80 by liuhongmei


									                Division of Child Support Services
   Employee Reference Guide – Standard Operating Procedure 373
                                HIPAA Guidelines
To take every precaution to safeguard confidential protected health information (PHI)
contained in case records maintained by the Division of Child Support Services (DCSS).

State Authority / Reference:
Standards for Privacy of Individually Identifiable Health Information
DCSS Policy Manual – Policy 8.0

Federal Authority / Reference:
Health Insurance Portability and Accountability Act of 1996 (HIPAA);
Federal PIQ-04-03;
Privacy Rules at 45 CFR 164.502, 45 CFR 164.512, 45 CFR 164.514;
HIPAA Topical Reference Tool (Identifies CFR and DHR Policy Cites)

All Georgia Child Support offices receiving Title IV-D funds including all private vendors
contracted with the Department of Human Services to provide child support services.

Required Case Condition:
HIPAA Notice of Privacy Practices must be given to and signed by both parties

373.01     Alleged Father / Parent has pending SSA/VA Claim
If you receive a request to establish paternity while the alleged father (AF) or non-
custodial parent has a pending Social Security (RSDI or SSI), Veterans Administration
or Workman's Compensation claim, you must respond with caution.
Every precaution should be taken not to information about the disability to the other
party without an Authorization to Release Information FormARI.
Important: You should never document information in the record concerning physical
or mental condition, injuries or illnesses due to HIPAA. Refer to ERG Procedure 540
for details on case action logs related to Protected Health Information (PHI).

373.02     Requests for Enforcement Against the Non-custodial Parent
If you receive a request for enforcement from a Custodial Parent/Custodian (CP/CU)
and you are aware that the Non-custodial Parent (NCP) has applied for or is receiving
Social Security (RSDI or SSI), Veterans Administration (VA) benefits or Workman's
Compensation claim, respond with caution.
Begin by determining if the CP/CU has knowledge of the NCP’s disability. If not, do not
release any information without an Authorization to Release Information. Explain that
we will review their request and respond when we receive more information.

Email Release 4/13/2009                    Page 1 of 4                   ERG Procedure 373
373.03     CP/CU Has Knowledge of Pending Disability Claim
Social Security
If you know that the NCP is waiting for the status of an RSDI claim, you may suggest that
the CP/CU go to the nearest Social Security Office to determine whether the children are
eligible for benefits. Otherwise, notify him/her that they must wait until DCSS receives
the results from SSA before notifying them of the results.
Veterans Administration or Worker’s Compensation
If you know that the NCP is waiting for the status of a VA or Workman’s Compensation
Claim, inform the CP/CU that we are monitoring the case and that we will seek to attach
any payments that become available.
Advise the CP/CU to notify you if they hear that payments are expected to begin.

373.04    CP/CU is aware of Pending Disability Claim
If you know that the NCP is waiting on an eligibility determination from SSA, VA or
Workman’s Compensation for benefits, explain that you cannot release any information
due to confidentiality. Inform the CP/CU that we will contact the NCP for an
Authorization to Release Information and will provide a response as soon as possible.
Mail FormHCL to both parties to document the following:
 1. That the CP/CU has been notified that the NCP has applied for benefits that are
     confidential in nature and that information will be shared as soon as possible, and
 2. That DCSS is aware that the NCP has applied for benefits and that we request
     permission to release basic information about the pending claim to CP/CU.

373.05     NCP is receiving SSA, VA or Workman’s Compensation Benefits
Determine what enforcement actions are appropriate for the NCP’s disability. Review
the following procedures to determine 1) which enforcement actions are allowable or
prohibited, 2) whether case closure is appropriate, and 3) how best to handle customer
service issues.
       ERG Procedure 80 - Safeguarding Information,
       ERG Procedure 275 - Social Security Benefits,
       ERG Procedure 280 - Veterans Affairs Benefits,
       ERG Procedure 450 - Worker’s Compensation Payments and Liens,
       ERG Procedure 1140 - Case Closure Criteria, and
       ERG Procedure 2110 - Customer Service Administrative Review Procedure
At a minimum, modify FormHCL to seek a release from the NCP and to be able to
provide updated information to the CP. (See 373.08 regarding Interstate Cases)
If enforcement is prohibited but the NCP provides a release, only notify the CP that the
NCP is receiving disability benefits that are not attachable. Do not specify what type of
disability the NCP.
NCP receiving SSI disability: If the CP inquires, explain that we are prohibited from
enforcing the case because SSI is considered a "needs based" benefit. Unless s/he
can prove the NCP has some other source of income, determine whether the case
meets case closure criteria.
If you have any questions, seek the advice of your attorney.
Email Release 4/13/2009                   Page 2 of 4                   ERG Procedure 373
373.06     Response from NCP to Authorization to Release Information
If the NCP responds granting permission to release information about a pending
benefit, application or claim, contact the CP by phone to advise him/her with information
as to the next appropriate steps.
If the NCP responds denying permission to release information, contact the CP by
phone to advise him/her that you cannot release information without a court order.
If you can’t reach the CP by phone, mail an update letter and document the CAL.

373.07       Preparing Case for a Hearing
If the CP requests a hearing, discuss the case with your attorney to determine whether
it is best to prepare the case for a contempt action or an administrative hearing through
the Office of State Administrative Hearings (OSAH).
The choice of hearing will be based on the facts of the case, including the NCP’s ability
to pay support based on the status of the NCP’s disability claim or disability benefits.
Once the judge reviews the facts in the case, s/he will either:
       Rule on the NCP’s ability to pay child support to his/her children,
       Rule on whether the NCP’s disability should be disclosed to the CP, or
       Order DCSS to advise the CP of the status of the NCP’s pending disability claim.

373.08      Court Hearings
If in conjunction with the court hearing you are asked to provide testimony related to PHI
of either party and you do not have an Authorization to Release General Information,
discuss this with your attorney. S/he will advise how you are to respond to questions
related to PHI.

373.09    Interstate Cases
If the NCP lives in another state edit Page 1 of FormHCL and replace the CP’s name
and address with the other states mailing address and check the appropriate block for
your request. Mail the form, along with Pages 2 and 3, to the other state to obtain
permission from the NCP to respond to the CP’s request for enforcement.
If the NCP lives in Georgia, and a request for enforcement is received from the other
state, respond only to that state’s child support agency with the case status information.
The other state is responsible for safeguarding any information that you provide.

Email Release 4/13/2009                   Page 3 of 4                    ERG Procedure 373
HIPAA Frequently Asked Questions
1. May a health plan disclose Protected Health Information to a state child support (IV-D)
   agency in response to a National Medical Support Notice?
   The Privacy Rule permits a health plan to respond to a request for information by a IV-D agency
   pursuant to a National Medical Support Notice (NMSN), as described below.
   The Privacy Rule at 45 CFR 164.512(f) permits a covered entity to disclose protected health
   information to a “law enforcement official” for law enforcement purposes in compliance with
   court orders, grand jury subpoenas, or certain written administrative requests. 45 CFR
   164.512(f)(1)(ii). As defined in 45 CFR 164.501, a “law enforcement official” means an officer or
   employee of any agency or authority of the United States, a State, a territory, a political
   subdivision of a State or territory, or an Indian tribe, who is empowered by law to investigate or
   conduct an official inquiry into a potential violation of law or to prosecute or otherwise conduct a
   criminal, civil, or administrative proceeding arising from an alleged violation of law. An employee
   of a IV-D agency, including a contract employee, who is empowered by state or federal law to
   enforce a medical child support order, meets this definition of a law enforcement official.
   The NMSN, a nationally uniform form that is sent by the IV-D agency to the employer and health
   plan for completion, constitutes a written administrative request by a law enforcement official.
   As such, the Privacy Rule allows a health plan to disclose protected health information in
   response to the NMSN, provided it includes or is accompanied by written assurances by the law
   enforcement official that (1) the information sought is material and relevant to a legitimate law
   enforcement inquiry; (2) the request is specific and limited in scope; and (3) de-identified
   information cannot reasonably be used. 45 CFR 164.512(f)(1)(ii)(C).
   The Privacy Rule requires the covered entity to verify that these three conditions are met, as
   well as the identity and authority of the public official making the request, unless already known
   to the covered entity. The covered entity must also limit the disclosures to the minimum
   necessary for the purpose. To meet these requirements, the covered entity may reasonably
   rely on the following:
      NMSN, or a separate written statement that, on its face, demonstrates that the three
         assurances required for these disclosures have been met. 45 CFR 164.514(h)(2)(i)(A).
      NMSN is sufficient to verify the identity and legal authority of the public official requesting
         the protected health information. 45 CFR 164.514(h)(2)(ii) and (iii).
      NMSN is sufficient as a request from a public official for the minimum information needed
         to meet the law enforcement purpose of the request. 45 CFR 164.514(d)(3)(iii)(A).
2. Can we send paternity test results to DFCS?
   Yes. We mail a copy with FormSOB, but only if we have a mutual case on the parties.

3. If an NCP or CP contacts us on a closed case and they now want a copy of paternity test
   results because they lost the first copy. Can we give them a copy?
   No. They may obtain a copy of the results if they are filed at the Clerk's Office and they are not
   “sealed”. They may get a copy from the Clerk’s office for a fee. If you have questions
   regarding sealed records, discuss with your attorney.

4. Does this HIPAA release form cover social security number issues?
   No. An SSN is not Protected Health Information.

Email Release 4/13/2009                       Page 4 of 4                       ERG Procedure 373

To top