210-RICR-10-05-1. Confidentiality Rule (version Adoption, 03/02/2018 to 01/04/2022)

To view the official Final Regulation for accessibility and readability, click Download Regulation: Download Regulation 1.1 Purpose A. The Executive Office of Health and Human Services (EOHHS) has an ethical and legal obligation to safeguard and maintain as confidential the information it receives from or about Medicaid applicants and beneficiaries. In accordance with R.I. Gen. Laws Chapter 40-6, all records pertaining to the administration of the Medicaid Program are confidential in nature. It is unlawful for any person to make use of, or cause to be used, any information contained in these records for purposes not directly connected with the administration of the Medicaid Program, except with the consent of the person affected. B. Further, 42 C.F.R. § 431.300 et seq . requires EOHHS to have safeguards in place that restrict the use or disclosure of information about Medicaid applicants and beneficiaries. The purpose of this document is to meet this requirement and to safeguard and maintain applicant /beneficiary information as confidential. C. Nothing in this section shall be deemed to prohibit the EOHHS Secretary, or his/her duly authorized agents, from issuing any statistical material or data, or publishing or causing the same to be published whenever he/she shall deem it to be in the public interest. 1.2 Legal Authority A. These rules are promulgated pursuant to the authority set forth in R.I. Gen. Laws Chapter 40-8 (“Medical Assistance”) and various sections in the State’s General Laws including: §§ 5-37.3-4-1 et seq . (“Confidentiality of Health Care Communications and Information Act”); 23-5-9 (“Upon Death, Reports of Infectious Disease”); Chapter 40-6 (“Public Assistance Act”); §§ 40-6-12 (“Records as to Assistance”); and 42-72-8 (“Confidentiality of Records, Department of Children, Youth, and Families”). B. Additional authority is derived from Title XIX of the Social Security Act; the State’s Medicaid State Plan; and the Rhode Island Comprehensive Section 1115 Demonstration, as approved in final form on February 25, 2014, and as subsequently amended. C. Additional confidentiality provisions exist for Medicaid beneficiaries who are receiving treatment for HIV/AIDS and mental health/substance use. These provisions are contained in State law, in substantive part, as follows: R.I. Gen. Laws §§ 23-1.10-13 (“Confidentiality of records -Availability for Research, Health and Safety”); 23-6.3-7 (“Confidentiality, Prevention and Suppression of Contagious Diseases - HIV/AIDS”); 23-6.3-8 (“Protection of Records, Prevention and Suppression of Contagious Diseases - HIV/AIDS”); 23-28.36-3 (“Notification of Fire Fighters, Police Officers and Emergency Medical Technicians After Exposure to Infectious Diseases”); 40.1-5-5 (“Admission of Patients Generally, Rights of Patients, Patients’ Records, Competence of Patients - Mental Health Law”); and 40.1-5-26 (“Disclosure of Confidential Information and Records, Mental Health Law”). D. Additional federal regulatory requirements related to confidentiality and protection of records are adopted by reference below. 1.3 Incorporated Materials A. These regulations hereby adopt and incorporate the following by reference, not including any further editions or amendments thereof, and only to the extent that the provisions therein are not inconsistent with these regulations: 1. 42 U.S.C. § 1396a(a)(7) (“State Plans for Medical Assistance”); 2. 42 C.F.R. § 431.300 (“Safeguarding Information on Patients and Beneficiaries”); 3. 42 C.F.R. Part 2 (“Confidentiality of Substance Use Disorder Patient Records”); 4. 42 C.F.R. § 460.200 (PACE Programs, Maintenance of Records and Reporting of Data”); 5. 42 C.F.R. §§ 435.940 through 435.965 (“Verifying Financial Information”); 6. 42 C.F.R. § 483.10(h) (Nursing Facilities “Resident Rights, Privacy and Confidentiality”); 7. 45 C.F.R. §§ 164.102 through 164.534 (“Security and Privacy”). 1.4 Definitions A. As used herein, the following terms shall be construed as follows: 1. “Confidential” means that information is safeguarded, protected, and shared only on a “need-to-know” basis. 2. “Executive Office of Health and Human Services" or "EOHHS” means the state agency established in 2006 under the provisions of R.I. Gen. Laws Chapter 42-7.2 et seq . within the executive branch of state government and serves as the principal agency for the purposes of managing the Departments of Children, Youth, and Families (DCYF); Health (DOH); Human Services (DHS); and Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). The EOHHS is designated as the “single state agency,” authorized under Title XIX of the U.S. Social Security Act (42 U.S.C. § 1396a et seq .) and, as such, is legally responsible for the program / fiscal management and administration of the Medicaid Program. 1.5 Confidentiality Criteria A. The use and disclosure of information concerning Medicaid applicants and beneficiaries shall be limited to purposes directly related to: 1. The administration of the Medicaid Program. This includes, but is not limited to, establishing eligibility, determining the amount of Medicaid benefits provided, and providing services for applicants and beneficiaries. 2. Any investigation, prosecution, or criminal or civil proceeding conducted in connection with the administration of the Medicaid Program. 3. The administration of any other federal or state assistance program that provides assistance, in cash or in kind, or services, directly to individuals on the basis of need. 4. Any other release shall be with the beneficiary’s written permission, as obtained by EOHHS. B. The disclosure to any committee or legislative body (federal, state, or local) of any information that identifies, by name and/or address, any applicant or beneficiary is prohibited. C. The EOHHS Secretary, or his/her designee, may inquire into the records of any state department or agency in the course of his administration of public assistance programs. 1.6 Types of Information to be Maintained as Confidential A. It is the beneficiary’s right and expectation that all information requested about him/her and his/her situation will be respected and safeguarded by EOHHS and all its personnel. The beneficiary will be made aware of his/her right to confidentiality in the application process. B. The types of information to be safeguarded are as follows: 1. Name and address of applicant or beneficiary; 2. Information related to the social and economic conditions or circumstances of an applicant or beneficiary; 3. Agency evaluation of information about an applicant or beneficiary; 4. Medical data, including diagnosis and history of disease or disability concerning an applicant or beneficiary; 5. Any other material defined in law or regulation as a confidential matter; 6. Any information received for verifying income eligibility and amount of Medicaid payments; 7. Information received from the Social Security Administration or the Internal Revenue Service that must be safeguarded according to the requirements of the agency furnishing the data; 8. Any information received in connection with the identification of legally liable third party resources under the provisions of 42 C.F.R. § 433.138; 9. Any information which, at the discretion of the EOHHS Secretary, or his/her designee, is deemed necessary for the proper administration of the Medicaid Program. C. General data, not identified with any applicant or beneficiary, such as total expenditures, numbers of beneficiaries, statistical information, and social data contained in general studies, reports, or surveys is not contained in the class of material to be safeguarded and treated as confidential. In the use of case material for research or training, the identity of the beneficiary and his/her family must be protected. 1.7 Procedures to Maintain Confidentiality A. EOHHS has established the following procedures to safeguard the conditions for use and release of confidential applicant / beneficiary information: 1. Orientation for new staff members and ongoing in-service staff trainings shall include the topic of confidentiality and EOHHS policies and procedures related to its implementation. 2. All newly appointed staff, who will have access to applicant /beneficiary records, must sign a statement attesting to the fact that they have read the State’s confidentiality agreement and that they will maintain compliance with same. 3. The applicant’s/ beneficiary’s right to privacy shall be protected during any necessary interviews. The information to be safeguarded will only be shared with others as is necessary and appropriate for purposes of administering the Medicaid Program. 4. Contractors, vendors, and any other persons having in their possession information related to Medicaid applicants/ beneficiaries must execute data exchange agreements with EOHHS that safeguard the confidential nature of this information. 5. Information must be adequately stored and processed so that it is protected against unauthorized disclosure. All paper records and electronic files shall be properly stored and shall only be available to the staff responsible for the administration and supervision of the Program. 6. Materials sent or distributed to applicants, beneficiaries, or providers of services must be limited to that which are directly related to the administration of the Medicaid Program and have no political implications except to the extent required to implement the National Voter Registration Act (Public Law 103-931). Materials such as “holiday” greetings, public announcements, partisan voting information, and non-citizen registration notices shall not be mailed or distributed. 7. Materials in the immediate interest of the health and welfare of applicants / beneficiaries, such as announcements of free medical examinations, availability of surplus food, and consumer protection information are not prohibited. 8. Only the names of persons directly connected with the administration of the Program shall be contained in material sent or distributed to applicants/ beneficiaries and vendors. Such persons shall only be identified in their EOHHS official capacity. 1.8 Release of Information A. The release or use of information concerning an applicant or beneficiary applying for or receiving assistance or services is restricted to other social agencies whose representatives are subject to standards of confidentiality that are substantially similar to those of EOHHS. B. EOHHS must obtain permission from an applicant/beneficiary or their family, whenever possible, before responding to a request for information from an outside source, unless the information is to be used to verify income, eligibility, or the amount of Medicaid payments. C. In an emergency, when the applicant/beneficiary cannot be reached to obtain consent, s/he will be notified immediately by EOHHS after the information is supplied. D. In the event of the issuance of a subpoena for the case record or for any EOHHS representative to testify concerning an applicant or beneficiary, the request must be transmitted to EOHHS Division of Legal Services. The Court will be advised by EOHHS’s lawyer of these rules and regulations against disclosure of information. The same policy applies to requests for information from a governmental authority, the courts, a law enforcement official, or the media. E. EOHHS exchanges information with other entities to verify the income and eligibility of applicants and beneficiaries. Information made available by EOHHS is only to the extent necessary to assist in the valid administrative needs of the program receiving the information. Information received under § 6103(1) of the Internal Revenue Code will be exchanged only with agencies authorized to receive that information under that section of the IRS Code. 1.9 Disclosure of Tax Data A. Section 26 U.S.C. § 6103(l) of the Internal Revenue Code does not allow for disclosure of tax data by the State except when such disclosure is for the purposes of determining eligibility or the amount of benefits for a public assistance program. B. The taxpayer does not have authority to authorize the EOHHS to disclose tax data in his/her file. C. Section 26 U.S.C. § 7213(a) of the Internal Revenue Code prohibits disclosure of any return or return information. Violations of this statute shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than five (5) years, or both, together with the costs of prosecution. D. Section 26 U.S.C. § 7431 of the Internal Revenue Code provides that any person who knowingly, or by reason of negligence, discloses any return or return information with respect to a taxpayer, is subject to civil action for damages in a District Court of the United States. 1.10 Access to Public Information A. EOHHS recognizes both the public’s right to access public records and the individual’s right to dignity and privacy. It is EOHHS’s policy to facilitate public access to all public records that may be disclosed in accordance with R.I. Gen. Laws Chapter 38-2. It is also the policy of EOHHS to ensure all public records under its jurisdiction are available for public inspection and reproduction consistent with all applicable state and/or federal laws, unless otherwise prohibited by a court of competent jurisdiction. B. EOHHS has established regulations to set forth the specific rules to access public records maintained by EOHHS. (Please refer to “Access to Public Records” regulations). 1.11 Penalties and Sanctions R.I. Gen. Laws § 40-6-12 states that any person violating any of the provisions of these rules and regulations shall be deemed guilty of a misdemeanor, and shall be fined not more than two hundred dollars ($200) or shall be imprisoned for not more than six (6) months, or both. Other provisions of law cited herein may contain additional penalties and sanctions for violations of confidentiality and/or privacy. 1.12 Severability If any provision in any section of this rule or the application thereof to any person or circumstances is held invalid, its invalidity does not affect other provisions or applications of the rule which can be given effect without the invalid provision or application, and to this end the provisions of this rule are declared to be severable.