CMS-10106 REVISED Supporting Statement-2-19-08 (3)

CMS-10106

Supporting Statement For Paperwork Reduction Act Submissions

Specific Instructions

A. Background

This “Medicare Authorization to Disclose Personal Health Information” will be used by Medicare beneficiaries to authorize Medicare to disclose their protected health information to a third party. In January 2004, The Authorization was published in the Federal Register for a 60-day comment period and received no comments. In July 2004, the authorization form was beneficiary tested. Minor changes were made and brief instructions were added to the form to make it more beneficiary-friendly.

B. Justification

1 . Need and Legal Basis

Unless permitted or required by law, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (§ 164.508) prohibits Medicare (a HIPAA covered entity) from disclosing an individual’s protected health information without a valid authorization. In order to be valid, an authorization must include specified core elements and statements. Medicare will make available to Medicare beneficiaries a standard, valid authorization to enable beneficiaries to request the disclosure of their protected health information. This standard authorization will simplify the process of requesting information disclosure for beneficiaries and minimize the response time for Medicare.

2. Information Users

The completed authorization will allow Medicare to disclose an individual’s personal health information to a third party at the individual’s request.

3. Improved Information Technology

Beneficiaries will submit the “Medicare Authorization to Disclose Personal Health Information” in paper. At this time, Medicare does not have the capability to permit the submission of electronic authorizations; however, we will load the “1-800 MEDICARE Authorization to Disclose Personal Health Information” form to the Medicare.gov website. The beneficiary can complete the form online, print it out, sign it, and mail it to 1-800-MEDICARE.  For those who prefer to call, after performing disclosure, the CSR would fill out the form and mail the completed form to the beneficiary who would sign the form and return it back to 1-800-MEDICARE for processing.

Beneficiaries will submit the “Medicare Authorization to Disclose Personal Health Information” in paper. At this time, Medicare does not have the capability to permit the submission of electronic authorizations.

4. Duplication of Similar Information

This is a request to extend an existing, standard Medicare authorization that includes the core elements and statements required by HIPAA.

5. Small Businesses

Small businesses are not affected by this collection.

6. Less Frequent Collection

Providing a valid authorization form to Medicare beneficiaries is good customer service. The Medicare authorization form will simplify the process for beneficiaries and quicken Medicare’s response time.

7. Special Circumstances

Not applicable.

8. Federal Register Notice/Outside Consultation

The 60-day FR notice for this collection published on June 8, 2007.

9. Payments/Gifts To Respondents

Not applicable.

10. Confidentiality

As required by HIPAA, Medicare sends all Medicare beneficiaries a Notice of Privacy Practices (included in the Medicare & You Handbook and on the medicare.gov Web site). The Notice of Privacy Practices assures Medicare beneficiaries that their personal health information is protected and informs beneficiaries of their privacy rights. Medicare has added HIPAA-required privacy protection language to all contracts with business associates. As required by the Privacy Act, Medicare publishes systems of records notices in the Federal Register that describe the data in each system and to whom Medicare may disclose the information. A Privacy Act Statement assuring confidentiality is given to individuals when their information is collected.

Unless permitted or required by law, Medicare only discloses an individual’s protected information with a valid authorization. Medicare assures beneficiaries of the confidentiality of their information by requiring the authorization include the core elements and statements required by HIPAA. The core elements specify what information is to be disclosed and to whom.

11. Sensitive Questions

Not applicable.

12. Burden Estimate (Total Hours & Wages)

Number of respondents and frequency of response: There are approximately 3940 million Medicare beneficiaries. Beneficiaries can contact 1-800- MEDICAREedicare to require the disclosure of their Medicare protected health information.contractors (Fiscal Intermediaries, Carriers, Call Centers, and Durable Medical Equipment Regional Carriers) to request the disclosure of their Medicare protected health information. In our 2004 OMB submission, we To estimated the number of Medicare beneficiaries who may submitting authorizations on an annual basis. We, Medicare asked a sample of each type of Medicare contractor to provide an estimate of the number of authorizations the contractor receives annually. The estimate for each contractor type was then multiplied by the number of that type of contractor. We Medicare estimateds one million authorizations would ill be submitted annually.per year.

However, after reviewing our historical data, we found that we grossly overestimated the number. Listed below is a chart containing the total number of authorizations Medicare received between 2002 and 2008.

Written Authorizations by Year
Year	Count
2002	523
2003	161,901
2004	210,008
2005	162,305
2006	168,577
2007	102,847
2008	17,207**
Total	823,368

**As of February 14, 2008

Between 2003 and 2007, we received an average of 161,128 authorizations per year. We did not include 2002 in our calculation because it was the first year of the form. We did not include 2008 in our calculation because the data collection is ongoing and the year is not complete. We believe that moving forward we will receive approximately 200,000 authorizations annually. This new estimate accounts for the average number of authorizations received between 2003 and 2007. In addition, we increased the estimate to account for increases in the beneficiary population and increased awareness of the authorization form. The form will be referenced by name in the 2009 Medicare and You Handbook.

Annual hour burden: Processing written consents and authorizations is a customary and usual business practice for Medicare. The standard Medicare authorization will not increase the burden for Medicare. It will take Medicare contractors between 10 minutes and 2 weeks to process the authorization.

Burden hour and cost to respondents for the collection of information: There will be no cost to Medicare beneficiaries to request, complete, submit, or have processed the Medicare authorization form. It should take approximately 15 minutes for a beneficiary to complete the Medicare authorization form. 15 minutes times 200,0001 million beneficiaries per year equals 250,000 hours.

13. Capital Costs

Not applicable.

14. Cost to the Federal Government

None.

15. Program Changes

• To increase clarity, we updated the name of the form to include 1-800-MEDICARE

• After reviewing our historical date, we found that we grossly overestimated the number. Therefore, we made an update to the Burdon Estimate (see #12)

• To increase beneficiary customer service, we will load the “1-800 MEDICARE Authorization to Disclose Personal Health Information” form to the Medicare.gov website. The beneficiary can complete the form online, print it out, sign it, and mail it to 1-800-MEDICARE.  For those who prefer to call, after performing disclosure, the CSR would fill out the form and mail the completed form to the beneficiary who would sign the form and return it back to 1-800-MEDICARE for processing.

There are no program changes to the collection.

16. Publication and Tabulation Dates

Not applicable.

17. Expiration Date

Medicare beneficiaries contact Medicare contractors (Medicare Beneficiary Call Center, Medicare Administrative Contractors, etc.) to ask Medicare to disclose their information to third parties. When beneficiaries make such a request, Medicare contractors will send beneficiaries a blank “Medicare Authorization to Disclose Personal Health Information.” The Beneficiary Call Center and other contractors may customize the form with the appropriate return address prior to sending to the beneficiary. Therefore, Medicare will not display the expiration date on the authorization form.

18. Certification Statement

There are no exceptions to the certification statement.

C. Collections of Information Employing Statistical Methods -- Item 12 on OMB 83-I Part 1 is checked “No.” Not applicable. 2. Not Applicable. 3. Not Applicable. 4. Not Applicable. 5. Not Applicable

5