This is in response to the subpoena duces tecum, dated ______, initiated by your firm, for certain Medicare records in our possession. The Department of Health and Human Services regulation at 45 CFR Part 2 states, among other things, that the Department will treat subpoenas duces tecum for records in its possession as requests under the Freedom of Information Act (5 U.S.C. §552). Because the records the subpoena seeks are in a Privacy Act system of records, the Privacy Act (5 U.S.C. §552a) precludes release of those records except pursuant to a written authorization to release signed by the subject(s) of the records or unless the Freedom of Information Act requires release of the records or a court of competent jurisdiction orders release. Regarding the latter condition of disclosure, for purposes of the Privacy Act, a court of competent jurisdiction is a Federal court only. Review of this matter indicates that your firm has not presented a written authorization to release records signed by the subject(s) of the records. Moreover, your firm's subpoena is not an order of a court of competent jurisdiction, and 45 CFR Part 2 requires us to treat the subpoena duces tecum as a Freedom of Information Act request. Further the Freedom of Information Officer for the Centers for Medicare & Medicaid Services has determined that the requested records are exempt from mandatory disclosure under the Freedom of Information Act by exemption (b)(6) of that Act. Exemption (b)(6) permits the withholding of information about individuals in personnel and medical files and similar files, when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy. Based upon the foregoing, we respectfully decline to produce the Medicare records requested by your firm's subpoena duces tecum. If you have reason to disagree with this decision, you may appeal. Your appeal should be mailed, within 30 days of the date of this letter, to the Deputy Administrator, Centers for Medicare & Medicaid Services, Room C5-16-03, 7500 Security Boulevard, Baltimore, MD 21244-1850. Please mark your envelope "Freedom of Information Act Appeal," and enclose a copy of this letter. Sincerely yours, Signature of Authorized Official cc: FOI Officer, CMS Process the State or local court subpoena duces tecum that seeks other kinds of CMS records in accord with §10.2 above. C. Penalty for Failure to Comply With the Rules Relating to Disclosure of Information Obtained in the Administration of the Act Section 1106(a) of the Act provides that any person who violates the disclosure provisions shall be deemed guilty of a misdemeanor and, upon conviction thereof, shall be punished by a fine not exceeding $1,000, by imprisonment not exceeding 1 year, or both.