CMS Pub. 100-01, ch. 6, § 10

A. General

The purpose of the Privacy Act of 1974 is to provide safeguards for individuals against

an invasion of privacy by Federal agencies. Among other things, Federal agencies are

required to permit an individual to:

• Determine what records pertaining to the individual are collected, used, or

disseminated by such agencies;

• Prevent records pertaining to the individual obtained by Federal agencies for a

specific purpose from being used for another purpose without the individual's

consent; and

• Gain access to information pertaining to the individual in Federal agency records,

and to correct such records when appropriate.

Contractors considered to be Federal agencies for purposes of administering the Privacy

Act must comply with its provisions. Contractors must:

• Inform each individual from whom information is requested of their rights under

the Privacy Act;

• Describe the method of accessing an individual's records;

• Prepare a method of accounting for disclosures; and

• Devise a method of reviewing records at the request of individuals and making

corrections if appropriate.

Additional information concerning Medicare privacy policies can be accessed on the

CMS Web site under the Privacy Policy link at the bottom of the web page.

B. Definition of "Individual"

"Individual" means a living person on whom CMS has any personal (as opposed to

business) information. "Individual" does not include so-called persons such as sole

proprietorships, partnerships, or corporations. Except for disclosure of and access to

medical information about minors, a parent or legal guardian of a minor, or a legal

guardian of someone the court has declared incompetent, has the same rights as the

individual to the individual's records. No one may act on behalf of an individual who has

not been declared incompetent by a court or gain access to his/her records under the

Privacy Act without the individual's written consent.

C. Physicians' and Suppliers' Rights to Access Under the Privacy Act

Providers, physicians, and suppliers as business entities do not have access to business

information about themselves under the Privacy Act, since the Privacy Act concerns

individuals only. However, a physician or other supplier who is also an individual has

the same access rights as any other individual to personal information maintained about

themselves. Purely business information which is retrievable by the physician's unique

identifier is not subject to the Privacy Act, but it may be disclosed to the physician to the

extent that we would not deny the physician the information under the Freedom of

Information Act (FOIA).

D. Informing Individuals of Rights

The contractor must inform the individual of his/her rights under the Privacy Act when it

solicits any information directly from the beneficiary in connection with a Medicare

claim. This would usually be a result of the failure of the individual or provider to

furnish all the information required on a claims form. When information is collected by

telephone, the contractor will give the individual a brief oral explanation. When

information is requested by mail a written notice is used.

E. Method of Accessing Individual Records - General

The law requires that an agency must inform an individual, upon request, whether a

system of records contains a record pertaining to the individual, permit the individual to

review such record and to be accompanied for the purpose of reviewing the record by a

person of his or her choice. Further, the individual is permitted to obtain a copy of such

record in a comprehensible form at a reasonable cost. There is a charge of 10 cents per

page with all fees under $25 waived. There is no charge for searching; nor is there a

charge for a copy furnished as a means of permitting an individual access to their records.

Each requester shall be asked for proof of identity as well as such general information as

is necessary to determine where and how to look for records about the data subject

Within 10 working days of receiving a request, the contractor must decide whether to

release the records. The requested information must be furnished within 30 working days

unless good cause exists. An example of "good cause" would be an inactive record filed

in a records center that cannot be obtained within 30 days. The requester should be told

of the delay and given an approximate date to expect the information.

If an individual's request for information concerning themselves is not in the contractor's

files, the contractor should advise the individual that it does not have the information and,

if available elsewhere, that it is forwarding the request to the office which has it. The

contractor should furnish any requested information available if the request cannot be

satisfied in full. The contractor should identify requests under the Privacy Act that

require referral to CMS for data in central office systems. As required by the Privacy

Act, the contractor should send the request for processing, along with a copy of the

interim response, to the systems manager listed in the Annual Publication: Systems of

Records.

F. Methods of Accessing Individual Medical Records

The official responsible for the records, or their designated medical officer, may disclose

medical information directly to the individual if the official determines, based on review

of the medical evidence, that such disclosure is not likely to have an adverse effect. In

such cases the responsible official will give the requested information to the individual

and annotate the record to show that the disclosure was made.

If the responsible official determines that direct disclosure of the medical record would

be likely to have an adverse effect on the individual or does not consider themselves

qualified to make such a determination, the official will disclose the medical information

to the representative designated in writing by the individual. The representative must be

a medical professional (licensed medical practitioner or nurse) who would be willing to

review the record and discuss it with the individual. The contractor will retain a record

showing the reason for its determination and a copy of the correspondence transmitting

the information to the individual or to his/her medical representative.

If there is sensitive medical information in the records and the individual refuses to name

a medical professional or cannot afford the fee for the service, or if the designated

medical professional refuses to serve, the contractor will refer the file to the CMS

regional office.

G. Disclosure of Medical Information Relating to Minors

In order to protect the privacy of a minor, a parent or authorized guardian who requests

access to the minor's medical record may not be given direct access to the record.

Contractors shall ask a parent or guardian who requests access to such a record to

designate a physician or other professional (other than a family member) to whom the

record may be sent. The physician or health professional to whom the record is sent will

be asked by the contractor to consider the effect that the disclosure of the record to the

parent or guardian would have on the minor in determining whether the record should be

made available to the parent or guardian.

The contractor will prepare a response to the parent or guardian in substantially the

following form:

We have completed processing your request for access to the medical records of

(name)__________________________, a minor

The medical records have been sent to (name and address of designated health

professional) in accordance with your instructions

In each case where a minor's medical records are sent to a physician or health

professional, reasonable efforts will be made by the contractor to so inform the minor. In

the event the parent or guardian refuses to name a medical professional or cannot afford

the fee for the service or the designated medical professional refuses to serve, the

contractor will refer the file to the CMS regional office for appropriate action.

H. Disclosure to Third Parties

The Privacy Act permits disclosure to any third party with the written consent of the

individual to whom the record pertains. It also permits disclosure in certain instances

without the individual's consent. However, the contractor must not disclose information

unless the disclosure is specifically authorized in this chapter, or the individual has

consented to the disclosure in writing, or the CMS regional office authorizes the

disclosure.

I. Disclosures with Consent

Except for those disclosures discussed below in §10L of this chapter, Disclosure Without

Consent, information may not be disclosed without the written consent of the subject

individual, or their legal guardian, or, in the case of a minor, their parent (a parent or

legal guardian of a minor may not consent to the disclosure of medical information about

the minor). Other persons, regardless of relationship (except members of Congress and

representative payees), may not receive information about the individual without their

consent. In addition, a person who receives information about an individual with the

individual's consent may not authorize disclosure of that information to someone else.

Awkward situations may develop from a refusal, in compliance with the Privacy Act, to

divulge information to the child or spouse of an aged or infirm individual. In order to

avoid lengthy and unproductive correspondence, the requester should be advised that the

Privacy Act precludes our disclosing any information to anyone other than the individual

to whom the information pertains without the specific written consent of that individual,

but that the requested information will be sent directly to the individual concerned with

an explanation of the inquiry received on their behalf.

J. Disclosures to Members of Congress

Information requested by members of Congress and their staffs may be disclosed as

follows:

• Where a member of Congress (or a staff member) inquires on behalf of a

constituent, the contractor may respond to the member of Congress (MC) without

the written consent of the individual, but must make a record of the disclosure.

• Where the MC's inquiry is on behalf of a relative of the subject individual (but the

inquirer is not the legal guardian of the individual, or the parent of the individual

minor), the contractor should advise the MC that it can respond directly only to

the individual unless the individual furnishes written consent to release the

information about themselves to the MC (if we respond directly to the individual

or with their consent, no accounting record is required). Where the inquirer is the

legal guardian, or the parent of a minor, the contractor may disclose the

information to the MC, but must make a record of the disclosure.

• Where the MC's inquiry is in writing and does not indicate whether the request is

from the subject individual, the contractor will contact the MC, usually by

telephone, to clarify the situation.

A copy of the reply (or a report of telephone call if the response is by telephone) will

provide an adequate accounting record. The record should show the date of disclosure,

the information disclosed, and to whom the disclosure was made. The contractor should

file this record by name or social security claim number so that retrieval may be made

expeditiously.

K. Disclosure to Representative Payees

An SSA-appointed representative payee is entitled to receive information on, or act on,

behalf of a beneficiary to the extent necessary to protect the beneficiary's rights under

title II or XVIII.

L. Disclosure without Consent

Below are listed the situations in which data on identifiable individuals may be released

without the individual's consent. The disclosure is permitted if the disclosure would be:

• To DHHS employees and officers who need the records to perform their duties;

• Required by the FOIA;

• To the Bureau of Census;

• For research purposes under certain circumstances;

• To the National Archives;

• For law enforcement activities if the activity is authorized by law and the request

is from the head of the agency and specifies the particular record desired and the

law enforcement activity for which the record is sought;

• For compelling circumstances affecting the health and safety of any person if

notice of the disclosure is sent to the last known address of the individual;

• To either House of Congress or to any congressional committee or subcommittee

(see section I above for requests from members of Congress on behalf of

constituents);

• To the Comptroller General or an authorized representative to perform the duties

of the General Accounting Office;

• Pursuant to the order of a court of competent jurisdiction;

• For a "routine use" - A "routine use" is a disclosure of information which may be

made without the individual's written consent because the disclosure is

compatible with the purpose for which the information was collected in the first

place. An explanation of the purposes and uses of each "routine use" disclosure

must be published in the Federal Register at least 30 days prior to the disclosure

and at least annually thereafter. Current routine uses are:

• Part B Payment Records

• Payment Record Reference File

• Tape containing amount, type, and cost of health care services.

• Summary Records

• Group Health Plan Membership Data

• Identification Data

• Group Health Membership Data

• Group Health Membership List

• Quality Assurance Program Releases and Corrections

M. Accounting for Disclosure

The Privacy Act requires that agencies account for disclosures of personal data to

organizations outside DHHS or made in response to requests under the FOIA. The

purposes of the accounting are:

• To allow individuals to learn to whom records about themselves have been

disclosed; and

• To provide a basis for subsequently advising recipients of any amended or

disputed records.

The accounting must enable the contractor to tell the individual when and what

information about the individual was released and to whom. It is not necessary to

maintain a separate record of disclosures if such information can be retrieved from the

contractor's operating records.

An individual has the same access rights to an accounting of disclosures as to other

information, with no exception. It is not mandatory to tell an individual about disclosures

made to an agency for law enforcement purposes. (Refer requests for accountings that

include disclosures to law enforcement agencies to the CMS regional office.)

The contractor must maintain accounting records for 5 years, or the life of the basic

record, whichever is longer. The lives of various basic records are furnished in Chapter

1 of the Claims Processing Manual.

N. Reviewing and Correcting Records

Individuals are permitted by the Privacy Act to request correction of any record

pertaining to themselves. The contractor should have a method of reviewing records at

the request of the individual and making corrections where appropriate. In reviewing an

individual's request to amend a record, the contractor should, whenever practicable,

complete the review and advise the individual of the results within 10 days of the receipt

of the request. Prompt action should be taken wherever possible to reduce the

administrative costs involved in issuing both a separate acknowledgment of the receipt of

the request and a subsequent notice informing the individual of the action taken. If a

contractor denies a request for correction, the individual can appeal to the system

manager for the contractor's system of records.

O. Penalties

All employees must be aware of their responsibilities under the Privacy Act and guard

against improper disclosure of personal information. Any officer or employee who

willfully discloses individually identifiable information, the disclosure of which is

prohibited by the Act, shall be guilty of a misdemeanor and fined not more than $5,000.

P. Providers, Physicians, Suppliers, and the Privacy Act:

1. Confidentiality of Provider and Supplier Records

Medicare information may not be accepted from providers, physicians, and other

suppliers of services on a confidential basis, expressed or implied, since any medical

information obtained by a contractor is subject to disclosure to the individual to whom it

pertains. Contractors are to make sure their providers and other suppliers of services are

aware that no medical information marked "confidential" will be accepted on that basis

and that any medical information received by the contractor may be disclosed to the

patient or his/her representative upon request, either directly or through designated

professional medical personnel. If a provider, physician, or other supplier of services

documents medical findings on medical forms preprinted "confidential" or the provider

or other supplier of services routinely stamps all records "confidential," such records,

when transmitted to the contractor are to be accompanied by a signed statement to the

effect that the provider, physician or supplier understands that the information is subject

to disclosure at the request of the patient or his/her representative under the Privacy Act.

2. Release of Eligibility Data to Providers and Suppliers When the Individual is

Unable to Sign an Authorization

In situations such as the admission to a hospital of an unconscious person, where the

individual has not signed a statement authorizing the provider to pursue a Medicare

claim, the disclosure of Medicare information to the provider should be treated as a

routine use disclosure. If the individual has authorized the provider or supplier to pursue

a Medicare claim, the release of information may be treated as a disclosure made with the

beneficiary's consent.