1600, Disclosure of Information | Texas Health and Human Services

Printer-friendly version

Revision 22-2; Effective September 1, 2022

1610 Confidential Nature of a Case Record

Revision 22-2; Effective September 1, 2022

Information collected in determining initial or continuing eligibility is confidential. The Texas Health and Human Services Commission (HHSC) and the managed care organization (MCO) may disclose general information about policies, procedures or other methods of determining eligibility, and any other information that is not about or does not specifically identify a member. A member or their legally authorized representative (LAR) may review all information in the case record and in HHSC or MCO handbooks that contributed to the decision about eligibility.

1611 Establishing Identity for Contact Outside the Interview Process

Revision 22-2; Effective September 1, 2022

All information that the Texas Health and Human Services Commission (HHSC) and the managed care organization (MCO) have about a member or any individual on the member's case must be kept confidential. Confidential information includes, but is not limited to, a member's name, date of birth (DOB), address, Social Security number (SSN), Medicaid ID number or any other personally identifiable health information.

Before discussing or releasing information about a member or legally authorized representative (LAR) on the member's case, take steps to be reasonably sure the individual receiving the confidential information is either the member or their LAR and is authorized to receive confidential information (for example, an attorney).

1611.1 Telephone Contact

Revision 22-2; Effective September 1, 2022

Establish the identity of an individual who identifies themselves as a member by using the individual’s knowledge of any of the following:

member’s Social Security number (SSN) and date of birth (DOB);
member’s SSN and answer to a security question;
member’s DOB and answer to a security question; or
answers to two security questions.

Establish the identity of a legally authorized representation (LAR) by using the individual's knowledge of any of the above or the any of the following:

LAR’s or AR’s SSN and DOB;
LAR’s or AR’s SSN and answer to a security question;
LAR’s or AR’s DOB and answer to a security question; or
answers to two security questions.

Establish the identity of an attorney or LAR by asking for the individual to provide Form H1826, Case Information Release, completed and signed by the member. The managed care organization (MCO) must maintain this documentation in the member's case file.

Texas Health and Human Services Commission (HHSC) staff must use established regional procedures to confirm the identity of legislators or their staff. The MCO must use established HHSC procedures to confirm the identity of legislators or its staff. Legislators and members of their staff must also provide HHSC with Form H1826.

1611.2 In-Person Contact

Revision 22-2; Effective September 1, 2022

Establish the identity of the individual who presents themselves as a member or legally authorized representative (LAR) at a Texas Health and Human Services Commission (HHSC) or managed care organization (MCO) office by examining:

at least one form of government-issued photo identification:
- Valid U.S. passport;
- driver license or Department of Public Safety Identification card; or
- state agency employee badge; and
at least two forms of other identification:
- Social Security number (SSN) card;
- hospital record;
- work or school identification card;
- voter registration card; or
- wage stub.

Establish the identity of other HHSC or MCO staff, federal agency staff, researchers or contractors by examining at least one source such as:

employee badge; or
government-issued identification card with a photograph.

Identify the need for other HHSC or MCO staff, federal staff, research staff or contractors to access confidential information through one of the following:

official correspondence or a telephone call from a state or regional office; or
contact with an HHSC attorney.

Contact appropriate regional or state office staff when federal agency staff, contractors, researchers or other HHSC or MCO staff come to the office without prior notification or adequate identification and request permission to access records.

Refer to Section 1611.3, Verification and Documentation, if the individual is requesting personally identifiable information (PII) or protected health information (PHI).

1611.3 Verification and Documentation

Revision 22-2; Effective September 1, 2022

It is only acceptable to disclose personally identifiable information (PII) or protected health information (PHI) to the applicant, member, legally authorized representative (LAR) or a third-party to whom the applicant, member or LAR have provided written consent for the release of PII or PHI information. If disclosing PII or PHI, document transactions and maintain documentation in the member's case file pertaining to how the identity of the person was verified when contact is outside the interview and the method of how the information was released to the individual.

Verify the identity of the person who requests disclosure of PII or PHI by examining:

at least one form of government-issued photo identification:
- Valid U.S. passport;
- driver license or Department of Public Safety Identification card; or
- state agency employee badge; and
at least two forms of other identification:
- Social Security number (SSN) card;
- hospital record;
- work or school identification card;
- voter registration card; or
- wage stub.

1612 Custody of Records

Revision 17-1; Effective September 1, 2017

Records must be safeguarded. Use reasonable diligence to protect and preserve records and to prevent disclosure of the information they contain, except as provided by the Texas Health and Human Services Commission (HHSC) and managed care organization (MCO) regulations.

Reasonable diligence for employees responsible for records includes keeping records:

in a locked office when the building is closed;
properly filed during office hours; and
in the office at all times, except when authorized to remove or transfer them.

1613 Disposal of Records

Revision 22-2; Effective September 1, 2022

To dispose of documents with member-specific information, managed care organizations (MCOs) must follow procedures contained in the STAR Kids Managed Care Contract.

1614 When and What Information May Be Disclosed

Revision 22-2; Effective September 1, 2022

Reasonable effort must be made to limit the use, request or disclosure of individually identifiable health information to the minimum necessary to determine eligibility and operate the program. The disclosure of individual medical information from the Texas Health and Human Services Commission (HHSC) and managed care organization (MCO) records must be limited to the minimum necessary to accomplish the requested disclosure. For example, if a member authorizes release of income verification, including disability income, do not release related case medical information unless specifically authorized by the member.

Give member addresses or other case information only to a person who has written permission from the applicant, member or legally authorized representative (LAR) to obtain the information. The applicant, member or LAR authorizes the release of information by completing and signing:

Form H1826, Case Information Release; or
a document containing all of the following information:
- the applicant's or member's:
  - full name (including middle initial) and Medicaid identification number; or
  - full name (including middle initial) and either date of birth (DOB) or Social Security number (SSN);
- a description of the information to be released. Note: If a general release is authorized, provide the information that can be disclosed to the member or LAR. Withhold protected health information (PHI) from the case record, such as names of persons who disclosed information about the household without the household's knowledge, and the nature of pending criminal prosecution;
- a statement specifically authorizing HHSC or the MCO to release the information;
- the name of the person or agency to whom the information will be released;
- the purpose of the release;
- an expiration event that is related to the member, the purpose of the release or an expiration date of the release;
- a statement about whether refusal to sign the release affects eligibility for delivery of services;
- a statement describing the applicant's or member's right to revoke the authorization to release information;
- the date the document is signed; and
- the signature of the applicant, member or LAR.

Note: If the case information to be released includes individually identifiable health information, the document must also tell the applicant, member, or LAR that information released under the document may no longer be private and may be released further by the person receiving the information.
Occasionally, requests for information from the case records of deceased members are received. In these instances, protect the confidentiality of the former members and their survivors.

The Office of the Chief Counsel at HHSC handles questions about the release of information. All questions and problems encountered by individuals concerning release of information should be referred to this office. MCO staff should email HPM_Complaints@hhsc.state.tx.us or use the online question and complaint form.

1615 Confidential Nature of Medical Information ─ Health Insurance Portability and Accountability Act

Revision 18-1; Effective March 1, 2018

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that sets additional standards to protect the confidentiality of individually identifiable health information. Individually identifiable health information is information that identifies or could be used to identify an applicant or member and that relates to the:

past, present or future physical or behavioral health or condition of the applicant or member;
provision of health care to the applicant or member; or
past, present or future payment for the provision of health care to the applicant or member.

Protected health information (PHI) includes, but is not limited to, an individual's name, date of birth (DOB), address, Social Security number (SSN), Medicaid ID number or any other personally identifiable information (PII).

1616 Privacy Notice

Revision 22-2; Effective September 1, 2022

Texas Health and Human Services Commission (HHSC) and managed care organization (MCO) staff must send each member the Texas Health and Human Services Agencies' Notice of Privacy Practices at https://hhs.texas.gov/health-and-human-services-agencies-notice-privacy-practices, upon certification. This notice tells the member or legally authorized representative (LAR) about:

member privacy rights;
the duties of HHSC and the MCO to protect health information (PHI); and
how HHSC and the MCO may use or disclose health information without member authorization. Examples of use or disclosure include health care operations (e.g., Medicaid), public health purposes, reporting victims of abuse, law enforcement purposes, sharing with HHSC or MCO contractors and coordinating government programs that provide benefits.

1617 Member Authorization

Revision 22-2; Effective September 1, 2022

The member or legally authorized representative (LAR) may authorize the release of health information from Texas Health and Human Services Commission (HHSC) and managed care organization (MCO) records by using a valid authorization form. Form H1826, Case Information Release, includes all the authorization elements required by Health Insurance Portability and Accountability Act (HIPPA) privacy regulations.

1618 Minimum Necessary Information Release

Revision 17-1; Effective June 1, 2017

Reasonable efforts must be made to limit the use, request or disclosure of individually identifiable health information to the minimum necessary to determine eligibility and operate the program. The disclosure of individual medical information from Texas Health and Human Services Commission (HHSC) and managed care organization (MCO) records must be limited to the minimum necessary to accomplish the requested disclosure. For example, if a member authorizes release of income verification, including disability income, do not release related case medical information unless specifically authorized by the member.

1619 Legally Authorized Representatives

Revision 22-2; Effective September 1, 2022

Only the member's legally authorized representative (LAR) can exercise the member's rights with respect to individually identifiable health information. Therefore, only a member's personal representative may authorize the use or disclosure of individually identifiable health information or obtain individually identifiable health information on behalf of a member. Exception: Texas Health and Human Services Commission (HHSC) and the managed care organization (MCO) are not required to disclose the information to the personal representative if the member is subjected to domestic violence, abuse or neglect by the personal representative. Consult appropriate legal counsel, as described in Section 1614, When and What Information May Be Disclosed, if it is believed that health information should not be released to the LAR.

Note: An LAR is not automatically designated as a responsible party.

1619.1 Adults and Emancipated Minors

Revision 22-2; Effective September 1, 2022

If the member is an adult or emancipated minor, including married minors, the member's LAR is a person who has the authority to make health care decisions about the member and includes a:

person the member has appointed under a medical power of attorney, a durable power of attorney with the authority to make health care decisions, or a power of attorney with the authority to make health care decisions;
court-appointed guardian for the member; or
person designated by law to make health care decisions when the member is in a hospital or nursing home and is incapacitated or mentally or physically incapable of communication.

Consult appropriate legal counsel, as described in Section 1614, When and What Information May Be Disclosed, for approval.

1619.2 Unemancipated Minors

Revision 22-3; Effective Dec. 1, 2022

A parent is the LAR for a minor child except when:

the minor child can consent to medical treatment by themselves. Under these circumstances, do not disclose to a parent information about the medical treatment to which the minor child can consent. A minor child can consent to medical treatment by themselves when the:
- minor is on active duty with the U.S. military;
- minor is 16 years or older, lives separately from the parents and manages their own financial affairs;
- consent involves diagnosis and treatment of disease that must be reported to the local health officer or the Texas Department of State Health Services (DSHS);
- minor is unmarried and pregnant and the treatment (other than abortion) relates to the pregnancy;
- minor is 16 years or older and the consent involves examination and treatment for drug or chemical addiction, dependency or use at a treatment facility licensed by HHSC;
- consent involves examination and treatment for drug or chemical addiction, dependency or use by a physician or counselor at a location other than a treatment facility licensed by the state of Texas;
- minor is unmarried, is the parent of a child, has actual custody of the child and consents to treatment for the child; or
- consent involves suicide prevention or sexual, physical or emotional abuse.
a court is making health care decisions for the minor child or has given the authority to make health care decisions for the minor child to an adult other than a parent or to the minor child. Under these circumstances, do not disclose to a parent information about health care decisions not made by the parent.

1619.3 Deceased Members

Revision 22-2; Effective September 1, 2022

The LAR for a deceased member is an executor, administrator or other person with authority to act on behalf of the member or the member's estate. These include:

an executor, including an independent executor;
an administrator, including a temporary administrator;
a surviving spouse;
a child;
a parent; and
an heir.

Consult appropriate legal counsel, as described in Section 1614, When and What Information May Be Disclosed, about whether a particular person is the personal representative of an applicant or member.

1620 Correcting Information

Revision 22-2; Effective September 1, 2022

A member or legally authorized representative (LAR) has a right to correct any information that the Texas Health and Human Services Commission (HHSC) or the managed care organization (MCO) has about the member and any other individual on the member's case.

A request for correction must be in writing and:

identify the individual asking for the correction;
identify the disputed information about the individual;
state why the information is wrong;
include any proof that shows the information is wrong;
state what correction is requested; and
include a return address, telephone number or email address at which HHSC or the MCO can contact the member.

If HHSC or the MCO agrees to change individually identifiable health information, the corrected information is added to the case record, but the incorrect information remains in the file with a note that the information was amended per the member's request.

Notify the member or LAR in writing within 60 days (using current agency letterhead) that the information is corrected, or will not be corrected, and the reason. Inform the member if HHSC or the MCO needs to extend the 60-day period by an additional 30 days to complete the correction process or obtain additional information.

If HHSC or the MCO makes a correction to individually identifiable health information, HHSC or the MCO must ask the member for permission before sharing with third parties. The agency will make a reasonable effort to share the correct information with persons who received the incorrect information if they may have relied or could rely on it to the disadvantage of the member. HHSC staff must contact the HHSC privacy officer for a record of disclosures. MCOs must follow HHSC procedures as stated in the STAR Kids Managed Care Contract.

Note: Do not follow above procedures when the accuracy of information provided by a member or LAR is determined by another review process, such as a:

fair hearing;
civil rights hearing; or
other appeal process.

The decision in that review process is the decision on the request to correct information.

1630 Communication with the Managed Care Organization

Revision 23-3; Effective July 21, 2023

In order to comply with the Health Insurance Portability and Accountability Act (HIPAA), it is imperative for a member's individually identifiable health information to be shared only with their selected managed care organization (MCO). This makes it crucial that when documents containing member information are uploaded in the incorrect MCO folder in MCOHub, they be corrected immediately upon realization an error was made.

Send notification of all uploading errors to Program Support Unit (PSU) Operations staff. Include the document identifying information, the name of the folder in which it was erroneously uploaded and the name of the folder into which it should have been uploaded. Include the time the correction was made.

Example: Uploaded XX_2067_123456789_ABCD_IM_MFP.doc in SUPSKW at 8:54 a.m. on December 20. Should have been uploaded to MOLSKW. Corrected at 9:22 a.m. December 20.

All emails containing member information must be sent using encryption software. No personally identifiable information (PII) may appear in the subject line. See also Section 1615, Confidential Nature of Medical Information, and Section 5100, Agency Option (AO).

1640 Alternate Means of Communication

Revision 22-2; Effective September 1, 2022

The Texas Health and Human Services Commission (HHSC) and the managed care organization (MCO) must accommodate an applicant’s, member's or legally authorized representative’s (LAR’s) reasonable requests to receive communications by alternative means or at alternate locations.

The applicant, member or LAR must specify in writing the alternate mailing address or means of contact and include a statement that using the home mailing address or normal means of contact could endanger the member.