Program_Memos / 2003 / AB-03-034

Why This Topic Matters

The memo provides operational context for how Medicare privacy obligations were being interpreted and implemented during the HIPAA Privacy Rule transition period. It helps readers understand the scope of CMS oversight, contractor responsibilities, and the general types of privacy-related issues addressed in the guidance.

Article Sections

1. Program Memorandum

   Identifies the transmittal, issuing agencies, date, subject, and general purpose of the memorandum.

2. Privacy Rule Requirements

   Summarizes the HIPAA Privacy Rule framework and describes its relevance to Medicare and CMS operations.

3. Business Associates

   Addresses contractor status and the broader relationship between Medicare contractors and CMS under privacy requirements.

4. Notice of Privacy Practices

   Describes CMS’s beneficiary notice responsibilities and related distribution channels.

5. Authorization

   Reviews the general topic of beneficiary authorizations and CMS’s plan to provide standardized materials.

6. Opportunity to Agree/Object

   Covers permissible disclosures involving individuals, family members, and routine beneficiary communications.

7. Individual Rights and Complaints

   Discusses the types of individual privacy rights and the process for handling complaints and requests.

8. Administrative Requirements

   Summarizes broader administrative obligations, including oversight, training, and internal compliance expectations.

9. Compliance Date

   States the timing for compliance and the effective/implementation dates associated with the memorandum.

10. Attachment

    Introduces the attached question-and-answer material that expands on the memorandum’s privacy implementation topics.

11. Covered Entity

    Explains the general categories of CMS programs treated as covered entities for privacy purposes.

12. CMS Privacy Rule Implementation

    Describes CMS’s internal planning approach for privacy rule implementation and compliance oversight.

13. Budget

    Addresses funding and system-impact questions associated with privacy implementation activities.

14. Access & Amendment

    Summarizes beneficiary access and amendment topics and the distinction between different request types.

15. Accounting for Disclosures

    Covers disclosure accounting topics and CMS’s handling approach for beneficiary-related inquiries.

16. Right to Restrict/Confidential Communications

    Discusses restriction requests and confidential communication considerations within Medicare operations.

17. Complaints

    Outlines complaint handling channels and the role of central office in privacy-related complaints.

18. Authorizations

    Addresses authorization topics and related beneficiary communication procedures.

19. Administrative Requirements

    Further discusses oversight, privacy officers, and training expectations in the Medicare context.

20. Miscellaneous

    Covers additional privacy-related topics including the interaction of federal privacy authorities, state law considerations, call center practices, remote monitoring, trading partner agreements, and electronic claims enrollment.