Information Bulletin 01-11
Alert From HCFA: Confidentiality of Information
There are three reasons for this Information Bulletin:
- To alert nursing home facilities to a situation occurring across country which could jeopardize the confidentiality of patient records.
- To remind all nursing home facility staff of their responsibility to protect residents' clinical records from improper disclosure.
- To strongly encourage nursing home facility staff to read HCFA's "Important Information for Long Term Care Providers About Contractual Agreements Involving MDS Data".
HCFA has recently heard that several providers in different states have received packets from a company that generates and sells QI reports to facilities. The packets include software, along with downloading instructions, from this company. It appears the software is a mechanism for electronically transmitting MDS files from the facility directly to this company. The company then generates a QI report and sends it back to the facility. Staff at some facilities believed this downloading was required by the state or HCFA. This is not the case. HCFA has also received complaints that calls coming from this company can sometimes be perceived as "pressuring" or implying that compliance with the request is "required".
Remember, facilities may only release data to another person or entity if there is a contract in place between the facility and that entity, and that entity has a need to know the MDS information. In such a situation, the contractor or agent is required to "act" in the same manner as the facility. (For example, a nursing facility may contract with a physical therapist or a software vendor to provide services that it cannot provide on its own.) It is important to note that there is no state or federal requirement for facilities to enter into a contract with or submit MDS data to any company. Further, the QI reports from this company are not the same as the national QI's received via HCFA's Standard MDS system.
What is the Federal Regulation relating to a resident's right to privacy?42 CFR 483.10(e) states, under Privacy and Confidentiality,
"The resident has the right to personal privacy and confidentiality of his or her personal and clinical records."
Where can I access "Important Information for Long Term Care Providers About Contractual Agreements Involving MDS Data"?
You can access and print a copy of this information at:
Please Note: At the time of this mailing the above web site address is correct. However CMS web site addresses are subject to change. As MDH becomes aware of these changes we will update the CMS address on this bulletin.
If you have any questions regarding this Information Bulletin, please contact in writing:
Minnesota Department of Health
Compliance Monitoring Division
Licensing and Certification Program
85 East Seventh Place, Suite 300
PO Box 64900
St. Paul, Minnesota 55164-0900
Telephone: (651) 201-4101