PURPOSE: The state of Missouri, Department of Social Services, Division of Medical Services, is committed to protecting the confidentiality of protected health information of applicants and recipients of the Medical Assistance (Medicaid) Program. This rule describes how health care information about Medicaid applicants and recipients may be used and disclosed and how Medicaid recipi- 13 CSR 70-1

ents can get access to their personal health information.

1. (1) General Authority. There are many state and federal laws and regulations that safeguard applicants’ and recipients’ protected health information. Section 1902(a)(7) of the federal Social Security Act requires that a state plan for medical assistance must provide safeguards which restrict the use or disclosure of information concerning applicants and recipients to purposes directly connected with the administration of the plan. The Health Insurance Portability and Accountability Act (HIPAA) represents the first comprehensive federal protection of patient privacy (45 Code of Federal Regulations, parts 160–164). Passed by the United States Congress in 1996, HIPAA sets national standards to protect personal health information, reduces health care fraud, and makes health coverage more portable. The entire health care industry must implement HIPAA, including state governments.

2. (2) Definitions.

   1. (A) Health Insurance Portability and Accountability Act of 1996 (HIPAA). This law established “portability” requirements, allowing employees to “take their coverage with them” when they changed jobs. The “Administrative Simplification” section of the law deals with privacy, security of health care information, and standardized formats for electronic health care transactions (such as submission of health care claims).
   2. (B) Protected Health Information. A term established under the HIPAA privacy rules, it refers to individually identifiable health information, in whatever medium it is transmitted or maintained (e.g., paper, electronic, or even oral), including demographic information, that is created or received by a health care provider, health plan, employer, or health care clearinghouse and that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

   3. (C) Treatment, Payment and Health Care Operations (TPO) includes all of the following:

      1. 1. Treatment means the provision, coor-

dination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.

1. 2. Payment means activities undertaken

by a health plan to obtain premiums or determine/fulfill responsibility for coverage or provision of benefits, or by a provider or health plan to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collections activities, medical necessity determinations and utilization review.

1. 3. Health care operations includes func-

tions such as quality assessment and improvement activities, case management and care coordination, reviewing competence or qualifications of health care professionals, conducting training programs, licensing and credentialing activities, underwriting, premium rating, conducting or arranging for medical review, legal services and auditing functions, business planning and development, and general business and administrative activities (including activities relating to the sale, transfer or merger of the covered entity).

1. (3) Disclosures of Health Information Required or Allowed by Law. The Department of Social Services, the single state Medicaid agency, may use an applicant’s or recipient’s individually identifiable health information for treatment, payment, or health care operations. For example, individually identifiable health information may be used to determine disability for a public assistance program; when reviewing a request from the treating physician for a Medicaid service that requires a prior approval; and when processing claims and other requests for medical care payments. The Department of Social Services, Division of Medical Services may also report information for research purposes and matters concerning organ donations. The research must be for helping the Medicaid program. The Department of Social Services, Division of Medical Services shall report:

   1. (A) Contagious and reportable diseases, including, but not limited to, those defined by 19 CSR 20-20.020, birth defects, cancer, or other information for public health purposes;
   2. (B) Firearm injuries and other trauma events;
   3. (C) Reactions to problems with medicines;
   4. (D) To the police when required by law;
   5. (E) When the court orders the Department of Social Services to;
   6. (F) To the government to review how Department of Social Services programs are working;
   7. (G) To a provider or other insurance company who needs to know if a recipient is enrolled in one of the Department of Social Services programs;
   8. (H) To Workers’ Compensation for work related injuries;
   9. (I) Birth, death, and immunization information;
   10. (J) To the federal government when they are looking into something important to protect our country, the President, and other government workers;
   11. (K) Information about victims of abuse, neglect, or domestic violence to a government authority to the extent the disclosure is required by law; and
   12. (L) Medical eligibility when that information is used for a governmental function, such as local public health agency using eligibility information to determine eligibility for local health programs.
2. (4) Other Uses and Disclosures Require the Applicant’s or Recipient’s Written Authorization. For other situations, the Department of Social Services will ask for the applicant’s or recipient’s or their representative’s written authorization before using or disclosing information. The applicant or recipient or their representative may cancel this authorization at any time in writing. The Department of Social Services cannot take back any uses or disclosures already made with the applicant’s or recipient’s or their representative’s authorization.

3. (5) Applicant or Recipient Rights to Restrict or Request Protected Health Information. An applicant or recipient or their representative has the right to:

   1. (A) Receive private information from the Department of Social Services by other means or at another place;
   2. (B) Have their doctor see their health information, unless it is psychotherapy notes taken by a mental health provider that are kept separate from the rest of the individual’s medical record;
   3. (C) Request a change of their medical information if they think some of the information is wrong; and

   4. (D) Request a list of medical information the Department of Social Services shared that was not for treatment, payment, or health care operations or as required by federal law. Beginning in April 2003 an applicant or recipient or their representative can get a list of where their health information has been sent, unless it was sent for treatment, payment, checking to make sure they received quality care, or to make sure the laws are being followed, on forms prepared by the Department of Social Services.

      1. 1. If the individual requests a copy of

the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:

1. A. Copying, including the cost of

supplies for and labor of copying, the protected health information requested by the individual;

1. B. Postage, when the individual has

requested the copy, or summary or explanation, be mailed;

1. C. Preparing an explanation or sum-

mary of the protected health information; and

1. D. Requests for information in other

formats such as diskettes, audio/video tapes, slides, will be invoiced at the rate the agency actually paid for the format used.

AUTHORITY: section 208.201, RSMo 2000.* Original rule filed Feb. 3, 2003, effective Sept. 30, 2003.

*Original authority: 208.201, RSMo 1987.