CMS Pub. 100-01, ch. 6, § 170.3

Health Insurance Program

(Rev. 1, 09-11-02)

Disclosure by the provider or supplier to persons other than the individual or the

individual's authorized representative of any records, reports, or other information about

the individual is authorized without the individual's or their representative's consent under

the following circumstances:

The disclosure is required in connection with any claim or other proceeding under the

Social Security Act for the proper performance of the duties of:

• Any officer or employee of the Department; or

• Any officer or employee of a State agency, A/B MAC (A or HHH), provider of

services, or other agency or organization participating in the administration of the

program, by contract or agreement, in carrying out such contract or agreement.

These limitations apply whether or not the individual to whom the information pertains

authorizes further disclosure to third parties (e.g., to a private medical plan).

170.4 - Disclosure to Third Parties for Other Than program Purposes

(Rev. 124, Issued: 05-17-19, Effective: 06-18-19, Implementation: 06-18-19 The term Medicare beneficiary identifier (Mbi) is a general term describing a

beneficiary's Medicare identification number. For purposes of this manual, Medicare

beneficiary identifier references both the Health Insurance Claim Number (HICN) and

the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition

period and after for certain business areas that will continue to use the HICN as part of

their processes.

Information obtained from CMS or its contractor is confidential and may be disclosed

only under conditions prescribed in rules and regulations or on the express authorization

of the Administrator of CMS. However, certain limited information about a beneficiary's

Medicare eligibility status and related claims information may be released to third party

payers with the beneficiary's express authorization.

The following information may be released subject to necessary authorization:

• Medicare beneficiary identifier;

• Coinsurance and deductible status;

• Dates of entitlement to Medicare;

• Copies of Medicare claims forms;

• Medicare report of eligibility; and

• Explanation of Medicare Benefits (EOMB) or Medicare Summary Notice (MSN).

Providers should refer requests for other information to the contractor. Contractors refer

requests to the CMS regional office.

The provider or supplier will adhere to the following authorization guidelines to ensure

that information is not released without the required authorization. Authorization must:

• Be in writing;

• Be signed and dated by the individual or someone authorized to act on the

individual's behalf;

• Specify the name of the provider authorized to disclose information;

• Specify what information the individual is authorizing the provider to disclose;

• Specify the names of the third party payers to whom the information is being

released;

• Specify the purpose for which the information is being released;

• Specify an expiration date for the authorization that should not exceed 2 years

from the date it was signed; and

• Specify that it may be revoked at any time.