Protecting the Privacy of the MDS Data Form

Form 5 of 9

PROTECTING MDS DATA

Fields marked with an (*) are required.

MDS assessment data is personal information about nursing facility residents that facilities are required to collect and keep confidential in accordance with federal law. The 42 CFR Part 483.20 requires Medicare and Medicaid certified nursing facility providers to collect the resident assessment data that comprises the MDS. This data is considered part of the resident’s medical record and is protected from improper disclosure by Medicare and Medicaid certified facilities by regulation at CFR 483.70(i) and 483.75(i)(4), release of information from the resident’s clinical record is permissible only when required by:

  1. transfer to another health care institution,
  2. law (both State and Federal), and/or
  3. the resident.

Otherwise, providers cannot release MDS data in individual level format or in the aggregate. Nursing facility providers are also required under CFR 483.20 to transmit MDS data to a Federal data repository. Any personal data maintained and retrieved by the Federal government is subject to the requirements of the Privacy Act of 1974. The Privacy Act specifically protects the confidentiality of personal identifiable information and safeguards against its misuse. Information regarding The Privacy Act can be found at https://www.cms.gov/Research-Statistics-Data-and-Systems/Computer-Data-and-Systems/Privacy/PrivacyActof1974.html.

The Privacy Act requires by regulation that all individuals whose data are collected and maintained in a federal database must receive notice. Therefore, residents in nursing facilities must be informed that the MDS data is being collected and submitted to the national system, Quality Improvement Evaluation System Assessment Submission and Processing System (QIES ASAP) and the State MDS database. The notice shown on page 1-16 of this section meets the requirements of the Privacy Act of 1974 for nursing facilities. The form is a notice and not a consent to release or use MDS data for health care information. Each resident or family member must be given the notice containing submission information at the time of admission. It is important to remember that resident consent is not required to complete and submit MDS assessments that are required under Omnibus Budget Reconciliation Act of 1987 (OBRA ’87) or for Medicare payment purposes.

Contractual Agreements

Providers who are part of a multi-facility corporation may release data to their corporate office or parent company but not to other providers within the multi-facility corporation. The parent company is required to “act” in the same manner as the facility and is permitted to use data only to the extent the facility is permitted to do so (as described in 42 CFR at 483.10(h)(3)(i)).

In the case where a facility submits MDS data to CMS through a contractor or through its corporate office, the contractor or corporate office has the same rights and restrictions as the facility does under the Federal and State regulations with respect to maintaining resident data, keeping such data confidential, and making disclosures of such data. This means that a contractor may maintain a database, but must abide by the same rules and regulations as the facility. Moreover, the fact that there may have been a change of ownership of a facility that has been transferring data through a contractor should not alter the contractor's rights and responsibilities; presumably, the new owner has assumed existing contractual rights and obligations, including those under the contract for submitting MDS information. All contractual agreements, regardless of their type, involving the MDS data should not violate the requirements of participation in the Medicare and/or Medicaid program, the Privacy Act of 1974 or any applicable State laws.

PRIVACY ACT STATEMENT – HEALTH CARE RECORDS

Long Term Care-Minimum Data Set (MDS) System of Records revised 04/28/2007

(Issued: 9-6-12, Implementation/Effective Date: 6-17-13)

THIS FORM PROVIDES YOU THE ADVICE REQUIRED BY THE PRIVACY ACT OF 1974 (5 USC 552a). THIS FORM IS NOT A CONSENT FORM TO RELEASE OR USE HEALTH CARE INFORMATION PERTAINING TO YOU.

1. AUTHORITY FOR COLLECTION OF INFORMATION, INCLUDING SOCIAL SECURITY NUMBER AND WHETHER DISCLOSURE IS MANDATORY OR VOLUNTARY. Authority for maintenance of the system is given under Sections 1102(a), 1819(b)(3)(A), 1819(f), 1919(b)(3)(A), 1919(f) and 1864 of the Social Security Act.

The system contains information on all residents of long-term care (LTC) facilities that are Medicare and/or Medicaid certified, including private pay individuals and not limited to Medicare enrollment and entitlement, and Medicare Secondary Payer data containing other party liability insurance information necessary for appropriate Medicare claim payment. Medicare and Medicaid participating LTC facilities are required to conduct comprehensive, accurate, standardized and reproducible assessments of each resident's functional capacity and health status. To implement this requirement, the facility must obtain information from every resident. This information is also used by the Centers for Medicare & Medicaid Services (CMS) to ensure that the facility meets quality standards and provides appropriate care to all residents. 42 CFR §483.20, requires LTC facilities to establish a database, the Minimum Data Set (MDS), of resident assessment information. The MDS data are required to be electronically transmitted to the CMS National Repository. Because the law requires disclosure of this information to Federal and State sources as discussed above, a resident does not have the right to refuse consent to these disclosures. These data are protected under the requirements of the Federal Privacy Act of 1974 and the MDS LTC System of Records.

2. PRINCIPAL PURPOSES OF THE SYSTEM FOR WHICH INFORMATION IS INTENDED TO BE USED. The primary purpose of the system is to aid in the administration of the survey and certification, and payment of Medicare/Medicaid LTC services which include skilled nursing facilities (SNFs), nursing facilities (NFs) and noncritical access hospitals with a swing bed agreement.

Information in this system is also used to study and improve the effectiveness and quality of care given in these facilities. This system will only collect the minimum amount of personal data necessary to achieve the purposes of the MDS, reimbursement, policy and research functions.

3. ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM. The information collected will be entered into the LTC MDS System of Records, System No. 09-70-0528. This system will only disclose the minimum amount of personal data necessary to accomplish the purposes of the disclosure. Information from this system may be disclosed to the following entities under specific circumstances (routine uses), which include:

  1. To support Agency contractors, consultants, or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS;
  2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent for purposes of contributing to the accuracy of CMS’ proper payment of Medicare benefits and to enable such agencies to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds and for the purposes of determining, evaluating and/or assessing overall or aggregate cost, effectiveness, and/or quality of health care services provided in the State, and determine Medicare and/or Medicaid eligibility;
  3. To assist Quality Improvement Organizations (QIOs) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Title XI or Title XVIII of the Social Security Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans;
  4. To assist insurers and other entities or organizations that process individual insurance claims or oversees administration of health care services for coordination of benefits with the Medicare program and for evaluating and monitoring Medicare claims information of beneficiaries including proper reimbursement for services provided;
  5. To support an individual or organization to facilitate research, evaluation, or epidemiological projects related to effectiveness, quality of care, prevention of disease or disability, the restoration or maintenance of health, or payment related projects;
  6. To support litigation involving the agency, this information may be disclosed to The Department of Justice, courts or adjudicatory bodies;
  7. To support a national accrediting organization whose accredited facilities meet certain Medicare requirements for inpatient hospital (including swing beds) services;
  8. To assist a CMS contractor (including but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program to combat fraud, waste and abuse in certain health benefit programs; and (9) To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste and abuse in a health benefits program funded in whole or in part by Federal funds.

4. EFFECT ON INDIVIDUAL OF NOT PROVIDING INFORMATION. The information contained in the LTC MDS System of Records is generally necessary for the facility to provide appropriate and effective care to each resident.

If a resident fails to provide such information, e.g. thorough medical history, inappropriate and potentially harmful care may result. Moreover, payment for services by Medicare, Medicaid and third parties, may not be available unless the facility has sufficient information to identify the individual and support a claim for payment.

NOTE: Residents or their representative must be supplied with a copy of the notice. This notice may be included in the admission packet for all new nursing home admissions, or distributed in other ways to residents or their representative(s). Although signature of receipt is NOT required, providers may request to have the Resident or his or her Representative sign a copy of this notice as a means to document that notice was provided and merely acknowledges that they have been provided with this information.

Your signature merely acknowledges that you have been advised of the foregoing. If requested, a copy of this form will be furnished to you.

 * If signing on the Residents behalf, please provide the Resident's name in the Resident section.

Resident*

Date *

Responsible Party*

Date *

Note: The Resident, not the Responsible Person, is responsible for the bill.

By submitting this Form, please be aware that an electronic signature is as legally binding as a handwritten signature.

NOTE: Providers may request to have the Resident or his or her Representative sign a copy of this notice as a means to document that notice was provided. Signature is NOT required. If the Resident or his or her Representative agrees to sign the form it merely acknowledges that they have been advised of the foregoing information. Residents or their Representative must be supplied with a copy of the notice. This notice may be included in the admission packet for all new nursing home admissions.

Legal Notice Regarding MDS 3.0 - Copyright 2011 United States of America and interRAI. This work may be freely used and distributed solely within the United States. Portions of the MDS 3.0 are under separate copyright protections; Pfizer Inc. holds the copyright for the PHQ-9; Confusion Assessment Method. © 1988, 2003, Hospital Elder Life Program. All rights reserved. Adapted from: Inouye SK et al. Ann Intern Med. 1990; 113:941-8. Both Pfizer Inc. and the Hospital Elder Life Program, LLC have granted permission to use these instruments in association with the MDS 3.0.