2.0
Privacy
Act And related requirements
Under
the Privacy Act, contractors must assure that PII about beneficiaries
collected in TRICARE records is limited to that which is legally
authorized and necessary, and is maintained in a manner which assures
its confidentiality. When confidentiality is not assured, a privacy
breach may have occurred, which triggers requirements under the
Privacy Act. When the PII is in electronic form, additional requirements
under the Federal Information Security Modernization Act of 2014
(FISMA) apply. When the PII includes PHI, requirements under the
HIPAA Privacy, Breach, and Security Rules apply. The procedures
in
paragraphs 2.1 and
2.2 take into account
Privacy Act, FISMA, and HIPAA requirements. With respect to electronic
PII and security compliance, the contractor shall follow applicable
FISMA and DoD cybersecurity requirements, including information
security compliance under the National Institute of Standards and
Technology (NIST) program as stated in the TRICARE Systems Manual
(TSM),
Chapter 1, Section 1.1. These requirements
are concerned with not only confidentiality but also integrity and
availability of PII.
2.1
Breach
Response - Definition and General Requirements
2.1.1 A breach, as defined in DoDD 5400.11 (2014),
is a loss of control, compromise, unauthorized disclosure, unauthorized
acquisition, unauthorized access, or any similar term referring
to situations where persons other than authorized users and for
an other than authorized purpose have access or potential access
to PII/PHI, whether in paper or electronic form. Breaches are classified
as either possible or confirmed (see the following two definitions)
and as either cyber or non-cyber (i.e., involving either electronic
PII/PHI or paper/oral PII/PHI).
2.1.2 A possible breach is an incident
where the possibility of unauthorized access is suspected (or should
be suspected) and has not been ruled out. For example, if a laptop
containing PII/PHI is lost, and the contractor does not initially
know whether or not the PII/PHI was encrypted, then the incident shall
initially be classified as a possible breach, because it is impossible
to rule out the possibility of unauthorized access to the PII/PHI.
In contrast, the possibility may be ruled out immediately, and a possible
breach has not occurred, when misdirected postal mail is returned
unopened in its original packaging. However, if the intended recipient
informs the contractor that an expected package has not been received,
then a possible breach exists until and unless the unopened package
is returned to the contractor. In determining whether unauthorized
access should be suspected, the contractor shall consider at least
the following factors:
• How the event was discovered;
• Did the information
stay within the covered entity’s control;
• Was the information
actually accessed/viewed; and
• Ability to ensure
containment (e.g., recovered, destroyed, or deleted).
2.1.3 A confirmed breach is an incident
in which it is known that unauthorized access could occur. For example,
if a laptop containing PII/PHI is lost and the contractor knows
that the PII/PHI is unencrypted, then the contractor shall classify
and report the incident as a confirmed breach, because unauthorized
access could occur due to the lack of encryption (the contractor
knows this even without knowing whether or not unauthorized access
to the PII/PHI has actually occurred). If the laptop is subsequently
recovered and forensic investigation reveals that files containing
PII/PHI were never accessed, then the possibility of unauthorized
access can be ruled out, and the contractor shall re-classify the
incident as a non-breach incident.
2.1.4 A HIPAA Breach is an incident that satisfies
the definition of a breach in 45 CFR 164.402 (HIPAA Breach Rule).
2.1.5 A
cybersecurity incident is a violation or imminent threat of violation
of computer security policies, acceptable use policies, or standard
security practices, with respect to electronic PII/PHI. A cybersecurity
incident may or may not involve a breach of PII/PHI. For example,
a malware infection would be a possible breach if it could cause
unauthorized access to PII/PHI. However, if the malware only affects
data integrity or availability (not confidentiality), then a non-breach
cybersecurity incident has occurred.
2.1.6 The contractor shall follow the
procedures below upon discovery of a possible breach or cybersecurity
incident. These procedures focus on the first two steps (breach
identification and reporting) of a comprehensive breach response
program, but also require addressing the remaining steps: containment,
mitigation (which includes individual notification), eradication,
recovery, and follow-up. The contractor shall establish internal
processes for carrying out the procedures set forth below. These
processes shall assign responsibility for investigating, classifying,
reporting and otherwise responding to breaches and cybersecurity
incidents. The contractor should consult with the DHA Privacy Office
where guidance is needed, such as when the contractor is uncertain
whether a discovered breach is the contractor’s responsibility (e.g.,
if the contractor discovers a breach not caused by the contractor),
or how the contractor is to classify an incident (breach vs. non-breach,
confirmed vs. possible). Under no circumstances shall a contractor
delay reporting a confirmed or possible breach to the DHA Privacy
Office beyond the 24-hour deadline (see
paragraph 2.2.5) while waiting
for the DHA Privacy Office guidance or while investigating the incident.
2.1.7 In the event of a cybersecurity
incident not involving a PII/PHI breach, the contractor shall follow
applicable DoD cybersecurity and NIST requirements. If at any point
a contractor finds that a cybersecurity incident involves a confirmed
or possible PII/PHI breach, the contractor shall immediately initiate
the reporting procedures set forth below. The contractor shall also
continue to follow any required cybersecurity incident response
procedures and other applicable DoD cybersecurity requirements.
2.1.8 Contractors shall require subcontractors
who discover a possible breach or cybersecurity incident to initiate
the incident response requirements herein by reporting the incident
to the contractor immediately after discovery. The time of that
report to the contractor shall trigger the contractor’s DHA Privacy
Office reporting deadline (24 hours) under
paragraph 2.2.5. If a cybersecurity incident
is involved, the contractor’s deadline for US-CERT reporting (one
hour) runs from the time the incident is confirmed, under
paragraph 2.2.1.
The contractor shall require the subcontractor to cooperate as necessary
to meet these deadlines, maintain records, and otherwise enable
the contractor to complete the breach response requirements herein.
Alternatively, the contractor and subcontractor may agree that the
subcontractor shall report directly to US-CERT and the DHA Privacy
Office, and that the subcontractor shall be responsible for completing
the response process, provided that such agreement requires the
subcontractor to inform the contractor of the incident and the subsequent response
actions.
2.1.9 Contractors shall maintain records
of all breach and cybersecurity incident investigations, regardless
of the outcome. Investigations identifying unauthorized disclosures
must be logged for HIPAA and Privacy Act disclosure accounting purposes,
whether or not individual notification is required under the HIPAA
Breach Rule.
2.1.10 Contractors,
when acting as HIPAA-covered entities (rather than as business associates),
are not subject to the breach response requirements of this Manual.
However, such contractors are subject to both the HIPAA Breach Rule
(applicable to them in their capacity as covered entities) and DoD cybersecurity
requirements (applicable to them in their capacity as DoD contractors).
2.2
Breach
Response - Specific Reporting and Individual Notification Requirements
2.2.1 Immediately
upon discovery of a possible or confirmed breach or cybersecurity
incident, the contractor shall initiate an investigation. If the
incident involves electronic PII/PHI, and if the investigation finds
a confirmed breach or cybersecurity incident, the contractor shall
report it within one hour of confirmation, to the United States-Computer
Emergency Readiness Team (US-CERT) Incident Reporting System at
https://forms.us-cert.gov/report/,
as required by the Department of Homeland Security (DHS).
Note: DHS no longer
requires US-CERT reporting of non-cyber breaches or unconfirmed electronic
breaches. However, DHS permits US-CERT reporting of unconfirmed
cyber-related incidents on a voluntary basis. Thus, if a contractor
is uncertain whether a possible cyber-related incident should be
treated as confirmed and thus reportable, the contractor may voluntarily
report the incident.
2.2.2 Before submission to US-CERT, the
contractor shall save a copy of the on-line report. After submitting
the report, the contractor shall record the US-CERT incident reporting
number, which shall be included in the initial report to the DHA
Privacy Office as described in
paragraphs 2.2.5 through
2.2.7.
Information may not be known or complete, but available information
shall be reported within the one hour deadline for submission.
Note: Regardless
of whether or not an incident is confirmed, the contractor shall
also investigate whether or not the incident impacts data integrity
or availability of PII/PHI. If such impact is confirmed, then the
incident is reportable to US-CERT. For guidance on investigating
the impact on data integrity and availability, refer to DoD cybersecurity
and NIST guidance.
2.2.3 The contractor shall provide any
updates to the initial US-CERT report by e-mail to soc@us-cert.gov,
with the Reporting Number in the subject line. The contractor shall
provide a copy of the initial or updated US-CERT report to the DHA
Privacy Office if requested. Contractor questions about US-CERT
reporting shall be directed to the DHA Privacy Office, not the US-CERT
office.
2.2.4 In conjunction with its initial
investigation, the contractor shall immediately take steps to minimize
any impact from the occurrence and proceed with further investigation
of any relevant details such as root causes, vulnerabilities exploited,
or actions needed (such as containment, mitigation, eradication,
recovery and follow-up).
2.2.5 In
addition to US-CERT reporting, the contractor shall report to the
DHA Privacy Office by submitting the form specified below within
24 hours of discovery of a breach (possible or confirmed), unless
the breach falls within a category that the Privacy Office has determined
to be not reportable. This 24 hour period runs from the time of
discovery, unlike the one hour US-CERT reporting period, which runs
from the time a cybersecurity incident is confirmed. Thus, depending
on the time period needed to confirm, the report to the DHA Privacy
Office may be due either before or after the US-CERT report.
2.2.6 The breach report form required
within the 24 hour deadline shall be sent by e-mail to: dha.ncr.pcl.mbx.dha-privacy-officer@mail.mil.
Encryption is not required, because reports and notices shall not
contain PII/PHI. If electronic mail is not available, telephone
notification is also acceptable, but all notifications and reports
delivered telephonically must be confirmed in writing as soon as technically
feasible.
2.2.7 The
contractors shall prepare the breach reports required within the
24 hour deadline by completing the Breach Reporting DD Form 2959
(Breach of PII Report), available at the Breach Response link on
the DHA Privacy Office web
site,
https://health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties For
non-cyber
incidents without a US-CERT number, the contractor shall assign
an internal tracking number and include that number in Box 1.e of
the DD Form 2959. The contractor shall coordinate with the DHA Privacy
Office for subsequent action such as beneficiary notification, and mitigation.
The corresponding
DD Form 1423, Contract
Data Requirements List (CDRL)
, located in Section
J of the applicable contract provides guidance on
completing and updating the Breach Reporting DD Form 2959. The contractor
shall promptly update the DD Form 2959 as new information becomes
available.
2.2.8 If the DHA Privacy Office determines
that beneficiary notification is required, the contractor shall
provide written notification to beneficiaries affected by the breach
as soon as possible, but no later than 10 working days after the
breach is discovered and the identities of the beneficiaries are ascertained.
The 10 day period begins when the contractor is able to determine
the identities (including addresses) of the beneficiaries whose
records were impacted.
2.2.9 The contractor’s proposed notification
to be issued to the affected beneficiaries shall be submitted to
the DHA Privacy Office for approval. The notification to the beneficiaries,
at a minimum, shall include the following:
• Specific data elements.
• Basic facts
and circumstances.
• Recommended
precautions the beneficiary can take.
• Federal Trade
Commission (FTC) identity theft hotline information.
• Any mitigation
support services offered such as credit monitoring.
2.2.10 The contractor
shall ensure that envelopes containing written notifications to
affected beneficiaries are clearly labeled to alert the recipient
to the importance of its contents, e.g., “Data Breach Information
Enclosed,” and that the envelope is marked with the identity of
the contractor and/or subcontractor organization that suffered the
breach.
2.2.11 If notification
cannot be accomplished within 10 working days, the contractor shall
notify the DHA Privacy Office to determine needed follow-up actions.
2.2.12 If media notice is required, the contractor
will submit a proposed notice and suggested media outlets for the
DHA Privacy Office review (which will include coordination with
the DHA Communications Division) and approval.
2.2.13 The contractor shall, at no cost
to the Government, bear any costs associated with a breach of PII/PHI
that the contractor has caused or is otherwise responsible for addressing.
2.3 System of
Records (SOR) Maintained or Operated by Contractors
2.3.1 Contractor activity is typically
associated with the SOR described in System of Records Notice (SORN)
EDTMA 04 - Medical/Dental Claim History Files (note that physical
location of records in this SOR may be decentralized). However,
some contractor records may instead be associated with the following
SORs:
• EDTMA 01 - Health Benefits Authorization
Files;
• EDTMA 02 - Medical/Dental
Care and Claims Inquiry Files;
• EDHA 06 - Designated Provider Managed Care
System Records, formerly known as USTF Managed Care System;
• EDHA 07 - Military Health Information System;
and
• EDHA 08 - Health
Affairs Survey and Study Data Base.
Except for “routine use” disclosures
and other authorized disclosures as provided in DoD 5400.11-R, C4.1.1.3
and C4.2, no record contained in a SOR operated and maintained by
the contractor for the Government shall be disclosed to any person
or to any agency outside DoD without prior written consent or request
of the beneficiary to whom the record pertains.
2.3.2 The Privacy
Act permits use of PII throughout the Military Health System (MHS)
for legitimate mission purposes, including when TRICARE contractors
have a need for the records in the performance of their duties.
TRICARE contractors should be aware that TRICARE Beneficiary Counseling and
Assistance Coordinators (BCACs), Debt Collection Assistance Officers
(DCAOs), and Uniformed Services Claims Officers (USCOs) are employees
of the DoD authorized to receive information from TRICARE records
if they have a need for the information in the performance of their
duties. A TRICARE BCAC, DCAO, USCO, or other authorized DHA/MHS
representative who is assisting a beneficiary may receive TRICARE
information pertaining to that beneficiary, provided that the identity
and authority of such representative is verified (e.g., through
the Customer Service Community Directory). The restriction on disclosure
of only that information directly releasable to the beneficiary
also applies to the BCAC, DCAO, USCO, or other representative.
2.3.3 Following
proper SORN publication and Government confirmation of contractor
authority to operate the applicable system(s), the contractor shall
coordinate through the DHA Privacy Office, regarding any needed
updates. The contractor shall promptly advise the DHA Privacy Office
of changes in SORs or their use that may require a change in the
applicable SORN, whether EDTMA 04 or otherwise.
2.4 Confidentiality
Of Medical/Dental Claim History Files
Certain
categories of PII/PHI (such as SSN or Date of Birth (DOB) data,
or PHI relating to mental health, sexually transmitted disease,
etc.) are sensitive. Except as otherwise permitted in this paragraph or
as permitted by law, the contractor shall not release such sensitive
PII/PHI to a third party unless the beneficiary who is the subject
of the PII/PHI has specifically consented to disclosure of such
sensitive information in accordance with applicable consent/authorization
requirements (under Privacy Act, HIPAA, or Substance Abuse and Mental
Health Services Administration (SAMHSA) rules). However, if the contractor
is uncertain about whether disclosure without consent is warranted
(for example, on the basis of a HIPAA Privacy Rule exception), the
contractor shall consult with DHA Privacy Office or DHA Office of
General Counsel (OGC). In determining what PHI is sensitive, the
contractor may take into account the Explanation of Benefits (EOB)
issuance exceptions in
Chapter 8, Section 8,
the contractor’s own internal guidelines, and/or the contractor’s
case-by-case determinations.
2.5 Collecting Information
2.5.1 The Privacy Act requires personal
information to be collected, to the greatest extent practicable,
directly from the subject beneficiary when the information may result
in adverse determinations about the beneficiary’s rights, benefits,
or privileges under federal programs. The collection of information
from third parties shall be minimized except where there is a need
to obtain the information directly from a third party, such as a
need to verify information provided by the subject beneficiary.
2.5.2 Whenever
PII is solicited and collected (by paper, electronic, or verbal
means) from a beneficiary for a SOR, a
Privacy Act Statement (PAS)
shall be provided. The PAS informs the beneficiary of the authority
for soliciting and collecting PII, the principal purposes for which
that PII will be used, where that PII may be disclosed outside of
DoD, whether furnishing that information is voluntary or mandatory,
and the effects on the beneficiary of choosing not to provide all
or part of that requested PII. The PAS must be conspicuously posted
before the point of collection. On paper forms this usually means
placing the PAS at the beginning of the form, immediately following
the title, before the first official heading/selection, or immediately
prior to the first collection field. On electronic forms, this means
placing the PAS so that the beneficiary sees it before providing
information. A PAS may not be displayed via a hyper-link or pop-up
that the beneficiary could bypass. When information is collected by
telephone, a brief oral explanation of the Privacy Act shall be
given to the beneficiary. The following text illustrates acceptable
language for an oral PAS, showing the mandatory portion of the PAS
with example language in
bold (this is only illustrative;
modify as needed):
This information
is being collected to: Process your request to change your provider.
Providing this information is: Voluntary.
However, failure to provide all requested information may result
in a delay or denial of your request to change your provider.
This information may be disclosed for routine
uses consistent with why it was collected.
This information is being collected under
the authority of: 10 USC Chapter 55; 32 CFR Part 199; and
E.O. 9397 (SSN), as amended.
To hear this again please tell me
/ press 1 [If answer is “yes,” repeat script.]
If you do not want it repeated, please
tell me / press 2 [If answer is “yes,” continue with script.]
If you would like to hear a full
list of routine uses which may be made of your information, and
the complete legal authorities for collecting this information,
please tell me / press 9 now.
Note: The
last few lines may change depending on whether the PAS is being
provided by a human or automated system and on how that system would
operate. The point is to actively ask whether the beneficiary (1)
would like the PAS to be repeated, and (2) would like to hear the
routine uses and authority titles.
2.5.3 Claims received by the contractor
which do not indicate that the claimant received a PAS shall, nevertheless,
be processed for payment. However, if additional information concerning
a claim is required, the request to the beneficiary must include
the appropriate PAS language.
2.6
Access
To Contractor Records Under The Privacy Act
2.6.1 The contractor must develop and
describe procedures by which a beneficiary is permitted access to
records pertaining to him or her under the Privacy Act. If the request
is under HIPAA, refer to
Chapter 19, Section 3 (if
the request specifies neither HIPAA nor the Privacy Act, the contractor
shall apply its judgment as to whether the Privacy Act or HIPAA
is more applicable). Upon request, a beneficiary must be informed
whether or not the Medical/Dental Claim History Files contain a
record pertaining to him or her. And, if the beneficiary so desires,
he or she shall be permitted to review such record and to be accompanied
for the purpose of reviewing the record by a person of his or her
choice. Further, a beneficiary is permitted to obtain a copy of
such record in a form which is comprehensible to him or her.
2.6.2 The contractor
shall not require the beneficiary to provide a reason or justification
before granting beneficiary access to a record containing his/her
PII. However, the requester shall be required to provide such information
as is necessary to determine where and how to look for the records.
The beneficiary shall also be required to provide reasonable identity
verification, in accordance with 45 CFR 164.514(h), before access
is granted. Since most records in the Medical/Dental Claim History
Files relate to medical information, a beneficiary may be required
to submit a written request for access to the file. This allows
the contractor time to review the medical information in accordance
with the following procedures to determine if direct access by the
beneficiary to the medical information would have an adverse effect
on the beneficiary.
2.6.3 Neither the Privacy Act nor the
HIPAA Privacy Rule distinguish between custodial and non-custodial
parents in cases involving separation or divorce. A minor’s PII/PHI
may be released to either parent, unless the contractor is informed
of divorce or legal separation or a court order or other documentation
potentially affecting parental authority with respect to the minor’s
health care. In that situation, the contractor shall review the
documentation to verify which parent has authority with respect
to the minor’s health care and whether disclosure of the minor’s
PHI to either parent is restricted.
2.6.4 Disclosure shall be made only to
the minor if the minor consents to care and parental consent is
not required under law, or the minor and parent have agreed that
the minor may have a confidential relationship with the provider
of the care about which disclosure is requested. If the minor obtains
care at the direction of a court or guardian or other court appointee,
then disclosures shall be made to the court or appointee. In addition,
a minor’s PII/PHI need not be disclosed to a parent if the contractor
reasonably believes, in the exercise of professional judgment, that
disclosure would not be in the minor’s best interest, for example,
due to risk of abuse or neglect by the parent or other risk of endangerment
to the minor, or where the minor has signed a claim related to sensitive
matters such as abortion, substance abuse or sexually transmitted
disease. If the records relate to alcohol or drug abuse treatment,
then see the SAMHSA Regulations provisions below. Questions regarding
custodial parent issues shall be addressed to the DHA OGC.
2.6.5 Requests
for information or records must be acknowledged (if not responded
to) within 10 working days from the date of receipt. A beneficiary’s
request for access to records pertaining to him or her shall receive
concurrent consideration both under the Privacy Act and the Freedom
of Information Act (FOIA), if appropriate. The contractor may consult
the DHA FOIA Service Center if needed. The requested information
must be furnished within 20 working days unless good cause exists
to delay furnishing the record, in which case the beneficiary shall,
within the 20 working days, be informed in writing of the reason
for delay and when it is anticipated that the information will be
furnished. If the contractor does not agree to access as requested,
the contractor shall forward the request to DHA, ATTENTION OGC,
within 10 working days of receipt of the request.
2.7 Corrections
To Records
2.7.1 Beneficiaries’
requests for corrections of records should be in writing and contain,
at a minimum, sufficient identifying information to enable location
of the record, a description of the items to be amended and the
reason amendment is being requested. Requests for amendments must
be acknowledged within 10 working days from the date of receipt,
as provided in DoD 5400.11-R, C3.1.10 and C3.3.7.1. If it is determined
that the patient’s request is under HIPAA, refer to
Chapter 19, Section 3.
2.7.2 TRICARE
contractors shall implement procedures for reviewing records at
the request of individuals concerned and develop and implement procedures
for making corrections, if appropriate. Whenever practicable, contractors
shall complete the review and advise the beneficiary of the decision to
amend the record within 10 working days of receipt of the request.
Otherwise, a written acknowledgment of receipt of a request for
amendment must be provided within 10 working days after receipt,
with notification of a decision to amend the record furnished within
30 working days of receipt of the request. The final amendment and
notification must in any event be accomplished within 30 days after
the request.
2.7.3 If a contractor agrees with allowing
any portion of the beneficiary’s request to amend a record, it shall
amend the record accordingly. The contractor must make reasonable
efforts to inform previous recipients of the uncorrected record
identified by the beneficiary or by a disclosure accounting as required
below. Informing previous recipients must include providing them
the amended text.
2.7.4 If the TRICARE contractor does not
agree to amend the record as requested, the beneficiary shall not
be advised of the decision. Rather the beneficiary’s request for
amending the record, together with a copy of the record and the
contractor’s written explanation of the reason(s) for not amending the
record, shall be sent to DHA, ATTENTION: OGC, within 10 working
days of receipt of the request. Written acknowledgment of receipt
of the request for amendment shall be provided to the beneficiary.
2.8 Accounting
For Disclosures
2.8.1 The
Privacy Act requires an accurate accounting for disclosures of PII
to third parties outside the DoD that are not disclosures under
the FOIA or disclosures to DoD personnel for use in official duties.
Such accounting requires tracking:
• The name and address of the person and,
if appropriate, the agency to whom the disclosure is made.
• The date, nature, and purpose of each disclosure.
• For disclosures requiring consent, the
consent of the beneficiary to whom the record pertains.
2.8.2 The contractor
must keep a record of each disclosure or be able to reconstruct
from its system the required accounting information when needed.
Accounting records must be retained for at least five years after
the last disclosure, to assure compliance with HIPAA as well as
the Privacy Act. If the PII to which the accounting request applies
includes PHI, then the contractor must apply the disclosure accounting
requirements of the HIPAA Privacy Rule and DoD 6025.18-R, C13 in
such a manner that both the Privacy Act and the HIPAA Privacy Rule
are satisfied. See the provisions on HIPAA accounting in
Chapter 19, Section 3 and TSM,
Chapter 1, Section 1.1.
2.9 Safeguards
Contractors must implement administrative
and physical safeguards to protect Medical/Dental Claim History
Files from unauthorized or unintentional access, disclosure, modification,
or destruction. All persons whose official duties require access
to or processing and maintenance of personal information shall be
advised of the proper safeguarding and use of such information.
In addition, all employees should be aware of their responsibilities
under the Privacy Act.
2.10 General Correspondence
In responding to general correspondence,
the reply should be sent to the beneficiary regardless of who made
the inquiry. If a spouse or other family member makes an inquiry
concerning a beneficiary’s claim, etc., the inquiry shall not be
returned to the spouse or family member unanswered. Rather, a reply
should be addressed to the beneficiary with an explanation that
under the Privacy Act the reply could not be made to the spouse
or family member who made the inquiry. Also, if an inquiry is made
by the beneficiary, including an eligible family member regardless
of age, the reply shall be addressed to the beneficiary, not the
beneficiary’s spouse (Service member) or parent. The only exceptions
are when a parent writes on behalf of a minor child (under 18 years
of age) or when a guardian writes on behalf of a physically or mentally
incompetent beneficiary. However, in responding to a parent of a
minor or guardian of an incompetent, the procedures outlined under
Access to Contractor Records (
paragraph 2.6) shall be followed in responding
to a request by a parent of a minor or guardian of an incompetent
for disclosure of sensitive information (e.g., abortion, alcohol
and substance abuse, venereal disease, etc.) or information which,
if released, would have an adverse effect on the beneficiary. When
a reply is made to the beneficiary, the reply must be fully responsive
to the inquiry whether or not the query was originally made by the
beneficiary. Copies of the response shall NOT be sent to any family
member, spouse or other person who may have made the inquiry.
2.11 Release Of
Information To Members Of Congress
2.11.1 In accordance
with the DoD policy of making maximum information concerning its operations
and activities available to both Government officials and to the
public in general, DHA and TRICARE contractors will answer constituent’s
letters to members of Congress as fully as possible.
2.11.2 Information
requested by members of the Congress for the constituents shall
be handled in the same manner as if the beneficiary had written
directly to DHA or the TRICARE contractor. If it develops that the
information cannot be released, the Member of the Congress requesting
the information shall be advised promptly of that fact and of the
reasons for the determination.
2.11.3 An established
as a routine use of the Medical/Dental Claim History Files is providing information
from a beneficiary’s records to a Congressional office in response
to the beneficiary’s request to the Congressional office. However,
special rules apply in certain situations, as summarized below.
Consult the DHA Privacy Office if necessary.
2.11.3.1 If the
PII to be disclosed includes PHI, the HIPAA Privacy Rule applies,
which requires that the beneficiary authorize disclosure by signing
a HIPAA-compliant authorization form such as DD Form 2870. Pending
receipt of a signed authorization form, any response disclosing
PHI shall be issued directly to the beneficiary and not to the Congressional
office (which shall be notified that the response has been sent
to the beneficiary). Refer to
Chapter 19, Section 3.
2.11.3.2 In those
cases in which PHI is not requested and the Congressional inquiry
indicates that the request is being made on behalf of a person other
than the beneficiary whose record is to be disclosed (e.g., a spouse
or family member), the contractor shall advise the Congressional
office that written consent of the beneficiary is required, unless
the person has legal authority to act for the beneficiary (e.g.,
authority as a parent of a minor or as a guardian). Absent written
consent, the response shall generally be sent directly to the beneficiary
(the Congressional office must be notified of this action).
2.11.3.3 A record
of a beneficiary which would not be releasable directly to the beneficiary
(e.g., a medical record which would have an adverse effect on the
beneficiary) cannot be released directly to the Congressional office
making the inquiry on behalf of the beneficiary. Instead, the Congressional office
shall be advised of the procedure for release of such record. Of
course, in those cases where a contractor can respond to a Congressional
request for assistance on behalf of a beneficiary, without disclosing
PII/PHI which would fall under the Privacy Act, the contractor shall
comply.
2.11.4 Replies
to all Congressional inquiries and requests shall be completely
responsive and handled as expeditiously as possible. Should it become
evident that a response to a request cannot be made within 15 working
days, an interim reply will be sent. The interim reply will indicate
the anticipated date of completion and the steps being taken to
obtain the information requested.
2.12 Appeals
Guidance for
handling general correspondence also applies to appeal cases, except
that a designated “representative” (as defined in
32 CFR 199.10(a)(2)(ii)), may be communicated
with on the same basis as the beneficiary. However, unless the representative
is the parent of a minor or the legally appointed representative
of an incompetent beneficiary, a written statement from the beneficiary appointing
the representative is required. (See
Chapter 12, Section 2,
for requirements.)
4.0 Federal Regulations
On The Confidentiality Of Alcohol And Drug Abuse Patient Records
The HHS SAMHSA has issued special
rules on substance abuse information. For information regarding
identity, diagnosis, prognosis or treatment of any beneficiary in
connection with a substance abuse or alcoholism program, consent
must generally be obtained before information can be released. See
SAMHSA Regulations at 42 CFR Part 2, including the model consent
form. Disclosure without beneficiary consent, however, may be made
in certain circumstances (such as emergencies and approved research
or other health care operational activities) described in 42 CFR
Part 2 Subpart D. Before releasing health information based on a
SAMHSA consent, HIPAA authorization requirements, where needed,
must also be satisfied.
• The consent
requirement and other SAMHSA rules apply in any civil, criminal, administrative
or legislative proceeding. For information from SAMHSA regarding treatment
programs, contact:
• The contractor shall establish and
maintain procedures and controls to assure compliance with SAMHSA
requirements, including the following provisions.
4.1 Consent for
Minor, Incompetent or Deceased Beneficiaries
4.1.1 The SAMHSA rule applicable to minors,
42 CFR 2.14, relies on State laws to define minors and requirements
for informed consent by minors and parents. If no age of majority
is specified in the applicable State law, the age of 18 years shall
be considered the age of majority. A beneficiary who has been legally
declared an emancipated minor shall be considered as an adult. A
beneficiary who is under 18 years of age and is or was a spouse
of an Active Duty Service Member (ADSM) or retiree shall also be
considered an emancipated minor. In cases involving unemancipated
minor beneficiaries and separated or divorced parents, it may be
necessary to review any applicable court order, applicable state
law and 42 CFR 2.14 to determine the privacy rights of a minor receiving
alcohol and substance abuse prevention and treatment services.
4.1.2 For beneficiaries,
other than minors, judged to be incompetent, the consent to collection of
information may be given by the guardian or other person authorized
under state law to act on the patient’s behalf.
4.1.3 When consent
is required for collection or disclosure of records of a deceased
beneficiary, consent may be obtained from an executor, administrator,
or other personal representative of the deceased beneficiary’s estate.
If such a representative has not been appointed, the spouse, or
if none, other family member involved with the deceased beneficiary’s
care or payment for care may give consent.
4.2 Disclosure
to Beneficiary or Family Members or Others
Disclosure
of alcohol and substance abuse information to the beneficiary shall
be determined in accordance with the procedures set forth in “Access
to Contractor Records Under the Privacy Act” (
paragraph 2.6). When consent
is given, disclosure may be made to family members or any person
with whom the beneficiary has a close personal relationship and
who is involved in the beneficiary’s care unless, in the judgment
of the person responsible for the beneficiary’s treatment, the disclosure
would be harmful to the beneficiary.
4.3
Prohibition
On Redisclosure
Whenever a written disclosure is
made, with proper written consent, the disclosure shall be accompanied
by a written statement as follows:
“Prohibition on redisclosure: This
information has been disclosed to you from records protected by
Federal Law. Federal Regulations (42 CFR Part 2) prohibit you from
making any further disclosure of this information except with the
specific written consent of the person to whom it pertains. A general
authorization for the release of medical or other information, if
held by another party, is not sufficient for this purpose. Federal regulations
state that any person who violates any provision of this law shall
be fined not more than $500 in the case of a first offense and not
more than $5,000 in the case of each subsequent offense.”
Note: This
statement shall either appear on correspondence transmitting the
documents or be stamped on the first page of the documents disclosed.
4.4
Other Disclosures
Requests for disclosures in situations
not specified above shall be made only with the written approval
of OGC or the DHA Privacy Office.
7.0 Federal Non-discrimination Laws
7.1 Title VI of the Civil Rights Act
of 1964 provides that no person shall, on the grounds of race, color
or national origin, be excluded from participation under any program
or activity receiving federal financial assistance. In addition,
Section 1557 of the Patient Protection and Affordable Care Act (ACA) prohibits
discrimination on the ground of race, color, national origin, sex,
age, or disability under any health program or activity administered
by an Executive agency. These federal laws apply to TRICARE and
DHA, including the managed care support and ancillary services provided
under TRICARE/DHA contracts. Hospitals, skilled nursing facilities,
residential treatment centers and special treatment facilities determined
to be authorized providers under TRICARE are subject to the provisions
of Title VI and Section 1557.
7.2 Investigating complaints of noncompliance
is a function of DHA. Any discrimination complaints involving Title
VI or ACA Section 1557 that are received by contractors shall be
sent to DHA OGC, 16401 East Centretech Parkway, Aurora, Colorado
80011-9066.
7.3 The
contractors shall comply with Section 504 of the Rehabilitation
Act of 1973 as amended, regarding qualified handicapped individuals.
Any discrimination complaints involving Section 504 that are received
by contractors shall be forwarded to DHA OGC within two working
days of receipt.