2.0 The Managed Care Support Contractors
(MCSCs), Designated Providers (DPs), and the TRICARE Medicare Eligible
Program (TMEP) contractor shall transmit paper or electronic copies
of the medical record and all case documentation to the TQMC contractor
for each case or category of case requested by the TQMC contractor.
2.1 The estimated number of medical
records (including inpatient and outpatient care) to be selected
will vary depending upon the contractor’s geographic area of responsibility
involved and the TQMC’s selection criteria.
2.2 The estimated quantities per
geographic area of responsibility could range from up to 5,400 to
11,340 records per year for the MCSCs, up to 120 to 360 records
per year for the DPs, and up to 1,200 to 2,400 records per year
for TMEP. Records will be requested periodically throughout the
year.
3.0 The MCSC, DP, and TMEP contractor
shall transmit 95% of the requested records to the TQMC contractor within
45 calendar days and 98% within 60 calendar days from the date the
MCSC, DP, and TMEP contractor receive the request for records from
the TQMC contractor.
3.1 The MCSC, DP, and TMEP contractor’s
records shall include the complete medical record, the MCSC’s, DP’s, and
TMEP’s utilization review decision, rationale for that decision,
and quality of care determinations.
3.2 The MCSC,
DP, and TMEP contractor shall submit a monthly Contractor Records
Accountability Report. For reporting requirements, see DD Form 1423,
Contract Data Requirements List (CDRL), located in Section J of
the applicable contract.
3.2.1 The MCSC,
DP, and TMEP shall follow
Chapter 2, Section 6,
Records Management for all transition and transfer of records.
3.2.2 Records may be transmitted
through secure electronic means and stored with the TQMC contractor
for review in adherence with the requirements specified in
Chapter
9, Records Management.
3.2.3 Adherence
to these procedures is essential for compliance with the Privacy
Act of 1974 (5 United States Code (USC) 552a), the Department of
Defense (DoD) Privacy Program (DoD 5400.11-R), the Health Insurance Portability
and Accountability Act (HIPAA) Privacy and Security Rules (45 Code
of Federal Regulations (CFR) Parts 160 and 164), the DoD Health
Information Privacy Regulation (DoD 6025.18-R), the DoD Health Information Security
Regulation (DoD 8580.02-R), and other federal laws protecting the
privacy and security of Personally Identifiable Information (PII),
including health information.
3.2.4 The TQMC
contractor shall acknowledge receipt of electronic records from
the MCSC, DP, and TMEP contractor by return email.
3.2.5 The MCSC, DP, or TMEP contractor
shall follow-up with the TQMC contractor if the acknowledgment email
is not received within one business day after the electronic records
were transmitted, or if it is determined that the records were not
transmitted with the required security safeguards to determine the
status and whether a possible breach may have occurred.
3.2.6 The MCSC, DP, or TMEP contractor
shall notify, within 24 hours, the Defense Health Agency (DHA) Privacy
Office and carry out the other breach response requirements of
Chapter 1, Section 5.
3.3 The contractor shall adhere
to procedures specified in
paragraphs 3.2.1 through
3.9.3 to
transfer paper records.
3.3.1 The records
shall be packaged in boxes containing a single month of records
and a Box Inventory Document (see
Figure 7.7-1) stating the number of patient
records contained therein and identifying each record by patient
name and DHA Internal Control Number (ICN), which should be clearly
shown on each patient’s record.
3.3.2 The Box
Inventory Document (in both paper and electronic versions) contains
PII, and shall be protected from unauthorized use and disclosure
in the same manner as the patient records themselves.
3.3.3 The MCSCs, DPs, or TMEP contractor
shall notify the designated Point Of Contact (POC) at the TQMC contractor,
via email, each day that a box or boxes have shipped, stating the
number of boxes (with tracking numbers) in that day’s shipment (see
Figure 7.7-2).
3.3.4 The MCSCs, DPs, or TMEP contractor
shall track the shipment, including delivery, using the shipping vendor’s
tracking method and retain documentation of such.
3.4 The TQMC contractor, using
the MCSC, DP, or TMEP Box Inventory Document(s), shall match the
number of boxes received with the corresponding email shipment notification
within one business day of receipt of a shipment from a contractor.
3.4.1 The contractor and the TQMC
contractor, if any boxes are missing, shall investigate and no later
than 24 hours after finding that a box is missing, initiate breach
response in accordance with
Chapter 1, Section 5.
3.4.2 The TQMC contractor shall,
if no boxes are missing and for all boxes received, confirm the
number of records in each box and a match between each patient record
and ICN for the patient names listed on the Box Inventory Document
no later than five business days after receipt of the shipment.
3.4.3 The TQMC contractor shall send
an email back to the MCSC, DP or TMEP contractor confirming the number
of boxes, number of records in each box and match of all ICNs.
3.4.4 Upon receipt of the TQMC contractor’s
confirmation email, no further action is required by the MCSC, DP,
or TMEP contractor.
3.5 The TQMC
contractor, using the Box Inventory Document, shall identify the
following:
• A count discrepancy in either
the number of boxes or number of charts in each box;
• Absence of a record; or
• A mismatch of the record with
the ICN.
3.6 The TQMC
contractor shall notify the MCSC, DP, or TMEP contractor by email
of the discrepancy including details of the discrepancy no later
than five business days from receipt of shipment if the TQMC contractor concludes
that records are or may be missing.
3.6.1 The MCSC,
DP, or TMEP contractor shall investigate the discrepancy, take appropriate
steps and notifications, and be in telephone, fax and email communication
to resolve the potential violations of applicable law as soon as
possible after notification of the count discrepancy.
3.6.2 The MCSC, DP, or TMEP contractor
shall initiate breach response in accordance with
Chapter 1, Section 5 if the missing records
are not promptly located within 24 hours of receiving the notice
from the TQMC contractor.
3.7 The TQMC
contractor shall send a “non-receipt” email to the MCSC, DP, or
TMEP contractor no later than five business days if no shipment
was received from the MCSC, DP, or TMEP contractor following notification
that a shipment was sent.
3.7.1 The MCSC,
DP, or TMEP contractor shall immediately track the shipment and
notify the TQMC contractor by email of the status of the shipment
upon receipt of a “non-receipt of a shipment.”
3.7.2 The MCSC, DP, or TMEP contractor
shall be in telephone, fax or email communication with the TQMC contractor
to determine the appropriate steps and notifications, based upon
the investigation to resolve the potential HIPAA violation.
3.8 The MCSC, DP, or TMEP contractor
shall notify the DHA Clinical Operations Division (COD), and the
DHA Privacy Office within two hours. By close of business (COB)
on the same day, all parties are required to receive notice under
the breach notification provisions of
Chapter 1, Section 5 and
applicable law.
3.9 If the
MCSC, DP, or TMEP contractor does not receive an email from the
TQMC contractor indicating either confirmation of receipt, confirmation
of receipt with discrepancy, or a non-receipt of shipment, by the
morning of the sixth business day after shipment, the MCSC, DP,
or TMEP contractor shall notify the TQMC contractor, the DHA COD,
and the DHA Privacy Office.
3.9.1 The notifications
shall provide available details about the shipment and the circumstances.
3.9.2 The TQMC contractor shall verify
that these notifications are sent, and shall provide the notifications itself
if the sender of the records fails to do so.
3.9.3 The MCSC, DP, or TMEP contractor
shall comply with breach response requirements of
Chapter 1, Section 5 and applicable law.