Page 50

Administration, the disclosure of customer eligibility information is considered “routine.” Accordingly, the Administrator has authorized the Customer Service Unit (CSU) to provide qualified medical providers with current eligibility information for their patients. Except in exigent circumstances, providers should access eligibility information via the ACEDS system or through the Eligibility Verification System (EVS) dial-up. CSU staff should refer providers to these systems because of both (a) work volume issues and (b) only EVS maintains information on a customer’s Medicaid managed care status. In the event that the EVS system is unavailable and a qualified medical provider cannot access ACEDS, CSU staff may verify a customer’s eligibility status. Disclosures by CSU staff are strictly limited to Medicaid eligibility information. CSU staff may disclose only the customer’s eligibility information for the current period and recent past. CSU staff may never disclose any other customer information (e.g., date of birth, address, Social Security number, Medicare number, disability status, ACEDS program code, etc.) to any other provider or unauthorized requestor. In the event that CSU staff members need to disclose information to a qualified medical provider, they must first conclusively identify the caller or requestor. Once the requestor is positively identified, the SSR may provide eligibility information for a customer with the exact spelling provided by the medical provider. If the identity information (e.g., spelling of names, date of birth, or Social Security number) does not match the customer’s record, the CSU may not provide any information.

THE PRIVACY OF HEALTH INFORMATION 3.8

ALL Recent legislation known as the Health Insurance Portability and Accountability Act (HIPAA) establishes uniform standards for the protection of health information in the context of medical treatment, payment, and health care operations. With respect to HIPAA, the District regards IMA as a “hybrid” entity, one that is not a health care organization but nonetheless maintains some limited amount of health information. This “hybrid” designation does not in any way dilute the pre-existing confidentiality protections that IMA had in place under the more stringent Medicaid, Food Stamps, and TANF (formerly AFDC) statutes; rather, it reinforces those procedures that have been used within those programs. The relevance of HIPAA to IMA is largely limited to the protection of health information. The confidentiality policies detailed above satisfy HIPAA’s requirements around the disclosure of customer information. Described below are IMA’s policies regarding the other HIPAA components that are germane to this agency. Please note that the terms used below are borrowed from the HIPAA text; thus, some of the information may not immediately appear relevant to an organization such as IMA, which is only indirectly involved with the provision or payment of health care services. Amending Information on a Medical Examination Form 3.8.1

ALL Neither customers nor their authorized representatives may amend submitted Medical Examination Forms (DHS Form 856), which their clinician originally completed and they themselves provided to IMA. Likewise, IMA staff cannot amend in any way the Medical Examination Forms. Because IMA did not generate the information, the agency does not have the clinical or legal capacity to amend it. However, customers or their authorized representative(s) may request to append information to their Medical Examination Forms and/or case record. To do so, customers can submit supplemental information from a clinician or they can submit another Medical Examination Form. Alternatively, a