Disclosure of Information to Administer EMAC; Confidentiality

(1) Disclosure of Member Information to Administer the EMAC Supplement. The MassHealth Agency and the Connector shall provide DUA with such information as DUA determines necessary to determine liability for the EMAC Supplement and otherwise administer M.G.L. c. 149, § 189A including, without limitation, information pertaining to MassHealth and ConnectorCare beneficiaries (Member Information), at such times and in such manner as agreed by the MassHealth Agency, the Connector and DUA. The Member Information determined necessary by DUA for such purposes and the related terms and conditions upon which Member Information provided to DUA shall be documented in an Interdepartmental Service Agreement among DUA, the MassHealth Agency and the Connector (ISA). (2) Confidentiality. (a) DUA shall protect the confidentiality of Member Information provided by the MassHealth Agency and the Connector pursuant to 430 CMR 21.10(1), in accordance with its obligations under applicable privacy and security laws and regulations including, without limitation, M.G.L. c. 66A and M.G.L. c. 118E, § 49, and any additional terms and conditions as the MassHealth Agency and the Connector may reasonably require to comply with their respective legal obligations, as set forth in the ISA. (b) DUA may provide an employer, that it determines is liable for the EMAC Supplement under M.G.L. c. 149, § 189A, with access to Member Information for purposes of reviewing and/or appealing such liability. Access shall be provided in accordance with procedures established by DUA. Any employer that receives Member Information shall be required to maintain the confidentiality of such Information in accordance with M.G.L. c. 118, § 49, and any other legal obligation to which the employer is subject, and shall limit its use and disclosure of such information as necessary to review and/or appeal the amount of the employer's liability. (c) Without limiting the generality of the foregoing, no employer shall use or disclose Member Information to disparage or retaliate against any employee or other individual to whom it pertains. Prior to the receipt of Member Information, employers shall be required to sign a written acknowledgment of their obligations to maintain the confidentiality of such Information, in such form and pursuant to such procedures established by DUA.