As noted by CMS:
"On April 14, 2003, new Federal rules governing the use and disclosure of certain individually identifiable health information by health Plans, health care clearinghouses, certain health care providers ("covered entities"), became enforceable. Medicare Prescription Discount Drug Card Sponsors were added as covered entities by the Medicare Prescription Drug Improvement and Modernization Act of 2003.
The regulatory text of the final rule "Standards for Privacy of Individually Identifiable Health Information" (the "HIPAA Privacy Rule"), as modified, can be found at 45 CFR Parts 160 and 164, Subparts A and E. Part D Plans may use or disclose their members' protected health information as permitted by these regulations and any other applicable privacy laws (for example, more stringent state laws governing the use and disclosure of health information).
The HIPAA Privacy Rule generally allows covered entities to use or disclose this information without beneficiary authorization for treatment, payment, or health care operations (as those terms are defined by the rule) and for a number of public interest or benefit purposes, such as public health activities and research subject to certain requirements. Organizations are not required to obtain authorizations prior to using their Medicare beneficiary members' data to provide information to such members regarding their benefit packages. For additional information regarding the HIPAA Privacy Rule, go to the following:"