CMS-10106 Supporting Statement Part A

CMS-10106

Supporting Statement For Paperwork Reduction Act Submissions

Specific Instructions

A. Background

This “Medicare Authorization to Disclose Personal Health Information” will be used by Medicare beneficiaries to authorize Medicare to disclose their protected health information to a third party. In June 2007, The Authorization was published in the Federal Register for a 60-day comment period and received no comments. In July 2004, the authorization form was beneficiary tested. The form has been in place for several years. Changes were made to the instructions and the form to make it more beneficiary-friendly.

B. Justification

1 . Need and Legal Basis

Unless permitted or required by law, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (§ 164.508) prohibits Medicare (a HIPAA covered entity) from disclosing an individual’s protected health information without a valid authorization. In order to be valid, an authorization must include specified core elements and statements. Medicare will make available to Medicare beneficiaries a standard, valid authorization to enable beneficiaries to request the disclosure of their protected health information. This standard authorization will simplify the process of requesting information disclosure for beneficiaries and minimize the response time for Medicare.

2. Information Users

The completed authorization will allow Medicare to disclose an individual’s personal health information to a third party at the individual’s request.

3. Improved Information Technology

Beneficiaries will submit the “Medicare Authorization to Disclose Personal Health Information” in paper or they can access Medicare.gov and submit the form electronically.

4. Duplication of Similar Information

This is a request to extend an existing, standard Medicare authorization that includes the core elements and statements required by HIPAA.

5. Small Businesses

Small businesses are not affected by this collection.

6. Less Frequent Collection

Providing a valid authorization form to Medicare beneficiaries is good customer service. The Medicare authorization form will simplify the process for beneficiaries and quicken Medicare’s response time.

7. Special Circumstances

Not applicable.

8. Federal Register Notice/Outside Consultation

The 60-day FR notice for this collection published on June 27, 2014.

9. Payments/Gifts To Respondents

Not applicable.

10. Confidentiality

As required by HIPAA, Medicare sends all Medicare beneficiaries a Notice of Privacy Practices (included in the Medicare & You Handbook and on the Medicare.gov Web site). The Notice of Privacy Practices assures Medicare beneficiaries that their personal health information is protected and informs beneficiaries of their privacy rights. Medicare has added HIPAA-required privacy protection language to all contracts with business associates. As required by the Privacy Act, Medicare publishes systems of records notices in the Federal Register that describe the data in each system and to whom Medicare may disclose the information. A Privacy Act Statement assuring confidentiality is given to individuals when their information is collected.

Unless permitted or required by law, Medicare only discloses an individual’s protected information with a valid authorization. Medicare assures beneficiaries of the confidentiality of their information by requiring the authorization include the core elements and statements required by HIPAA. The core elements specify what information is to be disclosed and to whom.

11. Sensitive Questions

Not applicable.

12. Burden Estimate (Total Hours & Wages)

Number of respondents and frequency of response: There are approximately 43 million Medicare beneficiaries. Beneficiaries contact the 1-800 Medicare contractor to request the disclosure of their Medicare protected health information. Medicare estimates one million authorizations will be submitted per year.

Annual hour burden: Processing written consents and authorizations is a customary and usual business practice for Medicare. The standard Medicare authorization will not increase the burden for Medicare. It will take the Medicare contractor between 10 minutes and 2 weeks to process the authorization. Electronic authorizations are automatically entered into the system allowing Medicare to immediately release information to an authorized individual on behalf of a beneficiary.

Burden hour and cost to respondents for the collection of information: There will be no cost to Medicare beneficiaries to request, complete, submit, or have processed the Medicare authorization form. It should take approximately 15 minutes for a beneficiary to complete the Medicare authorization form. 15 minutes times 1,298,329 beneficiaries equals 324,582 hours.

13. Capital Costs

Not applicable.

14. Cost to the Federal Government

None.

15. Changes to Burden

The change in the number of responses shown is due to the increase number of Medicare beneficiaries in the program. The form is being revised due to the number of forms Medicare returned as incomplete resulting in additional forms to be mailed to the same individual. The annual hour burden has increased to 324,582 because the number of respondents increased by 294,329 (1,298,329 X .25) = 324,582. The expectation is the number of forms returned as incomplete will be reduced over time due to the reduction of the incomplete form being submitted to Medicare multiple times. The burden hour is expected to remain the same.

16. Publication and Tabulation Dates

Not applicable.

17. Expiration Date

Medicare beneficiaries contact the 1-800 Medicare contractor to ask Medicare to disclose their information to third parties. When beneficiaries make such a request, Medicare contractors will send beneficiaries a blank “Medicare Authorization to Disclose Personal Health Information.” The Beneficiary Call Center may customize the form with the appropriate return address prior to sending to the beneficiary. Therefore, Medicare will not display the expiration date on the authorization form.

18. Certification Statement

There are no exceptions to the certification statement.

C. Collections of Information Employing Statistical Methods -- Item 12 on OMB 83-I Part 1 is checked “No.” Not applicable. 2. Not Applicable. 3. Not Applicable. 4. Not Applicable. 5. Not Applicable

3