| (a) An IRO must preserve the confidentiality of individual
medical records, personal information, and any proprietary information
provided by payors. Personal information includes name, address, telephone
number, social security number, and financial information.
(b) An IRO is prohibited from publicly disclosing patient
information protected by the Health Insurance Portability and Accountability
Act of 1996 (42 U.S.C. Section 1320d et seq.), or transmitting the
information to a subcontractor involved in the independent review
process that has not signed an agreement similar to the business associate
agreement required by regulations adopted under the Health Insurance
Portability and Accountability Act of 1996.
(c) An IRO may not disclose or publish individual medical
records or other confidential information about a patient without
the prior written consent of the patient or as otherwise provided
by law, including the Health Insurance Portability and Accountability
Act of 1996, if applicable. An IRO may provide confidential information
to a provider who is under contract with the IRO for the sole purpose
of performing or assisting with independent review. Information provided
to a provider who is under contract to perform a review must remain
confidential.
(d) The IRO may not publish data identifying a particular
payor, physician, or provider, including any quality review studies
or performance tracking data, without prior written consent of the
involved payor, physician, or provider. This prohibition does not
apply to internal systems or reports used by the IRO.
(e) All payor, patient, physician, and provider data
must be maintained by the IRO in a confidential manner that prevents
unauthorized disclosure to third parties. Nothing in this chapter
allows an IRO to take actions that violate state or federal statutes
or regulations concerning confidentiality of patient records.
(f) To ensure confidentiality, an IRO must, when contacting
a utilization review agent, a physician's or provider's office, or
a hospital, provide its certificate of registration number and the
caller's name and professional qualifications to the provider or the
provider's named independent review representative.
(g) The IRO's procedures must specify that specific
information exchanged for the purpose of conducting a review will
be considered confidential, be used by the IRO solely for the purposes
of independent review, and may be shared by the IRO only with a provider
who is under contract with the IRO to perform an independent review.
The IRO's plan must specify the procedures in place to ensure confidentiality
and must acknowledge that the IRO agrees to abide by any federal and
state laws governing the issue of confidentiality. Summary data that
does not provide sufficient information to allow identification of
individual patients, providers, payors, or utilization review agents
is not confidential.
(h) Medical records and patient-specific information
must be maintained by the IRO in a secure area with access limited
to essential personnel only. IROs must transmit and store records
in compliance with the Health Insurance Portability and Accountability
Act of 1996.
(i) Information generated and obtained by the IRO in
the course of the review must be retained for at least four years.
This requirement is not negated by the suspension or surrender of
the IRO's certificate of registration or the failure to renew the
certificate of registration.
(j) Destruction of documents in the custody of the
IRO that contain confidential patient information or payor, physician,
or provider financial data must be by a method that ensures complete
destruction of the information when the organization determines that
the information is no longer needed.
|
| Source Note: The provisions of this §12.208 adopted to be effective November 26, 1997, 22 TexReg 11363; amended to be effective December 26, 2010, 35 TexReg 11281; amended to be effective July 7, 2015, 40 TexReg 2538 |
