[Code of Federal Regulations] [Title 42, Volume 3] [Revised as of October 1, 2004] From the U.S. Government Printing Office via GPO Access [CITE: 42CFR480.101] [Page 467-469] TITLE 42--PUBLIC HEALTH CHAPTER IV--CENTERS FOR MEDICARE & MEDICAID SERVICES, DEPARTMENT OF HEALTH AND HUMAN SERVICES (CONTINUED) PART 480_ACQUISITION, PROTECTION, AND DISCLOSURE QUALITY IMPROVEMENT ORGANIZATION INFORMATION--Table of Contents Subpart B_Utilization and Quality Control Quality Improvement Organizations (QIOs) Sec. 480.101 Scope and definitions. Subpart A [Reserved] Subpart B_Utilization and Quality Control Quality Improvement Organizations (QIOs) General Provisions Sec. 480.101 Scope and definitions. 480.102 Statutory bases for acquisition and maintenance of information. 480.103 Statutory bases for disclosure of information. 480.104 Procedures for disclosure by a QIO. 480.105 Notice of disclosures made by a QIO. 480.106 Exceptions to QIO notice requirements. 480.107 Limitations on redisclosure. 480.108 Penalties for unauthorized disclosure. 480.109 Applicability of other statutes and regulations. QIO Access to Information 480.111 QIO access to records and information of institutions and practitioners. 480.112 QIO access to records and information of intermediaries and carriers. 480.113 QIO access to information collected for QIO purposes. 480.114 Limitations on data collection. QIO Responsibilities 480.115 Requirements for maintaining confidentiality. 480.116 Notice to individuals and institutions under review. Disclosure of Nonconfidential Information 480.120 Information subject to disclosure. 480.121 Optional disclosure of nonconfidential information. Disclosure of Confidential Information 480.130 Disclosure to the Department. 480.131 Access to medical records for the monitoring of QIOs. 480.132 Disclosure of information about patients. 480.133 Disclosure of information about practitioners, reviewers and institutions. 480.134 Verification and amendment of QIO information. 480.135 Disclosure necessary to perform review responsibilities. 480.136 Disclosure to intermediaries and carriers. 480.137 Disclosure to Federal and State enforcement agencies responsible for the investigation or identification of fraud or abuse of the Medicare or Medicaid programs. 480.138 Disclosure for other specified purposes. 480.139 Disclosure of QIO deliberations and decisions. 480.140 Disclosure of quality review study information. 480.141 Disclosure of QIO interpretations on the quality of health care. 480.142 Disclosure of sanction reports. 480.143 QIO involvement in shared health data systems. Authority: Secs. 1102 and 1871 of the Social Security Act (42 U.S.C. 1302 and 1395hh). Subpart A [Reserved] Source: 50 FR 15359, Apr. 17, 1985, unless otherwise noted. Redesignated at 64 FR 66279, Nov. 24, 1999. General Provisions (a) Scope. This subpart sets forth the policies and procedures governing-- (1) Disclosure of information collected, acquired or generated by a Utilization and Quality Control Quality Improvement Organization (QIO) (or [[Page 468]] the review component of a QIO subcontractor) in performance of its responsibilities under the Act and these regulations; and (2) Acquisition and maintenance of information by a QIO to comply with its responsibilities under the Act. (b) Definitions. As used in this part: Abuse means any unlawful conduct relating to items or services for which payment is sought under Title XVIII of the Act. Aggregate statistical data means any utilization, admission, discharge or diagnostic related group (DRG) data arrayed on a geographic, institutional or other basis in which the volume and frequency of services are shown without identifying any individual. Confidential information means any of the following: (1) Information that explicitly or implicitly identifies an individual patient, practitioner or reviewer. (2) Sanction reports and recommendations. (3) Quality review studies which identify patients, practitioners or institutions. (4) QIO deliberations. Health care facility or facility means an organization involved in the delivery of health care services or items for which reimbursement may be made in whole or in part under Title XVIII of the Act. Implicitly identify(ies) means data so unique or numbers so small so that identification of an individual patient, practitioners or reviewer would be obvious. Non-facility organization means a corporate entity that: (1) Is not a health care facility; (2) is not a 5 percent or more owner of a facility; and (3) is not owned by one or more health care facilities in the QIO area. Patient representative means--(1) an individual designated by the patient, in writing, as authorized to request and receive QIO information that would otherwise be disclosable to that patient; or (2) an individual identified by the QIO in accordance with Sec. 480.132(c)(3) when the beneficiary is mentally, physically or legally unable to designate a representative. Practitioner means an individual credentialed within a recognized health care discipline and involved in providing the services of that discipline to patients. QIO deliberations means discussions or communications (within a QIO or between a QIO and a QIO subcontractor) including, but not limited to, review notes, minutes of meetings and any other records of discussions and judgments involving review matters regarding QIO review responsibilities and appeals from QIO determinations, in which the opinions of, or judgment about, a particular individual or institution can be discerned. QIO information means any data or information collected, acquired or generated by a QIO in the exercise of its duties and functions under Title XI Part B or Title XVIII of the Act. QIO interpretations and generalizations on the quality of health care means an assessment of the quality of care furnished by an individual provider or group of providers based on the QIO's knowledge of the area gained from its medical review experience (e.g., quality review studies) and any other information obtained through the QIO's review activities. QIO review system means the QIO and those organizations and individuals who either assist the QIO or are directly responsible for providing medical care or for making determinations with respect to the medical necessity, appropriate level and quality of health care services that may be reimbursed under the Act. The system includes-- (1) The QIO and its officers, members and employees; (2) QIO subcontractors; (3) Health care institutions and practitioners whose services are reviewed; (4) QIO reviewers and supporting staff; and (5) Data support organizations. Public information means information which has been disclosed to the public. Quality review study means an assessment, conducted by or for a QIO, of a patient care problem for the purpose of improving patient care through peer analysis, intervention, resolution of the problem and follow-up. Quality review study information means all documentation related to the quality review study process. [[Page 469]] Reviewer means review coordinator, physician, or other person authorized to perform QIO review functions. Sanction report means a report filed pursuant to section 1156 of the Act and part 474 of this chapter documenting the QIO's determination that a practitioner or institution has failed to meet obligations imposed by section 1156 of the Act. Shared health data system means an agency or other entity authorized by Federal or State law that is used by the QIO review system to provide information or to conduct or arrange for the collection, processing, and dissemination of information on health care services. Subcontractor means a facility or a non-facility organization under contract with a QIO to perform QIO review functions. [50 FR 15359, Apr. 17, 1985; 50 FR 41886, Oct. 16, 1985. Redesignated at 64 FR 66279, Nov. 24, 1999; 69 FR 49267, Aug. 11, 2004]