2.0 The MCSCs, DPs, and
TMEP contractor
shall transmit 95% of the requested records to the TQMC contractor
within 45 calendar days and 98% within 60 calendar days from the
date the MCSCs, DPs, and
TMEP contractor
receive the request for records from the TQMC contractor. Records
to be transmitted shall include the complete medical record, the
MCSC’s, DP’s, and
TMEP’s utilization
review decision, rationale for that decision, and quality of care
determinations. The MCSC’s, DPs, and
TMEP contractor shall
forward a monthly Contractors Records Accountability Report. Details
for reporting are identified by DD Form 1423, Contract Data Requirements
List (CDRL), located in Section J of the applicable contract. Both
paper and electronic record transfer and storage are acceptable
to Defense Health Agency (DHA). Records may be transmitted through
secure electronic means and stored with the TQMC contractor for
review in adherence with the requirements specified in
Chapter
9, Records Management. Adherence to these procedures is
essential for compliance with the Privacy Act of 1974 (5 USC 552a),
the Department of Defense (DoD) Privacy Program (DoD 5400.11-R),
the Health Insurance Portability and Accountability Act (HIPAA)
Privacy and Security Rules (45 CFR Parts 160 and 164), the DoD Health
Information Privacy Regulation (DoD 6025.18-R), the DoD Health Information
Security Regulation (DoD 8580.02-R), and other federal laws protecting
the privacy and security of Personally Identifiable Information
(PII), including health information. Receipt of electronic records
shall be acknowledged by return e-mail from the TQMC contractor.
If the acknowledgment e-mail is not received within one business
day after the electronic records were transmitted, or if it is determined that
the records were not transmitted with the required security safeguards,
then the contractor (MCSC, DP,
TMEP)
shall immediately follow-up to determine the status and whether
a possible breach may have occurred. Unless it is determined that
no possible breach occurred, then, within 24 hours, the contractor
shall notify the DHA Privacy Office and carry out the other breach
response requirements of
Chapter 1, Section 5.
2.1 Transfer of paper records shall
adhere to procedures specified in
paragraphs 2.1.1 through
2.5.
2.1.1 The
records shall be packaged in boxes containing a single month of
records and a Box Inventory Document (see
Figure 7.3-1) stating the number
of patient records contained therein and identifying each record
by patient name and DHA Internal Control Number (ICN), which should
be clearly shown on each patient’s record. Because the Box Inventory
Document contains PII, that document (in both its paper and electronic
versions) shall be protected from unauthorized use and disclosure
in the same manner as the patient records themselves.
2.1.2 The MCSCs, DPs, or
TMEP shall
notify the designated Point Of Contact (POC) at the TQMC contractor,
via e-mail, each day that a box or boxes have shipped, stating the
number of boxes (with tracking numbers) in that day’s shipment (see
Figure 7.3-2).
The MCSCs, DPs, or
TMEP shall track
the shipment, including delivery, using the shipping vendor’s tracking
method and retain documentation of such.
2.2 Within one business day of
receipt of a shipment from a contractor (MCSC, DP, or
TMEP),
the TQMC contractor, using the MCSC, DP, or
TMEP Box
Inventory Document(s), the TQMC shall match the number of boxes
received with the corresponding e-mail shipment notification. If
any boxes are missing, the contractor and the TQMC shall immediately
investigate and, no later than 24 hours after finding that a box
is missing, initiate breach response in accordance with
Chapter 1, Section 5. If no boxes are missing
and for all boxes received, then the TQMC contractor shall confirm
the number of records in each box, and a match between each patient
record and ICN for the patient names listed on the Box Inventory
Document no later than the Close of Business (COB) on the fifth
business day after receipt of the shipment. By that date, the TQMC
contractor shall send an e-mail back to the MCSC/DP/
TMEP confirming
the number of boxes, number of records in each box and match of
all ICNs. Upon receipt of the TQMC contractor’s confirmation e-mail,
no further action is required by the MCSC, DP, or
TMEP.
2.3 Using the Box Inventory Document,
if the TQMC contractor identifies:
• A count discrepancy in either
the number of boxes or number of charts in each box;
• Absence of a record; or
• A mismatch of the record with
the ICN; and
• If the TQMC contractor concludes
that records are or may be missing, the TQMC contractor shall notify
by e-mail the MCSC, DP, or
TMEP of
the discrepancy including details of the discrepancy by COB of the
fifth business day from receipt of shipment. Upon notification of
the count discrepancy, the MCSC, DP, or
TMEP shall
investigate the discrepancy, take appropriate steps and notifications, and
be in telephone, fax and e-mail communication to resolve the potential
violations of applicable law as soon as possible. If the missing
records are not promptly located, then, within 24 hours of receiving
the notice from the TQMC, the contractor shall initiate breach response
in accordance with
Chapter 1, Section 5.
2.4 The TQMC contractor shall send
a “non-receipt” e-mail to the MCSC, Uniformed Services Family Health
Plan (USFHP) Designated Providers (DP) and Program Office (PO),
or TMEP POC by COB of the fifth business
day if no shipment was received from the MCSC, USFHP DP and PO,
or TMEP following notification that
a shipment was sent. Upon receipt of a “non-receipt of a shipment”
e-mail from the TQMC contractor POC, the MCSC, USFHP PO, or TMEP shall
immediately track the shipment and notify the TQMC contractor POC,
by e-mail, of the status of the shipment. The MCSC, USFHP DP and
PO, or TMEP shall be in telephone,
fax or e-mail communication with the TQMC contractor POC to determine the
appropriate steps and notifications, based upon the investigation
to resolve the potential HIPAA violation.
2.5 If
the MCSC, USFHP DP and PO, or
TMEP do
not receive an e-mail from the TQMC contractor indicating either
confirmation of receipt, confirmation of receipt with discrepancy,
or a non-receipt of shipment, by the morning of the sixth business
day after shipment, the MCSC, USFHP DP and PO, or
TMEP shall
notify, by COB on the same day, all parties required to receive
notice under the breach notification provisions of
Chapter 1, Section 5 and applicable law. These
parties include the DHA Clinical Operations Division (COD), USFHP
PO, and the DHA Privacy Office. The notifications shall provide
available details about the shipment and the circumstances. The
TQMC contractor shall verify that these notifications are sent,
and shall provide the notifications itself if the sender of the
records fails to do so. Thereafter, the MCSC, USFHP DP, or
TMEP shall
comply with breach response requirements of
Chapter 1, Section 5 and
applicable law.