NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

24 to disclose PHI “as authorized by laws relating to workers’ compensation or other similar programs…” Workers’ compensation insurance claim reports are not subject to the disclosure restrictions that apply to covered entities. Property/casualty insurance writers maintain uninter- rupted access to all property/casualty insurance claims. However, ISO restricts access by property/casualty insurance writers to claims submitted by covered entities and business associates. • Covered entities and their business associates may continue to report their claim informa- tion and access reports from the system. ISO executes business associate contracts with those customers. The ISO Business Associate Agreement (BAA) has been amended to address the HITECH Act and Final Omnibus Rule requirements. Covered-entity Participating Organizations may continue to access all property/casualty claim information. Under current ISO operating procedures, covered entities and their business associates may also access claim submissions by other covered entities and their business associates, but only if each entity either has or had a relationship with the individual who is the subject of the PHI being requested, the PHI pertains to such relationship, and the disclosure is for the purpose of healthcare fraud and abuse detection or compliance. • Qualified law enforcement Authorized Users will continue to access property/casualty claim information (including National Insurance Crime Bureau (NICB) referrals and claims with case identifiers) that ISO ClaimSearch customers instruct ISO to make available to law enforcement, but will not have direct access to HIPAA claims information. • NICB Participating Organizations will continue to access all property/casualty claims, referred claims, and claims with case identifiers. 2 . HITECH Act and Final Omnibus Rule The HITECH Act portion of the 2009 stimulus bill amended HIPAA to make business associates subject to the same security rules as covered entities and imposes the same penalty structure for violations. Those and other new requirements for business associates were implemented by the Omnibus Rule, which became effective in September 2013. The HITECH Act and Final Omnibus Rule impose other requirements on business associates. Business associates must notify the covered entity of any security breach. In turn, the covered entity must notify the individuals affected and, if the breach involves more than 500 people, generate a media notice. The covered entity must immediately notify the Secretary of Health and Human Services. In addition, all breaches must be recorded and included in an annual report provided to the Secretary of Health and Human Services. ISO is in compliance with each of the HITECH Act’s operative provisions. This document will be updated as required to comply with future changes in the law. 3 . Medicare Secondary Payer (MSP) Section 111 through ISO ClaimSearch When using ISO ClaimSearch to comply with the requirements of Medicare Secondary Payer Section 111 reporting, certain data elements, such as ICD 9 and 10 codes, are required. However, ISO will take steps to ensure that ICD 9 and 10 codes are not disclosed to any external entity. Those data elements and all other Centers for Medicare and Medicaid Services (CMS)-specific fields will be included in reports returned to the entity that submitted the record and to CMS as part of Section 111 compliance reporting. ISO will not include CMS-specific fields of information in match reports returned to other ISO ClaimSearch participants. Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4