A    Safeguarding Confidential Information

Policy

Confidential information must be protected and can only be released as allowed by Federal and State laws, regulations, and administrative policy. The following policies apply to AHCCCS customers as well as people who are not applying for benefits, but their information is gathered by AHCCCS for any reason.

There are two main legal authorities for AHCCCS Medical Assistance confidentiality policy:

·        Title XIX of the Social Security Act restricts the release of confidential information about Medicaid customers for purposes of administering the Medicaid program. 

·        The Health Insurance Portability and Accountability Act (HIPAA) sets privacy and security standards that apply to health care facilities, providers and insurers, including AHCCCS.

NOTE     Both Title XIX and HIPAA may apply to a situation. When this happens, the stricter of the two is applied.

The following information is considered confidential:

·        Names, addresses, ZIP Codes, phone numbers, dates of birth, and Social Security numbers;

·        Social and economic circumstances;

·        Agency evaluations of personal information;

·        Protected health information (PHI), including diagnosis and history of disease or disability and Pre-Admission Screening (PAS);

·        Information received from electronic data matches, including reports from Federal and State systems;

·        Information received from other sources, such as the Arizona Department of Economic Security, Social Security Administration, or private-sector employers;

·        Information received when identifying legally liable third-party sources;

·        Information related to alcohol or drug abuse, communicable disease, Human Immunodeficiency Virus (HIV), Acquired Immune Deficiency Syndrome (AIDS), mental health, developmental disability, or genetic testing; and

Confidential information may be released only as allowed by federal and state law. See MA1602C for detailed policy.

Non-confidential information does not need to be safeguarded. When information cannot be used to identify a specific person, it is not confidential.

Definitions

Legal Authority