FOIA

FOIA Costs and Contact Information

Freedom Of Information

The following pages describe the confidentiality and disclosure of information acquired and maintained by CMS, SSA, intermediaries, providers, and State agencies in the administration of the health insurance program. They comply with the statutes and regulations governing disclosure of information, specifically section 1106 of the Social Security Act, the Freedom of Information Act, the Public Information Regulation, and Social Security Regulations Nos. 1 and 22.

Many of the items commonly requested of Intermediaries through FOIA are currently available to the public from CMS in an electronic medium. Because the data is electronic, it allows the requester more complete data more flexibility in working with the data. Commonly requested items include Cost Report data (including Acute, SNF, HHA, and ESRD), Wage Index data, Enrollment data (by zipcode & county), Provider data, Utilization data, Beneficiary data, etc.. CMS has moved the HCRIS cost report files from a mainframe based, flat-file environment to one utilizing an Oracle 8i Relational Database. You can utilize these files to get nearly all the cost report information. There is a read-me page and other information on these cost reports file also listed here. A more general listing of all files is at: http://cms.hhs.gov/data/purchase/default.asp and http://cms.hhs.gov/researchers/statsdata.asp .

The Authority for Disclosure

Regulation No. 1 defines the basic authorization for disclosure of information obtained in the administration of the program. The general rule is that information about an individual obtained in the administration of the program may not be disclosed without the authorization of that individual. Medical information relating to an individual will generally be disclosed under more restrictive conditions than other information and, where permitted, usually may be furnished only upon the written authorization of the individual. Specific exceptions to this rule are detailed in the following sections. As far as program operations are concerned, information about an individual may be disclosed without his authorization when the disclosure is necessary in connection with any claim, or other proceeding, under the Social Security Act. Information will be disclosed for other than program purposes only if the disclosure is authorized by Regulation No. 1 and is consistent with the proper and efficient administration of the program.

Prohibition Against Disclosure

Penalty for Failure to Comply With the Rules Relating to Disclosure of Information Obtained in the Administration of the Act. Section 1106(a) of the Act provides that any person who violates the disclosure provisions shall be deemed guilty of a misdemeanor and, upon conviction thereof, shall be punished by a fine not exceeding $1,000, by imprisonment not exceeding 1 year, or both.

Disclosure Of Information about Identifiable Beneficiaries

The disclosure of information about beneficiaries is governed by the provisions of section 1106 of the Social Security Act as implemented by Regulation No. 1, the Privacy Act, the FOI Act, and the DHHS Public Information Regulation. In general, no information may be released except to the beneficiary (or his legal guardian) without the beneficiary's (or legal guardian's) explicit written authorization.

Disclosure Of Information After The Death Of A Beneficiary

Information concerning the fact, date, or circumstances of death may be disclosed when efficient administration permits. The request must be in writing and must state why the information is sought. Additional information may be disclosed to a surviving relative or an authorized representative of that relative, the legal representative of the estate, or to a probate court for the purpose of appointing a legal representative of the decedent's estate. No information which would appear to be detrimental to the individual or his estate will be disclosed, i.e., unusual place or manner of death or information which could create a liability to the individual's estate.

Medical information may be disclosed, in form and detail consistent with proper and efficient administration of the program, when reasonably necessary for a Title XVIII purpose.

Medical information obtained in the administration of Title XVIII may be disclosed to a surviving relative or legal representative of the estate of the individual or to others for other than a Title XVIII purpose, when such information is necessary for a determination as to what supplementary benefits or services such deceased individual was eligible to receive under a private or public hospital or medical insurance program which is consistent with the purposes and objectives of Title XVIII. Such information may be disclosed only if the individual has consented to such disclosure or a surviving relative or the legal representative of the estate consents.

Disclosure To Third Parties For Other Than Program Purposes

Non-medical information about an individual may be disclosed for other than a program purpose, to persons or organizations designated by the individual, if the individual authorizes disclosure, and if disclosure is consistent with the proper and efficient administration of the Act.

Medical information may be disclosed to a supplier of medical services solely for the purposes of the beneficiary's care or treatment. Such supplier will be informed that the information is being furnished in connection with the treatment of the beneficiary and that its use should be restricted to that purpose.

Occasionally in the course of reviewing medical evidence submitted to substantiate a claim, intermediary medical personnel may discover a medical condition of which the source of the information is unaware. (For purposes of this section, the "source" of the information is the part submitting the evidence.) In cases where a serious or potentially serious condition is found, UGS may wish to inform the source of the information. If the source of the information indicates that the beneficiary is not institutionalized and the identity of his current physician is not known, the source should recommend that the beneficiary consult a physician or institution of his choice for further treatment.

Medical information may also be disclosed, upon request, to the beneficiary's physician or to a medial institution at which the beneficiary is or was a patient when such physician or institution is not the source of the information. However, consent for the release must be obtained from the beneficiary.

Information obtained in the administration of the Medicare program for non-program activities is not releasable. However, when the beneficiary has given written authorization you are permitted to release certain information to your complementary insurance program under specific conditions in your capacity as insurance writer or administrator, or to other insurers for complementary health benefits purposes (see §1601, Part 1). Under no circumstances use the knowledge of an individual's entitlement or benefit utilization information for purposes of dropping an individual from a group health insurance plan.

Disclosure Of Information About Providers And Suppliers

In keeping with the spirit of the Freedom of Information Act and growing consumer interest in health care facilities and suppliers, the Health Care Financing Administration has made available to the public various final reports and other information regarding providers and suppliers. Disclosure to the public by UGS is limited, but the following guidelines indicate what information is available, to whom it may be released, and the source to which a requester should be directed for information that UGS is not authorized to release.

1. Disclosure Necessary for Proper Administration of the Medicare Program
   • Disclosure of Survey Information of the Joint Commission on Accreditation for Hospitals (JCAH), American Osteopathic Association (AOA), or any other National Accreditation Organization — CMS may not disclose any accreditation survey made and released by the JCAH, AOA or other national accreditation organization except as prescribed by regulations. Accreditation letters and accompanying Recommendations and Comments prepared by the JCAH, AOA or other national accreditation organization for the provider's accreditation survey are confidential and exempted from public disclosure.
   • A copy of the provider's most recent accreditation survey may be disclosed with the provider's authorization to any authorized representative, employee or agent of CMS for official use only in connection with the Medicare sample validation or substantial allegation survey program.
2. Information About Hospitals, Skilled Nursing Facilities, Home Health Agencies, and Independent Laboratories
   • Information about a hospital, skilled nursing facility, or home health agency, as well as information about independent laboratories, providers of outpatient physical therapy (rehabilitation and public health agencies and clinics) and portable X-ray suppliers, may be disclosed without the authorization of the institution or organization when such disclosure is required for the proper performance of the duties of:
     • An officer or employee of the Department;
     • An officer or employee of an intermediary; or
     • An officer or employee of a State agency when necessary to carry out his duties under State law in the licensing or approving of hospitals, skilled nursing facilities, home health agencies, or independent laboratories, etc.
   • UGS will not release information obtained in the provider certification process to those not included in the above three categories, except as indicated in "Medicare Reports" below.
   • However, information that a particular institution is participating in the program may be released and information indicating the specialties for which Title XVIII payment may be made for services of a particular independent laboratory may be released. This information is usually available from the Directory of Medical Providers and Suppliers of Services published by the U.S. Government Printing Office.
3. Disclosure to Third Parties
   • Disclosure to third parties for program purposes of information about identifiable physicians and other suppliers who are natural persons is governed by the same restrictions and procedures as disclosure about named beneficiaries to third parties for program purposes.
   • Information about unidentifiable individuals or about providers or corporate entities (e.g., clinics or independent laboratories), is not exempt from disclosure by section 1106 and Regulations at 42 CFR, Part 401. However, it is not to be disclosed by third parties to which information is disclosed for program purposes.
4. Disclosure of Medicare Reports
   • Provider Survey Report and Related Information.
     Information concerning survey reports of providers or facilities, as well as statements of deficiencies based on survey reports are available at the local Social Security office or the Public Health Assistance office in the area where the facility is located. The following data may be released under this provision:
     • The official Medicare survey report;
     • Statement of deficiencies which have been conveyed to the provider following a survey;
     • Plans of correction, and pertinent comments submitted by the provider relating to Medicare deficiencies cited following a survey.
   • Program Validation Review Reports and Other Formal Evaluations are available under FOI. Upon request in writing, official reports and other formal evaluations of the performance of providers are made available to the public. After the survey reports and other formal evaluations are prepared by CMS personnel, the provider evaluated must be given an opportunity (not to exceed 30 days) to review the report and submit comments on the accuracy of the findings and conclusions. The provider's comments must be incorporated in the report if pertinent.
   • Provider Cost Reports may be obtained under FOI from UGS. Requests by the public either to inspect or to obtain a copy of a provider cost report must be in writing and must identify the provider or class of providers and specific cost reports requested. If UGS receives a request for information concerning providers that it does not service, the request will be forwarded to the CMS Regional Office servicing the provider and the requester so informed. The CMS Regional Office then forwards the request to the servicing intermediary.
   • UGS may release Medicare payment or Medicare cost data concerning a named provider. However, no information will be release which would allow the requester to calculate provider non-Medicare data as well.
   • The waiver of liability status of a particular provider and the statistics used to determine that status may also be disclosed under FOI.
5. Generally, requests for information about a specific physician or other supplier of services, or for information which would identify such a physician or other supplier of services should be directed to the Medicare Part B Carrier which services the physician or supplier of service. UGS does not maintain such information.
6. UGS may disclose the names of providers terminated from Medicare Program participation to the public upon request. Inquiries as to why a provider no longer participated in the program will be referred to CMS.
7. CMS publishes the names of providers, physicians, other suppliers of services, or any other persons who have been found by a Federal court to have been guilty of submitting false claims in connection with Title XVIII. Such requests will also be referred to CMS for a response. 

Requests for information under the FOIA must be submitted, in writing, to:

National Government Services
Freedom of Information
P.O. Box 50454
Indianapolis, IN 46250-0454