Table of Contents
Purpose
The purpose of these policies and procedures is to provide formal guidance to employees of the Health Care Authority (HCA) and EASI Gov, Inc. with regard to the receiving, handling, and disseminating of protected healthcare information (PHI) as it pertains to the administration of health plans.
The primary guiding factor behind these policies and procedures is to ensure that PHI is only used and disseminated appropriately. Specifically, that PHI be used only in the activities related to the administration of the health plans and NOT be disseminated such that the information may be used for other types of personnel decisions such as promotions, terminations, etc. All policies and procedures of HCA and EASI Gov, Inc. are public documents and are to be placed on permanent file with HCA and EASI Gov, Inc. and made available upon request.
Scope
These guidelines apply to all HCA and EASI Gov, Inc. and/or employees engaged in health plan administration who, through the course of their normal duties, may come into contact with PHI.
PHI is defined by Federal Law to be individually identifiable health information transmitted or maintained by a covered entity, regardless of form. As this pertains to HCA and EASI Gov, Inc., PHI will be in the form of employee appeals regarding decisions made by our health plan vendors, or PHI from the vendors themselves. Not all appeals contained PHI, though.
Important: These guidelines apply to benefit plan administrators but there are exceptions for worker's compensation or disability programs, which are not subject to the same requirements.
Identification of Affected Workforce Members
All employees, be they full or part-time, temporary or permanent, of the State Health Benefits (SHB) may come into contact with PHI and are, therefore, subject to these policies and procedures.
The Deputy Director of HCA, by means of his/her oversight of SHB, may come into contact with PHI and is, therefore, subject to these policies and procedures.
The Director of HCA, by means of his/her oversight of the Authority, may come into contact with PHI related to health plan administration and is, therefore, subject to these policies and procedures.
The Cabinet Secretary of the Health Care Authority, by means of his/her oversight of the Department, may come into contact with PHI related to health plan administration and is, therefore, subject to these policies and procedures.
Any other employee of the State of New Mexico who comes into contact with PHI designated for the use of health plan administration is subject to these policies and procedures.
Acceptance of PHI
PHI, according to law, may be received in any form. This includes paper, emails, faxes, and conversationally (oral).
The source of PHI may only be (1) a plan member seeking assistance in obtaining payment from a health plan for a service or supply or (2) from a business associate assisting HCA in the guidelines. Any such business associates will have in place contractual requirements mandating compliance to the same HIPAA regulations.
Any actionable request must be received in a written format. In other words, if PHI is received orally, it must be followed up with written documentation for any action to be taken.
Upon acceptance, all material containing PHI will be documented in a central location and assigned to a specific individual for disposition.
Handling PHI
PHI, if provided by the member, may be used by the appropriate personnel to assist in making a payment determination.
PHI may not be used in any way to assist in making an eligibility determination. Eligibility requirements have been established without regard to an individual's health status.
Additional PHI may not be requested by HCA from any source other than the member.
Dissemination and/or Disclosure of PHI
PHI shall not be disseminated to other areas of State or Local Government except as provided in the following Exceptions paragraph.
PHI shall not be disseminated to entities outside of State or Local Government except as provided in the following Exceptions paragraph.
PHI shall only be disseminated beyond the assigned individual within HCA in order to facilitate health plan administration. Such dissemination shall only be with and limited to the minimum number of individuals necessary for plan administration.
No PHI shall be disseminated on a routine or recurring basis except as provided in the following Exceptions paragraph.
Members may request to view their own PHI. As outlined, PHI will only be on file at HCA if sent by the member. PHI will only be provided after due diligence is applied to determine requestor's identity. All other requests for PHI will be denied except as provided in the following Exceptions paragraph.
Exceptions to PHI Dissemination and/or Disclosure
PHI may be disseminated without member consent in the following circumstances:
To facilitate payment with a health plan: If an appeal is received and it is clear that information is received by HCA which was not available to the determining health plan, this information may be disseminated to the health plan for their review and possible payment of denied services. If, after review of an appeal, HCA determines that a service or product should be paid for by the plan, PHI should not be disseminated to the health plan. Once in health plan possession, PHI is subject to published health plan privacy guidelines.
During a health emergency or when you are incapacitated: We will use our professional judgment to decide if sharing your health information is in your best interest.
Required by law: We will disseminate PHI when required by federal, state or local law.
Law enforcement requests: If law enforcement officials ask, PHI may be disseminated under the following circumstances: to identify or locate a fugitive or missing person, to disclose information about a death HCA believes may be the result of a crime, to disclose information HCA believes may be related to a crime on State of New Mexico property, or as required by a court order, subpoena, warrant, summons or other legal request.
PHI may be disclosed if such disclosure would prevent or lessen a serious and immediate threat to the health or safety of any person or the general public.
PHI may be disclosed with federal officials for national security purposes as authorized by law.
PHI may be disclosed as required by worker's compensation laws.
PHI may be disclosed to the Secretary of the U.S. Department of Health and Human Services (HHS) when HHS requests the health information to determine if we are following privacy law.
Providing Notice of Privacy Practices
Notice of privacy practices shall be communicated to all State Employees upon implementation.
Notice of privacy practices shall include all employee rights afforded under these policies and procedures.
Notice of privacy practices shall be communicated no less than annually thereafter.