2110  Confidential Nature of the Case Record

Information collected in determining initial or continuing eligibility is confidential. The restriction on disclosing information is limited to information about individual members. The Department of Aging and Disability Services (DADS), the Health and Human Services Commission (HHSC) and the managed care organization (MCO) may disclose general information about policies, procedures or other methods of determining eligibility, and any other information that is not about or does not specifically identify a member.

A member may review all information in the case record and in DADS, HHSC or MCO handbooks that contributed to the decision about eligibility.

2111  Establishing Identity for Contact Outside the Interview Process

Keep all information that the Department of Aging and Disability Services (DADS), the Health and Human Services Commission (HHSC) and the managed care organization (MCO) have about a member or any individual on the member's case confidential. Confidential information includes, but is not limited to, individually identifiable health information.

Before discussing or releasing information about a member or any individual on the member's case, take steps to be reasonably sure the individual receiving the confidential information is either the member or an individual the member has authorized to receive confidential information (for example, an attorney or personal representative).

2111.1  Telephone Contact

Establish the identity of an individual who identifies himself as a member by using the individual’s knowledge of the member's:

• Social Security number (SSN);
• date of birth; or
• other identifying information.

Establish the identity of a personal representative by using the individual's knowledge of the member's:

• SSN;
• date of birth;
• other identifying information; or
• knowledge of the same information about the member's representative.

Establish the identity of attorneys or legal representatives by asking for the individual to provide Form 1826-D, Case Information Release, completed and signed by the member.

Department of Aging and Disability Services (DADS) staff must use established regional procedures to confirm the identity of legislators or their staff. The managed care organization (MCO) must use established Health and Human Services Commission (HHSC) procedures to confirm the identity of legislators or their staff.

2111.2  In-Person Contact

Establish the identity of the individual who presents himself as a member or member's representative at a Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) or managed care organization (MCO) office by using sources such as:

• driver license;
• date of birth;
• SSN; or
• other identifying information.

Establish the identity of other DADS/HHSC/MCO staff, federal agency staff, researchers or contractors by using sources such as:

• employee badge; or
• government-issued identification card with a photograph.

Identify the need for other DADS/HHSC/MCO staff, federal staff, research staff or contractors to access confidential information through:

• official correspondence or a telephone call from a state or regional office;
• contact with a DADS regional attorney; or
• contact with an HHSC attorney.

Contact appropriate regional or state office staff when federal agency staff, contractors, researchers or other DADS/HHSC/MCO staff come to the office without prior notification or adequate identification and request permission to access records.

2111.3  Verification and Documentation

If disclosing individually identifiable health information, document how the identity of the person was verified when contact is outside the interview.

Verify the identity of the person who requests disclosure of individually identifiable health information using sources such as:

• valid driver license or Department of Public Safety identification card;
• birth certificate;
• hospital or birth record;
• adoption papers or records;
• work or school identification card;
• voter registration card;
• wage stubs; and
• U.S. passport.

2112  Custody of Records

Records must be safeguarded. Use reasonable diligence to protect and preserve records and to prevent disclosure of the information they contain, except as provided by Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and managed care organization (MCO) regulations.

Reasonable diligence for employees responsible for records includes keeping records:

• in a locked office when the building is closed;
• properly filed during office hours; and
• in the office at all times, except when authorized to remove or transfer them.

2113  Disposal of Records

To dispose of documents with member-specific information, Department of Aging and Disability Services (DADS) staff must follow procedures for destruction of confidential data in the Operational Handbook. Managed care organizations (MCOs) must follow procedures contained in the Uniform Managed Care Contract.

2114  When and What Information May Be Disclosed

Reasonable efforts must be made to limit the use, request or disclosure of individually identifiable health information to the minimum necessary to determine eligibility and operate the program. The disclosure of individual medical information from Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and managed care organization (MCO) records must be limited to the minimum necessary to accomplish the requested disclosure. For example, if a member authorizes release of income verification, including disability income, do not release related case medical information unless specifically authorized by the member.

Give member addresses or other case information only to a person who has written permission from the member to obtain the information. The member authorizes the release of information by completing and signing:

• Form 1826-D, Case Information Release; or
• a document containing all of the following information:
  • the applicant's/member's:
    • full name (including middle initial) and Medicaid identification number; or
    • full name (including middle initial) and either date of birth or SSN;
  • a description of the information to be released. Note: If a general release is authorized, provide the information that can be disclosed to the member. Withhold confidential information from the case record, such as names of persons who disclosed information about the household without the household's knowledge, and the nature of pending criminal prosecution;
  • a statement specifically authorizing DADS, HHSC or the MCO to release the information;
  • the name of the person or agency to whom the information will be released;
  • the purpose of the release;
  • an expiration event that is related to the member, the purpose of the release or an expiration date of the release;
  • a statement about whether refusal to sign the release affects eligibility for delivery of services;
  • a statement describing the applicant's or member's right to revoke the authorization to release information;
  • the date the document is signed; and
  • the signature of the applicant or member.

Note: If the case information to be released includes individually identifiable health information, the document must also tell the applicant or member that information released under the document may no longer be private, and may be released further by the person receiving the information.

Occasionally requests for information from the case records of deceased members are received. In these instances, protect the confidentiality of the former members and their survivors.

The Office of the General Counsel at DADS and HHSC handles questions about the release of information under the Open Records Act. All questions and problems encountered by individuals concerning release of information should be referred to these offices. DADS staff should direct their questions and problems to the regional attorney. MCO staff should contact HHSC’s Managed Care Operations.

2115  Confidential Nature of Medical Information — HIPAA

Health Insurance Portability and Accountability Act (HIPAA) is a federal law that sets additional standards to protect the confidentiality of individually identifiable health information. Individually identifiable health information is information that identifies or could be used to identify an individual and that relates to the:

• past, present or future physical or mental health or condition of the individual;
• provision of health care to the individual; or
• past, present or future payment for the provision of health care to the individual.

2116  Privacy Notice

Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and managed care organization (MCO) staff must send each member Form 0401, HIPAA – Privacy Notice, upon certification. This form tells the member about:

• his/her privacy rights;
• the duties of DADS, HHSC and the MCO to protect health information; and
• how DADS, HHSC and the MCO may use or disclose health information without his/her authorization. (Examples of use or disclosure include health care operations (for example, Medicaid), public health purposes, reporting victims of abuse, law enforcement purposes, sharing with DADS/HHSC/MCO contractors and coordinating government programs that provide benefits.)

2117  Member Authorization

The member may authorize the release of health information from Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and managed care organization (MCO) records by using a valid authorization form. Form 1826-D, Case Information Release, includes all the authorization elements required by Health Insurance Portability and Accountability Act (HIPPA) privacy regulations.

2118  Minimum Necessary Information Release

Reasonable efforts must be made to limit the use, request or disclosure of individually identifiable health information to the minimum necessary to determine eligibility and operate the program. The disclosure of individual medical information from Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and managed care organization (MCO) records must be limited to the minimum necessary to accomplish the requested disclosure. For example, if a member authorizes release of income verification, including disability income, do not release related case medical information unless specifically authorized by the member.

2119  Personal Representatives

Only the member's personal representative can exercise the member's rights with respect to individually identifiable health information. Therefore, only a member's personal representative may authorize the use or disclosure of individually identifiable health information or obtain individually identifiable health information on behalf of a member. Exception: Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and the managed care organization (MCO) are not required to disclose the information to the personal representative if the member is subjected to domestic violence, abuse or neglect by the personal representative. Consult appropriate legal counsel, as described in Section 2114, When and What Information May Be Disclosed, if it is believed that health information should not be released to the personal representative.

Note: A responsible party is not automatically a personal representative.

2119.1  Adults and Emancipated Minors

If the member is an adult or emancipated minor, including married minors, the member's personal representative is a person who has the authority to make health care decisions about the member and includes a:

• person the member has appointed under a medical power of attorney, a durable power of attorney with the authority to make health care decisions, or a power of attorney with the authority to make health care decisions;
• court-appointed guardian for the member; or
• person designated by law to make health care decisions when the member is in a hospital or nursing home and is incapacitated or mentally or physically incapable of communication. Consult appropriate legal counsel, as described in Section 2114, When and What Information May Be Disclosed, for approval.

2119.2  Unemancipated Minors

A parent is the personal representative for a minor child except when:

• the minor child can consent to medical treatment by himself/herself. Under these circumstances, do not disclose to a parent information about the medical treatment to which the minor child can consent. A minor child can consent to medical treatment by himself/herself when the:
  • minor is on active duty with the U.S. military;
  • minor is age 16 or older, lives separately from the parents and manages his/her own financial affairs;
  • consent involves diagnosis and treatment of disease that must be reported to the local health officer or the Texas Department of State Health Services (DSHS);
  • minor is unmarried and pregnant and the treatment (other than abortion) relates to the pregnancy;
  • minor is age 16 years or older and the consent involves examination and treatment for drug or chemical addiction, dependency or use at a treatment facility licensed by DSHS;
  • consent involves examination and treatment for drug or chemical addiction, dependency or use by a physician or counselor at a location other than a treatment facility licensed by the Texas Department of State Health Services;
  • minor is unmarried, is the parent of a child, has actual custody of the child and consents to treatment for the child; or
  • consent involves suicide prevention or sexual, physical or emotional abuse.
• a court is making health care decisions for the minor child or has given the authority to make health care decisions for the minor child to an adult other than a parent or to the minor child. Under these circumstances, do not disclose to a parent information about health care decisions not made by the parent.

2119.3  Deceased Individuals

The personal representative for a deceased member is an executor, administrator or other person with authority to act on behalf of the member or the member's estate. These include:

• an executor, including an independent executor;
• an administrator, including a temporary administrator;
• a surviving spouse;
• a child;
• a parent; and
• an heir.

Consult appropriate legal counsel, as described in Section 2114, When and What Information May Be Disclosed, if you have questions about whether a particular person is the personal representative of an applicant or member.

2120  Confidential Information on Notifications

The Department of Aging and Disability Services (DADS) is committed to protecting all confidential information supplied by the applicant or individual during the eligibility determination process. This includes inclusion of confidential information by DADS staff to third parties who receive a copy of a notification of eligibility form.

Staff must ensure they do not include confidential information on the eligibility notice that should not be shared with the service provider or another third party. For example:

• Notification is received from Medicaid for the Elderly and People with Disabilities that the member has lost Medicaid because his income of $2,892 exceeds the eligibility limit of $2,022. It is a violation of confidentiality to record on Form 2065-C, Notification of Ineligibility or Suspension of Waiver Services, "Your income of $2,892 exceeds the eligibility limit of $2,022." The comment should simply state, "You are no longer eligible for Medicaid."
• Another applicant is being denied HCBS STAR+PLUS Waiver (SPW) services because the presence of weapons in his home presents a hazard to service providers. It is a violation of confidentiality to record on Form 2065-C, "The presence of weapons in your home presents a hazard to service providers." The comment should simply state, "Your services are being denied due to hazardous conditions in your home."

In the examples above, revealing specifics of the individual's income or the condition of his home environment is a violation of his right to confidentiality. In all cases, DADS staff must assess any information provided by the individual to determine if its release would be a confidentiality violation.

2130  Correcting Information

A member has a right to correct any information that the Department of Aging and Disability Services (DADS), the Health and Human Services Commission (HHSC) or the managed care organization (MCO) has about the member and any other individual on the member's case.

A request for correction must be in writing and:

• identify the individual asking for the correction;
• identify the disputed information about the individual;
• state why the information is wrong;
• include any proof that shows the information is wrong;
• state what correction is requested; and
• include a return address, telephone number or email address at which DADS, HHSC or the MCO can contact the individual.

If DADS, HHSC or the MCO agrees to change individually identifiable health information, the corrected information is added to the case record, but the incorrect information remains in the file with a note that the information was amended per the member's request.

Notify the member in writing within 60 days (using current agency letterhead) that the information is corrected, or will not be corrected, and the reason. Inform the member if DADS/HHSC/MCO needs to extend the 60-day period by an additional 30 days to complete the correction process or obtain additional information.

If DADS, HHSC or the MCO makes a correction to individually identifiable health information, ask the member for permission before sharing with third parties. The agency will make a reasonable effort to share the correct information with persons who received the incorrect information if they may have relied or could rely on it to the disadvantage of the member. DADS staff must follow regional procedures to contact the DADS privacy officer for a record of disclosures. MCOs must follow HHSC procedures as stated in the Uniform Managed Care Contract.

Note: Do not follow above procedures when the accuracy of information provided by a member is determined by another review process, such as a:

• fair hearing;
• civil rights hearing; or
• other appeal process.

The decision in that review process is the decision on the request to correct information.

2140  Communication with the Managed Care Organization

In order to comply with the Health Insurance Portability and Accountability Act (HIPAA), it is imperative for a member's individually identifiable health information to be shared only with his or her selected managed care organization (MCO). This makes it crucial that when documents containing member information are posted in the incorrect MCO folder in TxMedCentral, they be corrected immediately upon realization an error was made.

Send notification of all posting errors to Arron Michaels (arron.michaels@dads.state.tx.us) with a copy to Alfredo Cervantes, Jr. (alfredo.cervantesjr@dads.state.tx.us). Include the document identifying information, the name of the folder in which it was erroneously posted and the name of the folder into which it should have been posted. Include the time the correction was made.

Example: Posted 9F_2067_123456789_ABCD_2S.doc in SUPSPW at 8:54 a.m. on December 20. Should have been posted to MOLSPW. Corrected at 9:22 a.m. December 20.

All emails containing member information must be sent using encryption software. No individually identifiable information may appear in the subject line.

See also:

• Section 2115, Confidential Nature of Medical Information – HIPAA; and
• Section 5100, TxMedCentral.

2150  Alternate Means of Communication

The Department of Aging and Disability Services (DADS), Health and Human Services Commission (HHSC) and the managed care organization (MCO) must accommodate a member's reasonable requests to receive communications by alternative means or at alternate locations.

The member must specify in writing the alternate mailing address or means of contact, and include a statement that using the home mailing address or normal means of contact could endanger the member.

2210  Acceptable Documentation for Both Citizenship and Identity

2211  Supplemental Security Income Recipients

The State Data Exchange (SDX) contains the needed information to verify citizenship. For any active Supplemental Security Income (SSI) recipient, Medicaid for the Elderly and People with Disabilities (MEPD) staff are able to use the SDX as verification for both citizenship and identity. For any denied SSI recipient, the SDX can be used as a valid verification source of both citizenship and identity when the denial is for any reason other than citizenship. The SDX printout shows action code N13 if the denial is for citizenship.

2212  Medicare Recipients

Active Medicare recipients are exempt from the requirement to provide evidence of citizenship and identity. The Social Security Administration (SSA) documents citizenship and identity for Medicare recipients.

For any individual entitled to or enrolled in Medicare Part A or B and subsequently denied Medicare, use the State On-Line Query (SOLQ) system or Wire Third Party Query (WTPY) system as documentation of both citizenship and identity when the denial is for any reason other than citizenship. If there is an end date listed for Medicare, the individual must provide documentation on the loss of Medicare.

2213  All Other Individuals

The primary documents that may be accepted as proof of both identity and citizenship include:

• U.S. passport;
• Certificate of Naturalization (N-550 or N-570); or
• Certificate of U.S. Citizenship (N-560 or N-561).

If an individual does not provide one of these primary documents that establish both U.S. citizenship and identity, the individual must provide two documents:

• one document that establishes U.S. citizenship; and
• one document that establishes identity.

See Evidence of Identity below for a list of documents that are acceptable.

Documents that establish citizenship are divided into second, third and fourth levels based on the reliability of the evidence.

Begin with the second level of evidence of citizenship and continue through the levels to locate the best available documentation.

In the hierarchy of approved documentation sources, some documents listed to verify citizenship are also acceptable to verify identity. When using the hierarchy of approved documentation sources, the same document cannot be the source to verify both citizenship and identity.

If an individual is unable to provide any other documentary evidence of citizenship, an affidavit signed under penalty of perjury is only accepted as a last resort. Medicaid for the Elderly and People with Disabilities (MEPD) staff are required to document the reason another source is not available to verify citizenship. If managed care organization (MCO) or STAR+PLUS Support Unit (SPSU) staff are provided an affidavit, ensure the reason the applicant or recipient is unable to produce documentary evidence of citizenship and identity is documented on the affidavit. If the affidavit does not contain this information, the reason another source is not available is documented and transmitted to MEPD staff on Form H1746-A, MEPD Referral Cover Sheet, along with the affidavit. The copies of the affidavit form are to be made available in all Health and Human Services Commission (HHSC) benefits offices. Form H1097, Affidavit for Citizenship/Identity, and Form H1097-S (Spanish), also may be used.

2220  Reserved

2230  Member Rights and Responsibilities

2231  Notifications

2231.1  SPSU Notification Requirements

The STAR+PLUS Support Unit (SPSU) is responsible for preparing and sending notifications to the applicant or member advising of actions taken regarding services and the right to a fair hearing. Form 2065-D, Notification of STAR+PLUS Program Services, is the legal notice sent to an applicant/member of the actions taken regarding STAR+PLUS Waiver services. The form must be completed in plain language that can be understood by the applicant/member. The language preference of the member must be considered.

The applicant or member must be notified on Form 2065-D within two business days of the date a case is certified. The form also includes information on the individual's room and board charges and copayment, if applicable.

Form 2065-D is also used to notify an applicant who is denied or a member whose services are terminated. The SPSU must notify the applicant on Form 2065-D of the denial of application within two business days of the decision. See also Section 3630, Denial/Termination Procedures.

Once it is determined that a case action must be taken, Form 2065-D must be prepared and mailed to the member the same date the form is signed. Notification forms must be posted to the managed care organization's XXXSPW folder using the correct naming convention in TxMedCentral on the case action date. The SPSU coordinator's signature date on Form 2065-D is the case action date.

2231.2  MCO Notification Requirements

The managed care organization (MCO) is responsible for notifying the member when a service is either denied or reduced. This is considered an adverse action and the member has a right to appeal. Appeal rights of STAR+PLUS members are in the Uniform Managed Care Manual, which can be found at: www.hhsc.state.tx.us/medicaid/UMCM/Chp3/3_4.pdf.

2232  Notifications with MEPD Involvement

Some actions are based on decisions related to Medicaid financial eligibility determined by Medicaid for the Elderly and People with Disabilities (MEPD) staff. The STAR+PLUS Support Unit (SPSU) must coordinate changes or the denial of waiver services with Medicaid denial decisions made by the MEPD specialist.

Although the MEPD specialist is required to notify the applicant/member of all Medicaid eligibility decisions, the SPSU is required to send the HCBS STAR+PLUS Waiver (SPW) applicant/member the notification of denial of waiver services on Form 2065-D, Notification of STAR+PLUS Program Services. SPSU staff also send the MEPD specialist a copy of Form 2065-D at initial certification and denial for case actions that involve Medicaid eligibility.

2233  Rights and Responsibilities Reference

Member rights and responsibilities are included in the Member Handbook. The required critical elements for member handbooks can be found at:

www.hhsc.state.tx.us/medicaid/UMCM/Chp3/3_4.pdf.

The Member Handbook must be provided to the member at application. This document is shared in the language preference expressed by the applicant/member.