CMS Memorandum: Allowable Use of Medicare Beneficiary Information Obtained from CMS

MEMORANDUM

DATE: October 16, 2009

TO: All Medicare Advantage Organizations, Part D Sponsors, 1876 and 1833 Cost Contractors, PACE and Medicare Advantage Demonstrations

FROM: Teresa DeCaro, RN, M.S, Acting Director
Medicare Drug and Health Plan Contract Administration Group

SUBJECT: Allowable Use of Medicare Beneficiary Information Obtained from CMS

The purpose of this memo is to clarify the use of beneficiary information obtained from CMS by all Medicare Advantage (MA) Contractors, Part D Sponsors, cost contractors, PACE and MA demonstrations (including individual market and employer plans). The policy outlined in this memo supersedes prior guidance on this topic, and we intend to enforce this guidance on a prospective basis.

The CMS restrictions on use of beneficiary data are contained in the Data Use Attestation that is signed by all CMS MA, Part D, PACE, and cost plans in order to participate in the program. By signing the Data Use Attestation, organizations or sponsors agree that, as a condition of having been granted permission to use and receive beneficiary information from CMS databases, they will restrict the use of Medicare data to those purposes directly related to the administration of the Medicare managed care and/or outpatient prescription drug benefits for which they have contracted with CMS to administer.
They also agree not to use that information to develop, market, or operate lines of business unrelated to their Medicare plan operations. [emphasis added]

For purposes of these Data Use Attestations, CMS-provided data includes information provided by beneficiaries in the course of enrollment as well as data obtained solely as a result of access to CMS systems granted to the contracting organization or sponsor because it is a Part C, Part D, PACE or cost plan contractor. Except in cases in which the enrollee gave information as part of a commercial relationship prior to enrollment in the Medicare plan, the contracting organization or sponsor was only given the information on the application as a result of the contract with CMS.

While we feel it is important to protect Medicare beneficiaries from potentially unwelcome marketing and other communications, we also recognize plans’ interest in contacting their enrollees on issues unrelated to the specific plan benefit that they contract with CMS to provide to those enrollees. The current Medicare Marketing Guidelines (hereinafter referred to as “Guidelines” ) outline the requirements for acceptable marketing practices of other health-related lines of business, as well as non-health care related lines of business. Upon review of the Data Use Agreement, we determined that additional guidance related to the distribution of other types of non-plan related information would be of assistance. Attachment 1 [below] to this memo includes a description of that guidance, as well as guidance on obtaining prior authorization from enrollees and on allowable mingling of plan and non-plan information.

The current Medicare Marketing Guidelines can be found at
http://www.cms.hhs.gov/ ManagedCareMarketing on the web. If you have any questions about whether plan communications comply with the MA or Part D program requirements and guidance and Federal law, we encourage you to contact Camille Brown at
camille.brown@cms.hhs.gov.

DEPARTMENT OF HEALTH & HUMAN SERVICES
Centers for Medicare & Medicaid Services
7500 Security Boulevard
Baltimore, Maryland 21244-1850

Allowable Use of Medicare Beneficiary Information Obtained from CMS
Attachment 1
October 16, 2009

Below are the detailed instructions for when prior authorization is required for use of Medicare Beneficiary Information obtained from CMS, followed by how prior authorization may be obtained. Lastly, we outline sending non-plan and non-health related information, once the authorization is approved. A brief review of our current guidance as well as the additional guidance is below. (The Medicare Marketing Guidelines (“Guidelines”) will be updated to reflect these edits on next revision.)

While plans with a previous commercial relationship with Medicare beneficiaries (and employers offering Medicare plans) may have obtained their personal data through that relationship, and therefore are not obligated to follow the guidelines set forth in the Data Use Agreement, we encourage plans to follow these Data Use guidelines as a good business practice for protecting beneficiaries from potentially unwelcome marketing and other communications. Examples of what is considered a previous commercial relationship include membership in such products as:
• Long-term care insurance
• Life-insurance policies
• Non-Medicare employer or retiree plans
• Medigap policies

When authorization is required
A. As outlined in Section 40.14.1 of the Guidelines, plan sponsors are permitted to send current members information about health-related issues, as long as the material includes instructions describing how the individuals may opt-out of receiving such communications. Examples of health-related issues plans may communicate without receiving the prior authorization of current enrollees include:

a. Long-term care insurance
b. Separate dental or vision policies
c. Value-added items and services (VAIS)

B. As outlined in Section 40.14.5 of the Guidelines, plan sponsors are permitted to send current enrollees information about non-health related services/issues, provided they obtain authorization from an enrollee prior to using an enrollee’s protected health information to provide marketing/information about an item or service that is not health-related. Examples of non-health related issues plans may communicate after receiving prior authorization (“opt-in”) of current enrollees include:

a. Accident-only policies
b. Life insurance policies
c. Annuities

C. With the release of this guidance, we clarify that other materials distributed to members that are unrelated to the administration of plan benefits, or are not related to health-related issues or other lines of business offered by the same organization, are also subject
to the prior authorization (“opt-in”) requirements set forth in Section 40.14.5 of the Guidelines. Examples of these types of issues include information on:

a. Volunteer or community activities
b. Pending State or Federal legislation
c. Joining grassroots advocacy organizations and information about such advocacy

D. CMS will continue to permit organizations and sponsors to provide information to their existing enrollees about current plan coverage and other Medicare Advantage, Prescription Drug, or Medigap products offered by that organization or sponsor without any prior authorization from enrollees. Provided that the information is not confusing or misleading, or includes references to information that requires prior authorization, plans may provide relevant plan and health information to members, including monthly newsletters, information on disease management programs, mailings describing rationale on why benefits have changed, and information on Medicaid and other community or social services programs.

Obtaining prior authorization

The following provides guidance on how the prior authorizations may be obtained. With any of these examples, the plan must receive the member’s “opt-in” authorization prior to receiving any non-plan or non-health related information, and plans should keep evidence of authorization for audit purposes.
• Organizations and sponsors may send, at their own expense, written requests to enrollees to obtain the beneficiary’s authorization for the organization or sponsor to contact him/her for purposes unrelated to plan benefits administration or CMS contract execution. The beneficiary must sign and return the request before the plan can send non-plan related materials or information. This authorization may also be obtained by directing a beneficiary to a website to provide the requisite consent. Note that if the plan uses a website for the “opt-in” process, the link from the plan’s Medicare product website must inform the beneficiary that he or she is leaving the Medicare product website and going to the non-Medicare product website. (Guidelines section 100.1)
• Beneficiaries can complete authorization in person at marketing events, health fairs, or other public venues.
• Beneficiaries can complete the authorization over the telephone, provided that the authorization is recorded. The call must be a beneficiary-initiated inbound telephone call.
• Beneficiaries can complete the authorization via an email to the plan, provided that the authorization includes an electronic signature.

Regardless of the method by which the prior authorization is obtained (written, telephonic, on a website, etc), the following rules apply:

1. The request may include one or more types of information for which authorization is being sought. If more than one type of information is on the form, a check box (or verbal agreement, if a telephonic authorization) needs to be assigned to each type of information. Furthermore, the type of information can only be described in general terms.
For example, “Check the boxes of the types of information you would like to receive: life insurance, long-term care insurance, pending State and Federal legislation, grass-roots advocacy.”
2. The request for authorization should not include any non-plan or non-health related content, nor should it be included in the same mailing as information on non-health related issues (Reference B and C, above), unless the plan has previously received prior authorization to send that particular non-health related information to that member. (For example, a request for authorization to send information about life insurance should not include a statement like “Make sure your spouse’s future is secure, with a life insurance policy from us,” and/or should not be sent with documents that include details about the life insurance policy.)
3. The request for authorization can be included in the same mailing as plan-related or health-related mailings to members (Reference A and D, above), so long as allowable by current Guidelines (including section 40.13). The request for authorization may not be included on the enrollment form (whether in hard copy or in electronic forms available via the plan’s website) or made during the processing of a telephonic enrollment.
4. The request for authorization should not be confusing or misleading to members by purporting to have current plan benefit information or by suggesting that the content includes official information from the Medicare program.
5. These requests for authorization are not subject to review by CMS, and should not be uploaded into HPMS. However, per Section 90.20 of the Guidelines, plan sponsors are still responsible for ensuring that all materials intended for Medicare beneficiaries meet the applicable CMS marketing standards as outlined in the guidelines.
6. CMS is adopting the same requirements for these authorizations as required by the HIPAA privacy rule. Additional details on what is required for an acceptable attestation can be found at 45 CFR 164.508 [FN 1].

Sending non-plan and non-health information once prior authorization is received

Any non-plan and non-health related content cannot be given to the members until after the authorization is received. In addition, once the authorization is received,:

1. Non-health related content (Reference B and C, above) cannot be included with plan-related materials. This includes mailings and websites, as well as outbound telephone calls related to current plan information. Note that if the plan uses a website to provide non-health related content, the link from the plan’s Medicare product website must inform the beneficiary that he or she is leaving the Medicare product website and going to the non-Medicare product website. (Guidelines section 100.1)
2. Health-related content (Reference A, above) can be included with plan-related materials. (Guidelines sections 40.14.1 – 40.14.6)

FN 1 As they review the applicable regulatory provisions and draft the necessary documents, plans may wish to look at the guidance CMS provided to its contractors in the CMS Internet-Only Manual System in Pub. 100-01, Medicare General Information, Eligibility, and Entitlement Manual, Chapter 6, Section 190 (I). You can locate this Manual at: http://www.cms.hhs.gov/Manuals/IOM/list.asp.

3. As with all other materials that plans send to Medicare beneficiaries, plans are responsible for ensuring that any non-plan related content provided as a result of beneficiary authorization is accurate and not confusing or misleading, and does not inappropriately imply Medicare’s approval, or suggest that the content includes official information from the Medicare program. In addition, these materials should include the disclaimer, “Medicare has neither reviewed, nor endorses, this information.” (Guidelines section 40.5 and 40.14.6) This also includes any mailing envelopes in which the non-plan related information is sent. (The requirements to label envelopes or mailings in Guidelines 50.6 do not apply to non-plan or non-health related materials.)

If the contracting organization or sponsor wishes to include the request for authorization in plan mailings, as opposed to a separate mailing at its own expense, the claimed administrative costs must reflect an appropriate reduction to reflect the share of the document preparation and mailings cost that is attributable to the organization’s or sponsor’s efforts to seek authorization to send non-plan related materials. (Guidelines section 40.14.1-2)