Acquisition, Protection, and Disclosure of Quality Improvement Organization Information

Scope and definitions.

This provision defines key terms and the scope of regulations governing the acquisition, protection, and disclosure of information by Quality Improvement Organizations.

Statutory bases for acquisition and maintenance of information.

This provision outlines the statutory requirements for QIOs to examine provider records and for health care providers to maintain evidence of medical necessity and quality of care.

Statutory bases for disclosure of information.

This provision specifies the statutory requirements for QIOs to exchange information with other entities and mandates the confidentiality of QIO information, with specific exceptions for fraud, public health, and licensing.

Procedures for disclosure by a QIO.

This provision outlines the procedural requirements for QIOs when disclosing information, including notice requirements, fees, and formatting standards.

Notice of disclosures made by a QIO.

This provision requires Quality Improvement Organizations to notify institutions at least 30 days before disclosing nonconfidential information and outlines notification requirements for confidential information.

Exceptions to QIO notice requirements.

This provision defines specific circumstances, such as imminent danger or fraud investigations, where the standard QIO notification requirements for information disclosure do not apply.

Limitations on redisclosure.

This provision restricts the further disclosure of confidential QIO information by persons or organizations that have obtained it, with specific exceptions for legal and administrative purposes.

Penalties for unauthorized disclosure.

This provision establishes criminal penalties, including fines and imprisonment, for the unauthorized disclosure of QIO information.

Applicability of other statutes and regulations.

This provision clarifies that federal regulations governing the confidentiality of alcohol and drug abuse patient records apply to QIO information.

QIO access to records and information of institutions and practitioners.

This provision authorizes Quality Improvement Organizations to access and obtain records pertinent to health care services furnished to Medicare patients.

QIO access to records and information of intermediaries and carriers.

This provision authorizes Quality Improvement Organizations to access and require copies of Medicare records held by intermediaries or carriers for review purposes.

QIO access to information collected for QIO purposes.

This provision requires institutions and practitioners to disclose to the QIO any information collected for QIO purposes, including quality review studies.

Limitation on data collection.

This provision mandates that QIOs collect only the information necessary to accomplish the purposes of Title XI Part B of the Act.

Requirements for maintaining confidentiality.

This provision outlines the responsibilities of QIOs to maintain the confidentiality of information, including physical security, training, and data purging requirements.

Notice to individuals and institutions under review.

The QIO must establish procedures to inform patients, practitioners, and institutions about the maintenance and disclosure of QIO information.

Information subject to disclosure.

The QIO must disclose specific nonconfidential information, including administrative procedures, aggregate statistical data, and quality review study summaries, upon request.

Optional disclosure of nonconfidential information.

A QIO may voluntarily disclose nonconfidential information to any person, agency, or organization, provided notification requirements are met.

Disclosure to the Department.

QIOs are required to disclose all requested information, including confidential and non-confidential data, to the Department of Health and Human Services or CMS.

Access to medical records for the monitoring of QIOs.

CMS or authorized monitors have the right to access and copy medical records maintained by institutions or practitioners for Medicare patients to monitor QIO performance.

Disclosure of information about patients.

QIOs must disclose patient-identified information to the patient or their authorized representative upon written request, subject to specific exceptions.

Disclosure of information about practitioners, reviewers and institutions.

QIOs must disclose performance information to the identified practitioner or institution and may disclose specific data to regulatory agencies for fraud, abuse, or licensing investigations.

Verification and amendment of QIO information.

QIOs must verify the accuracy of information and allow individuals or institutions to request amendments to their records, including documenting refusals if the request is denied.

Disclosure necessary to perform review responsibilities.

QIOs must disclose information to internal staff, consultants, subcontractors, and other QIOs as necessary to fulfill their statutory review functions.

Disclosure to intermediaries and carriers.

QIOs must disclose information necessary for Medicare payment administration, including review determinations and medical records, to intermediaries and carriers.

Disclosure to Federal and State enforcement agencies responsible for the investigation or identification of fraud or abuse of the Medicare or Medicaid programs.

Quality Improvement Organizations must disclose confidential information to Federal and State enforcement agencies investigating Medicare or Medicaid fraud or abuse upon receipt of a valid written request.

Disclosure for other specified purposes.

Quality Improvement Organizations are required to disclose confidential information to licensing bodies and public health officials under specific conditions, while maintaining protections against civil subpoenas.

Disclosure of QIO deliberations and decisions.

Quality Improvement Organizations are restricted from disclosing internal deliberations except to specific federal oversight agencies, though they must disclose reasons for decisions upon request for beneficiary appeals.

Disclosure of quality review study information.

Quality Improvement Organizations must disclose quality review study information to authorized agencies, institutions, and practitioners under specific conditions while maintaining protections against civil discovery.

Disclosure of QIO interpretations on the quality of health care.

Quality Improvement Organizations may disclose public interpretations and generalizations regarding the quality of health care that identify specific institutions, subject to established notice procedures.

Disclosure of sanction reports.

Quality Improvement Organizations are required to disclose sanction reports to the Office of the Inspector General and CMS, and may disclose them to other enforcement agencies.

QIO involvement in shared health data systems.

Quality Improvement Organizations may participate in shared health data systems only if the system's disclosure rules do not conflict with federal QIO confidentiality requirements.

Access to QIO data and information.

CMS may approve researcher access to confidential QIO information not otherwise authorized by existing regulations.

Beneficiary authorization of use of confidential information.

Quality Improvement Organizations must obtain valid, written beneficiary authorization before using or disclosing confidential information, unless otherwise permitted by law.