Page 19

Title 8: Medicaid Page 17 Iowa Department of Health and Human Services Employees’ Manual Chapter A: Administration Department Responsibilities Revised January 13, 2023 Confidentiality Department Responsibilities The Department has general administrative responsibilities for: ▪ Maintaining confidentiality of Medicaid-related information ▪ Maintaining facility inspection reports ▪ Preventing discrimination by staff or vendors ▪ Providing notification of Department actions that meets legal requirements. Confidentiality Legal reference: 42 CFR 431.300-431.306, 45 CFR 160.102 and 164.504, Iowa Code Section 22.7(2) and 217.30, 441 IAC 9.1 through 9.15(3) Federal Medicaid regulations require that the Department release information about a Medicaid applicant or member only for purposes directly connected with the administration of the Medicaid program unless specifically authorized by the applicant or member. As a health plan, Medicaid is subject to the privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA) and corresponding federal regulations on the standards the Department must meet to protect the privacy of protected health information. Health care providers are also subject to HIPAA standards. Requests for information are made using: ▪ Form 470-3951 or 470-3951(S), Authorization to Obtain or Release Health Care Information, when the request is for a third party/service, such as a law firm. ▪ Form 470-3952, Request for Access to Health Information, when a client requests their own Personal Health Information (PHI). When either form is received at a DHS office, the worker must send it on to the DHS Security and Privacy Office to be reviewed. Legitimate requests for information will then be gathered from the Data Warehouse and provided to the requester via a File Transfer Protocol (FTP). See 1-C, Confidentiality and Records for additional information on the policies and responsibilities regarding confidentiality of protected health information.