Page 1

Administrative Manual Section: General Administrative Procedures and Compliance; Chapter: Confidentiality& Privacy Policy Manual Number: 200.005 Legal Authority: 42 CFR 431.300; 42 CFR 431.305; 45 CFR 160-164 1. Policy Statement Federal and state law provides safeguards that restrict the use or disclosure of information concerning the individual to purposes directly connected with the administration of the Medicaid program. Such purposes include establishing eligibility, determining the amount of medical assistance, providing services to the individual and conducting or assisting in an investigation or prosecution of administrative, civil or criminal proceedings related to program administration. 2. The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act HIPAA and HITECH require TennCare to protect the privacy and security of any protected health information (PHI) received, used, stored and created in the course of business. PHI is any information about a past, present or future physical or medical condition, provision of health care or payment for health care that can be linked to a specific individual. This includes, but is not limited to, any part of a patient’s medical record or payment history. HIPAA privacy rules give patients privacy rights regarding access to and use of their medical records in all forms, including electronic and paper records, and oral communications. Privacy protections apply to all requests for information from outside sources, including governmental bodies and the courts, as well as law enforcement officials. Information subject to privacy protections includes but is not limited to: i. The individual’s name, date of birth, and address; ii. Unique identifiers such as Social Security or medical records numbers; iii. Agency evaluation of personal information; iv. Social and economic conditions or circumstances; v. Medical services provided; vi. Medical information including past history of disease or disability, current diagnosis, and future planned or needed care; vii. Any information received for the purpose of verifying income eligibility and amount of medical assistance payments. Income information received from the Social Security