Requests for Information From Outside Organizations

4.8 - Requests for Information From Outside Organizations (Rev. 12333; Issued: 10-26-23; Effective: 11-28- 23; Implementation: 11-28-23) This section applies to UPICs. Federal, state, and local LE agencies may seek beneficiary and provider/supplier information to further their investigations or prosecutions of individuals or businesses alleged to have committed health care fraud and other crimes for which medical records may be sought as evidence. When these agencies request that a UPIC disclose beneficiary records or provider/supplier information, the responsive disclosure shall comply with applicable federal law as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Business Associate provision of the UPIC’s contract. Federal law will dictate whether, and how much, requested information can be disclosed. The determination regarding disclosure will be contingent on the purpose for which it is sought and whether information is sought about beneficiaries or providers/suppliers. For example, certain general information that does not include specific beneficiary identifiers may be shared with a broader community, including private insurers. The information may include that of a general nature of how fraudulent practices were detected, the actions being taken, and aggregated data showing trends and/or patterns. The UPIC may release information, in accordance with the requirements specified in Sections A – G below, to the following organizations: • Other UPICs; • Qualified Independent Contractors (QICs); • QIOs; • State Attorneys General and State Agencies; • MFCUs; • OIG; • DOJ; and • FBI. Requests for information from entities not listed above shall be submitted to the COR for approval, with a copy to the BFL. In deciding to share information voluntarily or in response to outside requests, the UPIC shall carefully review each request to ensure that disclosure would not violate the requirements of the Privacy Act of 1974 (5 U.S.C. §552a) and/or the Privacy Rule (45 CFR, Parts 160 and 164) implemented under the HIPAA. Both the Privacy Act and the Privacy Rule seek to strike a balance that allows the flow of health information needed to provide and promote high-quality health care while protecting the privacy of people who seek this care. In addition, both statutes provide individuals with the right to know with whom their personal information has been shared, necessitating the tracking of any disclosures of information by the UPIC. The UPIC shall direct questions concerning what information may be disclosed under the Privacy Act or Privacy Rule to the CMS Regional Office Freedom of Information Act /privacy coordinator. Ultimately, the authority to release information from a Privacy Act System of Records to a third-party rests with the system manager/business owner of the system of records. The HIPAA Privacy Rule establishes national standards for the use and disclosure of individuals’ health information (also called protected health information [PHI]) by organizations subject to the Privacy Rule (which are called “covered entities”). As “business associates” of CMS, UPICs are contractually required to comply with the HIPAA Privacy Rule. The Privacy Rule restricts the disclosure of any information, in any form, that can identify the recipient of medical services; unless that disclosure is expressly permitted under the Privacy Rule. Two of the circumstances in which the Privacy Rule allows disclosure are for “health oversight activities” (45 CFR §164.512(d)) and for “law enforcement purposes” (45 CFR §164.512 (f)), provided the disclosure meets all the relevant prerequisite procedural requirements in those subsections. Generally, PHI may be disclosed to a health oversight agency (as defined in 45 CFR §164.501) for purposes of health oversight activities authorized by law, including administrative, civil, and criminal investigations necessary for appropriate oversight of the health care system (45 CFR §164.512(d)). The DOJ, through its U.S. Attorneys’ Offices and its headquarters-level litigating divisions; the FBI; the HHS OIG; and other federal, state, or local enforcement agencies, are acting in the capacity of health oversight agencies when they investigate fraud against Medicare, Medicaid, or other health care insurers or programs. The Privacy Rule also permits disclosures for other LE purposes that are not health oversight activities but involve other specified LE activities for which disclosures are permitted under HIPAA, which include a response to grand jury or administrative subpoenas and court orders, and for assistance in locating and identifying material witnesses, suspects, or fugitives. The complete list of circumstances that permit disclosures to a LE agency is detailed in 45 CFR §164.512(f). Furthermore, the Privacy Rule permits covered entities and business associates acting on their behalf to rely on the representation of public officials seeking disclosures of PHI for health oversight or LE purposes, provided that the identities of the public officials requesting the disclosure have been verified by the methods specified in the Privacy Rule (45 CFR §164.514(h)). The Privacy Act of 1974 protects information about an individual that is collected and maintained by a federal agency in a system of records. A “record” is any item, collection, or grouping of information about an individual that is maintained by an agency. This includes, but is not limited to, information about educational background, financial transactions, medical history, criminal history, or employment history that contains a name or an identifying number, symbol, or other identifying particulars assigned to the individual. The identifying particulars can be a finger or voiceprint or a photograph. A “system of records” is any group of records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identification assigned to the individual. For example, Medicare beneficiary data used by UPICs are maintained in a CMS “system of records” covered by the Privacy Act. Information from some systems of records may be released only if the disclosure would be consistent with “routine uses” that CMS has issued and published. Routine uses specify who may be given the information and the basis or reason for access that must exist. Routine uses vary by the specified systems of record, and a decision concerning the applicability of a routine use lies solely in the purview of the system’s manager for each system of record. In instances where information is released as a routine use, the Privacy Act and Privacy Rule remain applicable. For example, the HHS has published a routine use that permits the disclosure of personal information concerning individuals to the DOJ, as needed for the evaluation of potential violations of civil or criminal law and for detecting, discovering, investigating, litigating, addressing, or prosecuting a violation or potential violation of law, in health benefits programs administered by CMS. Refer to 63 Fed. Reg. 38414 (July 16, 1998). The 1994 Agreement and the 2003 form letter (refer to PIM Exhibits 35 and 25 respectively) are consistent with the Privacy Act. Therefore, requests that appear on the 2003 form letter do not violate the Privacy Act. The Privacy Act of 1974 requires federal agencies that collect information on individuals that will be retrieved by the name or another unique characteristic of the individual to maintain this information in a system of records. The Privacy Act permits disclosure of a record without the prior written consent of an individual if at least one (1) of 12 disclosure provisions apply. Two of these provisions, the “routine use” provision and/or another “law enforcement” provision, may apply to requests from the DOJ and/or the FBI. Disclosure is permitted under the Privacy Act if a routine use exists in a system of records. Both the Fiscal Intermediary Shared System (FISS) #8 and #10, the Multi-Carrier System (MCS), and the VIPS Medicare System (VMS) contain a routine use that permits disclosure to: “The Department of Justice for investigating and prosecuting violations of the Social Security Act to which criminal penalties attach, or other criminal statutes as they pertain to Social Security Act programs, for representing the Secretary, and for investigating issues of fraud by agency officers or employees, or violation of civil rights.” The CMS Utilization Review Investigatory File, System No. 09-70-0527, contains a routine use that permits disclosure to “The Department of Justice for consideration of criminal prosecution or civil action.” The latter routine use is more limited than the former, in that it is only for “consideration of criminal or civil action.” It is important to evaluate each request based on its applicability to the specifications of the routine use. In most cases, such routine uses will permit disclosure from these systems of records; however, each request should be evaluated on an individual basis. Disclosure from other CMS systems of records is not permitted (i.e., use of such records compatible with the purpose for which the record was collected) unless a routine use exists or one (1) of the 11 other exceptions to the Privacy Act applies. The LE provision may apply to requests from the DOJ and/or the FBI. This provision permits disclosures “to another agency or to an instrumentality of any jurisdiction within or under the control of the U.S. for a civil or criminal LE activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency that maintains the record specifying the particular portion desired and the LE activity for which the record is sought.” The LE provision may permit disclosure from any system of records if all of the criteria established in the provision are satisfied. Again, requests should be evaluated on an individual basis. To be in full compliance with the Privacy Act, all requests must be in writing and must satisfy the requirements of the disclosure provision. However, subsequent requests for the same provider/supplier that are within the scope of the initial request do not have to be in writing. The UPICs shall refer requests that raise Privacy Act concerns and/or issues to the CORs for further consideration. A. Requests from Private, Non-LE Agencies Generally, UPICs may furnish information on a scheme (e.g., where it is operating or specialties involved). Neither the name of a beneficiary or suspect can be disclosed. If it is not possible to determine whether or not information may be released to an outside entity, the UPIC shall contact its COR and BFL for further guidance. B. Requests from Other UPICs The UPICs may furnish requested specific information concerning ongoing fraud investigations and individually identifiable PHI to any UPIC, SMRC or MAC. The UPICs, SMRCs and MACs are “business associates” of CMS under the Privacy Rule and thus are permitted to exchange information necessary to conduct health care operations. If the request concerns investigations already referred to the OIG/OI, the UPIC shall notify the OIG/OI of the RFI received from another UPIC and notify the requesting UPIC that the case has been referred to the OIG/OI. C. RFI from QICs When a QIC receives a request for reconsideration on a claim arising from a UPIC review determination, it shall coordinate with the MAC to obtain all records and supporting documentation that the UPIC provided to the MAC in support of the MAC’s first level appeals activities (redeterminations). As necessary, the QIC may also contact the UPIC to discuss materials obtained from the MAC and/or obtain additional information to support the QIC’s reconsideration activities. The QIC shall send any requests to the UPIC for additional information via electronic mail, facsimile, and/or telephone. These requests should be minimal. The QIC shall include in its request a name, phone number, and address to which the requested information shall be sent and/or follow-up questions shall be directed. The UPIC shall document the date of the QIC’s request and send the requested information within seven (7) calendar days of the date of the QIC’s request. The date of the QIC’s request is defined as the date the phone call was made (if a message was left, it is defined as the date the message was left), the date the facsimile was received, or the date of the e-mail request. Note: Individually identifiable beneficiary information shall not be included in an e- mail. If a QIC identifies a situation of potential fraud, waste, and abuse, it shall immediately refer all related information to the appropriate UPIC for further investigation. Refer to PIM Exhibit 38 for QIC task orders and jurisdictions. D. Requests from QIOs and State Survey and Certification Agencies The UPIC may furnish requested specific information concerning ongoing fraud investigations containing personally identifiable information to the QIOs and state survey and certification agencies. The functions QIOs perform for CMS are required by law; thus the Privacy Rule permits disclosures to them. State survey and certification agencies are required by law to perform inspections, licensures, and other activities necessary for appropriate oversight of entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; thus the Privacy Rule permits disclosures to them. If the request concerns cases already referred to the OIG/OI, UPICs shall refer the requestor to the OIG/OI. E. Requests from State Attorneys General and State Agencies The UPIC may furnish requested specific information on ongoing fraud investigations to state Attorneys General and to state agencies. Releases of information to these entities in connection with their responsibility to investigate, prosecute, enforce, or implement a state statute, rule, or regulation may be made as a routine use under the Privacy Act of 1974, as amended; 5 USC §552a(b)(3) and 45 CFR Part 5b Appendix B (5). If individually identifiable PHI is requested, the disclosure shall comply with the Privacy Rule. (Refer to subsection H below and PIM Exhibit 25 for guidance on how requests should be structured to comply with the Privacy Rule.) The UPIC may, at its discretion, share PIM Exhibit 25 with the requestor as a template to assist them in preparing their request. If the request concerns cases already referred to the OIG/OI, the UPIC shall refer the requestor to the OIG/OI. F. Requests from MFCUs Under current Privacy Act requirements applicable to PI investigations, the UPIC may respond to requests from MFCUs for information on current investigations. Releases of information to MFCUs in connection with their responsibility to investigate, prosecute, enforce, or implement a state statute, rule or regulation may be made as a routine use under the Privacy Act of 1974, as amended; 5 USC §552a(b)(3) and 45 CFR Part 5b Appendix B (5). Refer to Subsection H below for further information regarding the Privacy Act requirements. If individually identifiable PHI is requested, the disclosure shall comply with the Privacy Rule. Refer to subsection H below and PIM Exhibit 25 for guidance on how requests should be structured to comply with the Privacy Rule. The UPIC may, at its discretion, share PIM Exhibit 25 with the requestors as a template to assist them in preparing their request. If the request concerns cases already referred to the OIG/OI, the UPIC shall refer the requestor to the OIG/OI. G. Requests from the OIG/OI for Data and Other Records The UPIC shall provide the OIG/OI with requested information and shall maintain cost information related to fulfilling these requests. An RFI shall consist of requests to run data for the OIG (including OnePI national data for suppliers and entities whose billed claims span across multiple jurisdictions), extract of records, or a request to furnish any documentation or reports (see below for requests for assistance). Such requested information may include LE requests for voluntary refund data (see section 4.2.2.8.1.3of this chapter). The UPIC shall not fulfill a request if there is a substantial impact (i.e., 40 hours or more) on the budget without prior COR approval. The UPIC shall copy the BFL on these requests for approval from the COR. These requests generally fall into one of the following categories: Priority I – This type of request is a top priority request requiring a quick turnaround. The information is essential to the prosecution of a provider/supplier. The request shall be completed with the utmost urgency. Priority I requests shall be fulfilled within thirty (30) calendar days when the information or material is contained in the UPIC’s files unless an exception exists as described below. The UPIC shall provide the relevant data, reports, and findings to the requesting agency in the format(s) requested within 30 calendar days or sooner, when possible. The MAC shall furnish requested information to the UPIC within 20 calendar days of receipt of the request from the UPIC unless there are extenuating circumstances. The MAC shall communicate any extenuating circumstances to the UPIC and the MAC COR as soon as they become known. The UPIC shall communicate these extenuating circumstances to its COR. Periodically, there are instances in which the OIG/OI is in need of the requested information in a shorter timeframe than (30) calendar days. To account for these instances, the UPIC and MAC may add language to their Joint Operating Agreement (JOA) that allows for a shorter timeframe for the MAC to furnish the requested information (i.e. 48 hours, 72, hours, etc.). In these instances, the OIG/OI must provide justification as to why the requested information is needed in a shorter timeframe than the standard Priority I request. Otherwise, the UPIC shall follow-up with other contractors, and document all communication with contractors to ensure the request is not delayed unnecessarily. If extenuating circumstances exist that prevent the UPIC from meeting the thirty (30) day timeframe, the UPIC shall inform the requestor what, if any, portion of the request can be provided within thirty (30) days. The UPIC shall notify the requesting office as soon as possible (but not later than thirty (30) days) after receiving the request. The UPIC shall also document all communication with the requesting office regarding the delay, and shall include an estimate of when all requested information will be supplied. Priority II – This type of request is less critical than a Priority I request. An RFI shall consist of requests to run data for the OIG, extract of records, or a request to furnish any documentation or reports (see below for requests for assistance). Based on the review of its available resources, the UPIC shall inform the requestor what, if any, portion of the request can be provided. The UPIC shall provide the relevant data, reports, and findings to the requesting agency in the format(s) requested. The UPICs shall respond to such requests within 45 calendar days or sooner, when possible. The MAC shall furnish requested information to the UPIC within 30 calendar days of receipt of the request from the UPIC unless there are extenuating circumstances. The MAC shall communicate any extenuating circumstances to the UPIC and the MAC COR as soon as they become known. The UPIC shall communicate these extenuating circumstances to its COR. The UPIC shall follow-up with other contractors, and document all communication with contractors to ensure the request is not delayed unnecessarily. If extenuating circumstances exist that prevent the UPIC from meeting the 45-day timeframe, the UPIC shall inform the requestor what, if any, portion of the request can be provided within 45 calendar days. The UPIC shall notify the requesting office as soon as possible (but not later than 45 calendar days) after receiving the request. The UPIC shall also document all communication with the requesting office regarding the delay, and shall include an estimate of when all requested information will be supplied. Request for Assistance (RFA) – An LE RFA is a type of RFI and shall consist of any LE requests that do not include running data and reports but include requests such as the review and interpretation of medical records/medical documentation, interpretation of policies, and reviewing cost reports. The timeframes for RFIs specified in Priority I and II do not apply to RFAs. Due dates shall be negotiated with the requesting entity and documented appropriately along with the reasons for not meeting the agreed upon timeframes. The UPIC shall contact the COR if an agreement cannot be reached on the timeframe for completion. Disclosures of information to the OIG shall comply with the Privacy Rule and Privacy Act. When the OIG makes a data request, the UPIC shall track these requests and document the following: (1) nature/purpose of the disclosure (cite a specific investigation and have a general description); (2) what information was disclosed; and (3) the name of the individual and the agency. The aforementioned information shall be maintained in a secure file and made available to CMS upon request through a secure means. The CMS has established a level of effort limit of 40 hours for any individual request for support RFIs and RFAs. If the estimated level of effort to fulfill any one request is likely to meet or exceed this figure, the UPIC shall contact its COR for approval to proceed. A CMS representative will contact the OIG to explore the feasibility of other data search and/or production options. The UPIC shall obtain approval from the COR regarding requests started by the UPIC that it subsequently anticipates will exceed that 40-hour level of effort. The UPIC shall not exceed the 40-hour level of effort until it receives COR approval. H. Procedures for Sharing CMS Data with the DOJ In April 1994, CMS entered into an interagency agreement with the OIG and the DOJ that permitted UPICs to furnish information that previously had to be routed through OIG (refer to PIM Exhibit 16) including data related to the investigation of health care fraud matters directly to the DOJ that previously had to be routed through OIG (refer to PIM Exhibit 35). This agreement was supplemented on April 11, 2003, when in order to comply with the HIPAA Privacy Rule, the DOJ issued procedures, guidance, and a form letter for obtaining information (refer to PIM Exhibit 25). CMS and the DOJ have agreed that the DOJ’s requests for individually identifiable health information will follow the procedures that appear on the form letter (refer to PIM Exhibit 25). The 2003 form letter must be customized to each request. The form letter mechanism is not applicable to requests regarding Medicare Secondary Payer (MSP) information, unless the DOJ requestor indicates he or she is pursuing an MSP fraud matter. The PIM Exhibit 25 contains the entire document issued by the DOJ on April 11, 2003. The UPIC shall familiarize itself with the instructions contained in this document. Data requests for individually identifiable PHI related to the investigation of health care fraud matters will come directly from those individuals at the FBI or the DOJ who are involved in the work of the health care oversight agency (including, for example, FBI agents, Assistant U.S. Attorneys, or designees such as analysts, auditors, investigators, or paralegals). For example, data may be sought to assess allegations of fraud; examine billing patterns; ascertain dollar losses to the Medicare program for a procedure, service, or time period; determine the nature and extent of a provider’s/supplier’s voluntary refund(s); or conduct a random sample of claims for MR. The LE agency should begin by consulting with the appropriate Medicare contractor (usually the UPIC, but possibly also the MAC) or CMS to discuss the purpose or goal of the data request. Requests for cost report audits and/or associated documents shall be referred directly to the appropriate MAC. The UPIC shall discuss the information needed by the DOJ and determine the most efficient and timely way to provide the information. When feasible, the UPIC shall use statistical systems to inform the DOJ of the amount of dollars associated with its investigation, and the probable number of claims to expect from a claims-level data run. The UPIC shall obtain and transmit relevant statistical information to the DOJ (as soon as possible but no later than five (5) calendar days). The UPIC shall advise the DOJ of the anticipated volume, format, and media to be used (or alternative options, if any) for fulfilling a request for claims data. The UPIC shall provide the DOJ with the requested information and shall maintain cost information related to fulfilling these requests. An RFI shall consist of requests to run data for the DOJ (including national data for suppliers and entities whose claims billings span across multiple jurisdictions), extract of records, or a request to furnish any documentation or reports. The DOJ will confirm whether a request for claims data remains necessary based on the results of statistical analysis. If so, the DOJ and CMS will discuss issues involving the infrastructure and data expertise necessary to analyze and further process the data that CMS will provide to the DOJ. If the DOJ confirms that claims data are necessary, the DOJ will prepare a formal request letter to the UPIC with existing DOJ guidance (Exhibit 25). The UPIC shall provide data to the DOJ, when feasible, in a format to be agreed upon by the UPIC and the DOJ. Expected time frames for fulfilling the DOJ claims-level data requests will depend on the respective source(s) and duration of time for which data are sought, with the exception of emergency requests, which require coordination with Headquarters, the DOJ, and CMS staff. These are as follows: Emergency Requests - Require coordination with Headquarters DOJ and CMS staff. Priority I – This type of request is a top priority request requiring a quick turnaround. The information is essential to the prosecution of a provider/supplier. A RFI shall consist of requests to run data for the DOJ, extract of records, or a request to furnish any documentation or reports (see below for requests for assistance). The request shall be completed with the utmost urgency. Priority I requests shall be fulfilled within thirty (30) calendar days when the information or material is contained in the UPIC’s files unless an exception exists as described below. The UPIC shall provide the relevant data, reports, and findings to the requesting agency in the format(s) requested within 30 calendar days or sooner, when possible. The MAC shall furnish requested information to the UPIC within 20 calendar days of receipt of the request from the UPIC unless there are extenuating circumstances. The MAC shall communicate any extenuating circumstances to the UPIC and the MAC COR as soon as they become known. The UPIC shall communicate these extenuating circumstances to its COR. Periodically, there are instances in which the DOJ is in need of the requested information in a shorter timeframe than (30) calendar days. To account for these instances, the UPIC and MAC may add language to their JOA that allows for a shorter timeframe for the MAC to furnish the requested information (i.e. 48 hours, 72, hours, etc.). In these instances, the DOJ must provide justification as to why the requested information is needed in a shorter timeframe than the standard Priority I request. Otherwise, the UPIC shall follow-up with other contractors, and document all communication with contractors to ensure the request is not delayed unnecessarily. If extenuating circumstances exist that prevent the UPIC from meeting the thirty (30) day timeframe, the UPIC shall inform the requestor what, if any, portion of the request can be provided within thirty (30) days. The UPIC shall notify the requesting office as soon as possible (but not later than thirty (30) days) after receiving the request. The UPIC shall also document all communication with the requesting office regarding the delay, and shall include an estimate of when all requested information will be supplied. Priority II Requests – This type of request is less critical than a Priority I request. An RFI shall consist of requests to run data for the DOJ, extract of records, or a request to furnish any documentation or reports (see below for requests for assistance). Based on the review of its available resources, the UPIC shall inform the requestor what, if any, portion of the request can be provided. The UPIC shall provide the relevant data, reports, and findings to the requesting agency in the format(s) requested. The UPIC shall respond to such requests within 45 calendar days or sooner, when possible. The MAC shall furnish requested information to the UPIC within 30 calendar days of receipt of the request from the UPIC unless there are extenuating circumstances. The MAC shall communicate any extenuating circumstances to the UPIC and the MAC COR as soon as they become known. The UPIC shall communicate these extenuating circumstances to its COR. The UPIC shall follow-up with other contractors, and document all communication with contractors to ensure the request is not delayed unnecessarily. If extenuating circumstances exist that prevent the UPIC from meeting the 45-day timeframe, the UPIC shall inform the requestor what, if any, portion of the request can be provided within 45 calendar days. The UPIC shall notify the requesting office as soon as possible (but not later than 45 calendar days) after receiving the request. The UPIC shall also document all communication with the requesting office regarding the delay, and shall include an estimate of when all requested information will be supplied. RFA – A LE RFA is a type of RFI and shall consist of any LE requests that do not include running data and reports, but include requests such as the review and interpretation of medical records/medical documentation, interpretation of policies, and reviewing cost reports. The timeframes for RFIs specified in Priority I and II do not apply to RFAs. Due dates shall be negotiated with the requesting entity and documented appropriately along with the reasons for not meeting the agreed upon timeframes. The UPIC shall contact the COR if an agreement cannot be reached on the timeframe for completion. Disclosures of information to the DOJ shall comply with the Privacy Rule and Privacy Act. When DOJ makes a data request, the UPIC shall track these requests and document the following: (1) nature/purpose of the disclosure (cite a specific investigation and have a general description); (2) what information was disclosed; and (3) name of the individual and the agency. The aforementioned information shall be maintained in a secure file and made available to CMS upon request through a secure means. The CMS has established a level of effort limit of 40 hours for any individual request for support (RFIs and RFAs). If the estimated level of effort to fulfill any one request is likely to meet or exceed this figure, the PI contractor shall contact its COR for approval to proceed. A CMS representative will contact the OIG to explore the feasibility of other data search and/or production options. The UPIC shall obtain approval from the COR regarding requests started by the UPIC that it subsequently anticipates will exceed that 40-hour level of effort. The UPIC shall not exceed the 40-hour level of effort until it receives COR approval. I. Duplicate/Similar RFIs If the UPIC receives duplicate or similar RFIs from OIG and DOJ, the UPIC shall notify the requestors. If the requestors are not willing to share the information, the UPIC shall ask the BFL, with a copy to the COR, for assistance. J. Reporting Requirements for the DOJ and OIG For each data request received from the DOJ and the OIG, the UPIC shall maintain a record that includes: • The name and organization of the requestor; • The date of the written request (all requests must be in writing); • The nature of the request; • Any subsequent modifications to the request; • The cost of furnishing a response to each request; and • The date completed. K. LE Requests for MR The UPIC shall not send document request letters or go onsite to providers/suppliers to obtain medical records solely at the direction of LE. However, if LE furnishes the medical records and requests the UPIC to review and interpret medical records for them, the UPIC shall require LE to put this request in writing. At a minimum, this request shall include the following information: • The nature of the request (e.g., what type of service is in question, what is the allegation, and what should the reviewer be looking for in the medical record); • The volume of records furnished; • The due date; and • The format required for response. The UPIC shall present the written request to the COR, and copy its BFL prior to fulfilling the request. Each written request will be considered on a case-by-case basis to determine whether the UPIC has resources to fulfill the request. If so, the request may be approved. If LE requests the UPIC to perform MR on all investigations the UPIC initiates, the UPIC shall perform MR if it deems it necessary, on a case-by-case basis. The UPIC shall inform the COR and copy its BFL of such requests by LE. It is recommended that the MR Manager be included in the evaluation of the Request for MR to provide input as to: • The resources required; • The resources available; and • Recommended revisions to the volume of records to be reviewed that will still provide a statistically and clinically significant sample to support the purpose or allegation in the request and provide for the best use of MR resources. L. LE Requests for UPIC Audits of Medicare Provider Cost Reports Relating to Fraud If LE requests the UPIC to perform an audit of a Medicare provider’s cost report for fraud, the UPIC shall consult with the MAC to inquire if an audit of the cost report has already been performed. The UPIC shall also consult with the COR and BFL. The UPIC shall provide its COR and copy its BFL with the basis for the LE request and a detailed cost estimate to complete the audit. If the COR approves the audit, the UPIC shall perform the audit within the timeframe and cost agreed upon with LE. M. Requests from LE for Information Crossing Several UPIC Jurisdictions If a UPIC receives a RFI from LE that crosses several UPIC zones, the UPIC shall contact its BFL, with a copy to the COR. In the event that multiple zones are providing information in connection with the request, each UPIC shall enter a separate entry into the UCM as described in Section 4.12 of this chapter. The BFL may assign a lead UPIC to process these requests that will coordinate with the other UPICs to obtain the necessary data and consolidate the information into one comprehensive response for the requestor. The lead UPIC may be the UPIC that initially received the request; however, the nature of the RFI should be considered when assigning a lead UPIC. N. Freedom of Information Act Requests The UPIC shall assist CMS in processing requests from members of the public for records/information in accordance with the Freedom of Information Act (FOIA) (5 U.S.C. 552). Specifically, the UPIC shall adhere to FOIA policy, procedure, and instructions contained within Department of Health and Human Services FOIA regulations at 45 CFR Part 5, the HIPAA Regulations at 45 CFR 164.508, Chapter 6 of Program Manual Pub 100-1, the FOIA Policy and Procedural Guide, and any supplemental guidance issued by the Centers for Medicare & Medicaid Services (CMS) Freedom of Information Officer. FOIA guidelines can be found at http://www.cms.gov/FOIA/. Should the UPIC directly receive a FOIA request from any external requestors and/or CMS components other than their CPI BFL(s) or COR(s), they shall submit the FOIA request to the CMS Office of Strategic Operations and Regulatory Affairs (OSORA) FOIA Mailbox (FOIA_Request@cms.hhs.gov) for processing. Once the FOIA request is received by the OSORA FOIA Mailbox, it will be logged and assigned to the appropriate CPI component. Once assigned to CPI, should the FOIA request require UPIC investigative and/or audit materials, the appropriate CPI component will request the materials from the UPIC, with a copy to the applicable COR. Upon receipt of the FOIA request, the UPIC shall provide all relevant investigative information as requested in the FOIA request letter to their BFL through an agreed upon delivery method (i.e., email, Box, etc.), with a copy to their COR, by an agreed upon date between both parties. The UPIC shall include a cover letter with their response, of which outlines the information that is included in their response package and any recommended FOIA exemptions, as described at https://www.sec.gov/foia/nfoia.htm. If the UPIC determines that FOIA costs will have a budgetary impact that will affect their contract line-item value, the UPIC shall notify the COR immediately.