to15_t2017-amend_2.pdf

TRICARE Operations Manual 6010.59-M, April 1, 2015

SUMMARY OF CHANGES

This change includes multiple clerical edits in addition to the changes specified below.

CHAPTER 1

1. Section 2. Language clarified to include meetings and conferences.

2. Section 4.

a. Removed language “as directed by HHS, for ICD-10 implementation.”

b. Clarified supervisory review of appeals, grievances, correspondence and telephone responses.

c. Clarified location and submission time for quality review audits.

d. Removed vulnerability assessment requirements contained in OMB’s Circular A-123.

CHAPTER 2

3. Section 2. Transaction testing requirements added.

4. Section 3. Language clarified interim self-assessment reports will be provided to the Government at 30 intervals following submission of the Network Implementation Plan.

5. Section 4.

a. Clarified enrollment for dual processing period requirements.

b. Clarified that DMDC will provide the initial enrollment policy information using an Enrollment Gold File.

c. Clarified “enrollment freeze” shall be global for each contract transition.

d. Clarified that incoming contractor shall coordinate transition of allotment data.

CHAPTER 5

6. Section 1.

a. Clarified Participation on Claims date.

b. Clarified that incoming contractor shall submit its implementation plan for network access standard reporting in accordance with the CDRL.

CHAPTER 6

7. Section 1. Clarified effective date of Enrollment.

1 June 22, 2015

CHAPTER 7

8. Section 1. Expanded the requirements for Medical Management Training.

9. Section 2. Clarified SNF preauthorization note for dual eligible beneficiaries.

CHAPTER 9

10. Section 1. Clarified electronic mail may be a record or a non-record.

CHAPTER 10

11. Section 3. Deleted Recoupment of Hospice Overpayments.

CHAPTER 11

12. Section 6. Clarified “busy signal level” for telephones.

CHAPTER 13

13. Section 2.

14. Addendum A. Clarified Violation of Participation Agreement or Reimbursement Limitation.

CHAPTER 15

15. Section 1. Clarified Memorandum of Understanding requirements.

CHAPTER 17

16. Section 3. Deleted Medical and Dental Care for Former Member with Serious Illness or Injuries.

CHAPTER 18

17. Section 2.

a. Clarified Fixed Transformation Payment Calculation.

b. Clarified the Shared Savings or Incentive Payment Calculation.

2 June 22, 2015

CHAPTER 19

18. Section 2. Relocated Ongoing Transaction Testing to Chapter 2, Section 10, Transitions.

CHAPTER 20

19. Section 5. Added a reference to location of processing standards for TDEFIC written inquiry responses.

CHAPTER 22

20. Section 1. Clarified that the contractor may retain fees associated with the processing of insufficient fund payments.

21. Section 2.

a. Clarified that the contractor may retain fees associated with the processing of insufficient fund payments.

b. Clarified TRS Customer Education requirements.

c. Clarified TRR Customer Education requirements.

CHAPTER 24

22. Section 7. Added language regarding claims jurisdiction for ambulance/aeromedical evacuation based on the patient’s location.

23. Section 9. Clarification added for Overseas Drafts/Checks and EOBs.

24. Section 15. Added language requiring reports and plans to include responsible contractor personnel contact information.

25. Section 18.

a. Added language regarding fully documenting out-of-area care.

b. Clarification provided on TOP PCM responsibility.

CHAPTER 25

26. Section 1. Clarified that the contractor may retain fees associated with the processing of insufficient fund payments.

3 June 22, 2015

CHAPTER 26

27. Section 1.

a. This change clarifies that the entire CHCBP program is run by the East MCSC and clarifies eligibility for CHCBP.

b. Added the ability for the contractor to charge a $20 fee in instances of insufficient funds to pay premiums.

INDEX

28. Updated to reflect changes made in Chapter 2.

4 June 22, 2015

HPOS HPOB April 1, 2015

The TRICARE Operations Manual (TOM), 6010.59-M provides operational guidance for contractors who are contractually bound by part, or all, of this manual.

The TRICARE Manuals provide instructions, guidance and responsibilities in addition to the requirements set forth in the incorporated federal statutes and the regulations and may not be interpreted in contradiction thereto.

John L. Arendale, Section Branch Chief Health Plan Operations Sections (HPOS) Branch

(HPOB)

Defense Health Agency (DHA)

Definitions are available in the Apr 2015 TRICARE Operations Manual (TOM), Appendix A.

Acronyms and Abbreviations are available at http://www._______________.

Foreword

Administration Chapter 1 Section 2

Contract Administration And Instructions

Revision:

1.0 TRICARE MANUALS

These include the TRICARE Operations Manual (TOM), TRICARE Policy Manual (TPM), TRICARE Reimbursement Manual (TRM), and TRICARE Systems Manual (TSM). The TRICARE Manuals are the principal vehicles for general operating instructions to all health care delivery contractors and may be accessed at http://manuals.tricare.osd.mil/. The official archive copies of these documents are maintained at Defense Health Agency (DHA). The documents and all official changes to them will be maintained at DHA in an electronic medium using the PDF (Portable Document Format) format, and are available at the above web site. Distribution of paper copies will be on an exception basis.

Regardless of publication medium, their printed and displayed appearance will be identical. The principal means of distribution will be via an electronic notification of publication and the contractor’s subsequent download of the manual or change from the above web site. All proposed changes to these documents will be distributed for review and comment in an electronic medium, using PDF as the document format, and comments must be returned to DHA in an acceptable electronic format.

Contractors shall furnish the DHA Procuring Contracting Officer (PCO) with designated point(s) of contact and e-mail address(es) for review and comment on proposed manual changes, and notification of the final publication of manual changes.

2.0 IMPLEMENTATION OF MANUAL CHANGES

The contractor shall implement changes in requirements as specified by the PCO. If a contractor is unable to comply by the effective date, the PCO shall be notified in writing. The notification shall include the reasons for the noncompliance and a plan for reaching compliance. The proposal shall include milestones, if appropriate, and a firm date for completion.

3.0 COMMUNICATIONS WITH DHA

The contractor shall:

3.1 Provide complete replies to DHA requests for Rough Order Of Magnitude (ROM) estimates, comments, and/or cost estimates on proposed changes to the manuals no later than 30 days from the date of the request. In addition, in the event of an urgent need imposed by law or a program requirement under which significant loss to the Government would result from delay, a period of less than 30 days will be imposed, whether it is a major or minor change.

3.2 Provide timely responses to all requests for information directed to them by DHA.

http://manuals.tricare.osd.mil/

Chapter 1, Section 2

Contract Administration And Instructions

3.3 Use assigned Contracting Officer’s Representative (COR) at DHA as the initial POC for program interpretation or other forms of operational guidance.

4.0 DHA-REQUIRED MEETINGS

Generally, a 14 calendar day notice will be provided for all meetings hosted by DHA. The contractor shall provide representation at two regional contractors/TRICARE Regional Offices (TROs), meetings/conferences and two regional provider conferences. The contractor shall provide up to four contractor representatives at up to four additional meetings at the direction of the PCO per contract year.

5.0 DHA DELEGATION OF RESPONSIBILITY

Responsibility has been delegated to DHA Communications, to perform the following:

• Grant exceptions to the claims filing deadline.

• Grant “good faith payments.”

• Waive the signature requirements on TRICARE claims.

• Adjudicate and process unique claims requiring special handling, and claims for emergency care provided by a Department of Veterans Affairs (DVA) facility or a facility under the Bureau of Indian Affairs (BIA).

• Authorize benefits for which the authority has not otherwise been delegated to other DHA officials or contractors.

• Authorize an “override” of information contained on Defense Enrollment Eligibility Reporting System (DEERS), pending a system update, based on appropriate documentation regarding eligibility under the law, regulation and policy.

- END -

Chapter 1, Section 3

TRICARE Processing Standards

• Self referrals and referrals of beneficiaries who use Other Health Insurance (OHI) as first payor;

• MTF/eMSM directed referrals to non-network providers when network providers are available; and

• The eight mental health self-referrals.

All other referrals are included without exception.

1.2.3 In addition to the referral timeliness standards identified in paragraph 1.2.1, the contractor shall achieve and continuously maintain a referral processing accuracy percentage of at least 95% during Option Period 1. Beginning with Option Period 2, this referral processing accuracy standard shall increase by 1% each Option Period until the standard reaches 99% during Option Period 5. For purposes of evaluation, a referral shall be considered to be processed accurately when all three of the following actions are performed correctly:

• Consideration of Right of First Refusal (ROFR) rules;

• Verification of beneficiary eligibility in Defense Enrollment Eligibility Reporting System (DEERS); and

• Issuance of an authorization to an appropriate provider/facility based on the referral.

Referrals which do not result in an authorization (e.g., a referral which is returned to the MTF/eMSM for missing information) shall not be considered in calculating referral processing accuracy.

1.2.4 The contractor shall provide reports as described in the Contract Data Requirement List

(CDRL).

1.3 Network Adequacy

Starting in Option Period 1, the following percent of claims for Prime enrollees region-wide (excluding TPR enrollees) will be for care rendered by a network provider. This includes all claims for Prime enrollees except emergency room claims, Point of Service (POS) claims, or claims with OHI.

• Ninety percent (90%) Option Period 1.

• Ninety-one percent (91%) Option Period 2.

• Ninety-two percent (92%) Option Period 3.

• Ninety-three percent (93%) Option Period 4.

• Ninety-four percent (94%) Option Period 5.

1.4 Claims Processing Timeliness

Unless otherwise specified, the standards below apply to all claims.

TRICARE Processing Standards

• Invalid header conditions;

• Invalid record type;

• Invalid contractor number;

• Invalid voucher/batch identifier;

• Invalid voucher/batch date;

• Invalid sequence number;

• Invalid resubmission number;

• Invalid period begin date;

• Invalid period end date;

• Invalid total number of records; and

• Invalid total amount paid.

2.0 MANAGEMENT

2.1 Filing

The contractor shall file all hard copy, microform copies and digital/optical disk imaging of claims/adjustment claims, with attached documentation by Internal Control Number (ICN) and by state or contract number within five calendar days after they are processed to completion. The claim and all supporting documents shall be maintained in hard copy, microcopy, or digital image or optical disk.

Provisions shall be made for appropriate retention and disposition of files in accordance with the Federal Records Act and DHA instructions (see Chapter 9).

2.2 Availability Of Information

Information required for appropriate responses to inquiries, including but not limited to claim files, appeals files, previous correspondence, and check files shall be retrievable and forwarded within five workdays following a request for the information.

3.0 BENEFICIARY AND PROVIDER SERVICES (BPS)

For all processing standards, the actual date of receipt shall be counted as the first day. The date the reply is mailed shall be counted as the processed to completion date. The standards with which the contractor shall comply include:

3.1 Routine Written Inquiries

All routine written inquiries shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide final responses to routine written inquiries as follows:

• Eighty-five percent (85%) within 15 calendar days of receipt;

• Ninety-seven percent (97%) within 30 calendar days of receipt; and

• One hundred percent (100%) within 45 calendar days of receipt.

3.2 Priority Written Inquiries (Congressional, ASD(HA), And DHA)

All priority written inquiries shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide final responses to priority

TRICARE Processing Standards written inquiries as follows:

• Eighty-five percent (85%) within 10 calendar days of receipt.

• One hundred percent (100%) within 30 calendar days of receipt.

3.3 Walk-In Inquiries (TRICARE Overseas Contract Only)

• Ninety-five percent (95%) of walk-in inquiries shall be acknowledged and be assisted by a service representative within 15 minutes of entering the reception area.

• Ninety-nine percent (99%) of walk-in inquiries shall be acknowledged and assisted by a service representative within 20 minutes of entering the reception area.

3.4 Telephone Inquiries

The following required levels of service shall be available at all times - daily, weekly, monthly, etc. Averages are not acceptable.

• Blockage rates shall not exceed 5%.

• The call abandonment rate shall be less than 5%.

• The average speed of answer shall not exceed 45 seconds.

• If transferred to an individual, 90% of all calls shall be answered by an individual (not an answering machine) within 30 seconds.

• Total “on hold” time for 95% of all calls shall not exceed 30 seconds during the entire telephone call.

• Eighty-five percent (85%) of all telephone caller inquiries shall achieve resolution in one call. (Includes calls transferred to an individual.)

• Ninety-nine and one-half percent (99.5%) of all inquiries not fully and completely resolved on the initial call shall be fully and completely resolved to the customer’s satisfaction within 10 business days.

4.0 APPEALS

4.1 Expedited Preadmission/Preprocedure Reconsiderations

One hundred percent (100%) of requests for expedited preadmission/preprocedure reconsiderations shall be processed to completion within three working days of the date of receipt by the contractor of the reconsideration request (unless the reconsideration is rescheduled at the written request of the appealing party). Expedited preadmission/preprocedure requests are those requests filed by the beneficiary within three calendar days after the beneficiary receipt of the initial denial determination.

TRICARE Processing Standards

4.2 Nonexpedited Medical Necessity Reconsiderations

From the date of receipt by the contractor until processed to completion, the contractor shall meet the following processing standards for non-expedited medical necessity reconsiderations:

• Ninety-five percent (95%) within 30 calendar days; and

• One hundred percent (100%) within 60 calendar days.

4.3 Nonexpedited Factual Reconsiderations

From the date of receipt by the contractor until processed to completion, the contractor shall meet the following standards for non-expedited factual reconsiderations:

• Ninety-five percent (95%) within 30 calendar days of receipt; and

• One hundred percent (100%) within 60 calendar days from the date of receipt of the reconsideration request. The date of completion is considered to be the date the reconsideration determination is mailed to the appropriate parties.

4.4 Determinations Reversed by the Appeals Process

One hundred percent (100%) of contractor determinations reversed by the appeals process shall be processed to completion within 21 calendar days of receipt.

5.0 GRIEVANCES

All written grievances shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide interim written response by the 30th calendar day after receipt for all grievances not processed to completion by that date. The interim response shall include an explanation for the delay and an estimated date of completion. Ninety-five percent (95%) of all grievances shall be processed to completion within 60 calendar days from the date of receipt.

6.0 POTENTIAL DUPLICATE CLAIM RESOLUTION

6.1 The contractor shall utilize the automated TRICARE Duplicate Claims System (DCS) to resolve DHA identified potential duplicate claims payments.

6.2 The contractor shall move Open status potential duplicate claim sets to Pending, Validate, or Closed status on a first-in/first-out basis. To this end, contractor performance will be measured against the percentage of claim sets in Open status at the end of a month with load dates over 30 days old. No more than 10% of the potential duplicate claim sets remaining in Open status at the end of a month shall have load dates over 30 days old. Contractor compliance with this standard shall be determined from the Performance Standard Report generated by the DCS (see the TRICARE Systems Manual (TSM), Chapter 4, Addendum C, Summary/Management Report entitled “Performance Standard,” for a description and example of the Performance Standard Report). The 10% standard becomes effective on the first day of the seventh month following the SHCD or following system installation whichever is later.

TRICARE Processing Standards

6.3 The contractor shall not be responsible for meeting the performance standard during any month in which access to the DCS is prevented for two working days due to failure of any system component for which the Government is responsible.

6.4 All overpayment recovery, refund, offset collection and adjustment requirements, including timeliness standards, are applicable to the operation of the DCS. Offsets shall be applied against any future payments to a debtor until the debt is satisfied.

7.0 DEBT COLLECTION RESEARCH ASSISTANCE

The contractor shall meet required response times for problem resolution (Standard: 85% within 10 days, 100% within 30 days). Resolution is the completion is defined as: Completely review all contractor actions on the claims, the correction of all contractor errors including the expeditious reprocessing of all claims with identified errors, preparing and providing a written explanation of any beneficiary liability and the provision of a case-specific response to the Government. If applicable, the response to the Debt Collection Assistance Officer (DCAO) should note that a check is being issued to the beneficiary or provider on a priority basis, and the approximate date payment is expected.

Administration Chapter 1 Section 4

Management

Revision:

1.0 GENERAL

The contractor shall establish and maintain sufficient staffing and management support services and commit all other resources and facilities necessary to achieve and maintain compliance with all quantitative and qualitative standards for claims processing timeliness, claims inventory levels, claims control, and claims accuracy. The requirements below outline minimum requirements of Defense Health Agency (DHA). Contractors are encouraged to develop and employ the most effective management techniques available to ensure economical and effective operation.

2.0 SYSTEM ADDITIONS OR ENHANCEMENTS

2.1 Implementation of Changes in Program Requirements

The contractor shall have the capacity, using either directly employed personnel or contracted personnel, to maintain and operate all required systems and to achieve timely implementation of changing program requirements.

2.2 Maintaining Current Status of Diagnostic and Procedural Coding Systems (PCS)

Contractors are required to use the current versions of the updated American Medical Association Physicians Current Procedural Terminology, 4th Edition (CPT-4), and the International Classification of Diseases, 9th Revision, Clinical Modification (ICD-9-CM) diagnostic coding system; and any special codes that may be directed by DHA. Beginning with dates of service on or after the mandated date, as directed by Health and Human Services (HHS), for International Classification of Diseases, 10th Revision (ICD-10) implementation, for outpatient facility and all non-facility services, and for inpatient facility charges with discharge dates on or after the mandated date, as directed by HHS, for ICD-10 implementation, contractors will be required to replace the use of ICD-9-CM diagnosis codes with the current version of the ICD-10-CM and the International Classification of Diseases, 10th Revision, Procedure Coding System (ICD-10-PCS) for inpatient hospital procedures. The contractor is responsible for using the most current codes correctly. That responsibility includes making any needed revisions required by periodic CPT-4 and ICD-9-CM or ICD-10-CM and ICD-10-PCS updates issued by the publishers. When updates occur, contractors will be notified of the date the TRICARE Encounter Data (TED) editing system will be accepting changes in the codes.

2.3 Zip Code File

The contractor shall maintain and update an electronic file of all zip codes using a Government-furnished electronic zip code directory. The contractor shall incorporate this electronic file in its claims

Chapter 1, Section 4

Management processing system to determine the validity of a beneficiary or provider zip code. This directory will be provided by the Government no less than four and no more than 12 times per calendar year. Updates to the electronic zip code directory for the purposes of contract modifications, directed policy actions, and expansion or termination of zip codes by the U.S. Postal Service (USPS), shall be accomplished at no additional cost to the Government.

2.4 Updating And Maintaining TRICARE Reimbursement Systems

The contractor, at no additional cost to the Government and as directed by DHA shall implement all policy changes and clarifications to existing TRICARE reimbursement systems affecting both the level of payment and the basic method of reimbursement as they apply to current provider categories implemented at the time of contract award. The TRICARE Reimbursement Manual (TRM) is the source for instructions and guidance on all existing reimbursement systems for current provider categories.

3.0 MANAGEMENT CONTROLS

The contractor shall develop and employ management procedures necessary to ensure control, accuracy, and timeliness of transactions associated with operation of their call center, TRICARE Service Center (TSC) functions (TRICARE overseas contract only), enrollment, authorizations, provider referrals, claims processing, beneficiary services, provider services, reconsiderations, grievances, Automatic Data Processing (ADP), and financial functions. These procedures include such elements as:

3.1 An automated claims aging report, by status and location, for the purpose of identifying backlogs or other problem areas delaying claims processing. At a minimum, this report must be sorted to enable a count of the total number of claims pending for a specified length of time, e.g., the time periods specified in the Monthly Cycle Time/Aging Report.

3.2 An automated returned claims report counting the number of claims returned by the time periods specified in the Monthly Cycle Time/Aging Report.

3.3 Procedures to assure ensure confidentiality of all beneficiary and provider information, to assure ensure that the rights of the individual are protected in accordance with the provisions of the Privacy Act and the HIPAA and Health and Human Services (HHS) Privacy Regulation and prevent unauthorized use of DHA files.

3.4 A system to control adjustments to processed claims which will document the actual date the need for adjustment is identified, the reason for the adjustment and the names of both the requesting and authorizing persons. The controls shall also ensure the accurate and timely update of the beneficiary history files, the timely and accurate submission of the TED data and issuance of the proper notice to the beneficiaries and providers affected by the adjustments.

3.5 A set of processing guidelines, desk instructions/user’s manuals and reference materials for internal use. These materials shall be maintained, on a current basis, for the life of the contract. Desk instructions shall be available to each employee in the immediate work area. Reference material such as procedure codes, diagnostic codes, and special processing guidelines, shall be available to each work station with a need for frequent referral. Other reference materials shall be provided in each unit with a reasonable need and in such quantity as to ensure the ease of availability needed to facilitate work flow. Electronic versions may be used.

Management

4.0 QUALITY CONTROL

4.1 The contractor shall develop and implement an end-of-processing quality control program which assures accurate input and correct payments for authorized services received from certified providers by eligible beneficiaries.

4.2 The contractor shall have a quality control program consisting of supervisory review on all of appeals, grievances, correspondence, and telephone responses. This must begin by the end of the third month after the start of health care delivery (SHCD) and be carried out monthly thereafter. The review shall include a statistically valid sample or 30 records, which ever whichever is greater, of all each of the following: appeals, grievances, and correspondence processed and telephonic responses completed.

The criteria for review shall be accuracy and completeness of the written or telephonic response, clarity of the response, and timeliness with reference to the quantitative standards for the processing of appeals, grievances, and correspondence. Any lack of courtesy or respect in the response shall also be noted. All findings shall be documented, provided to DHA Contracting Officer’s Representative (COR) staff, or authorized auditors, and used in a documented training program.

4.3 The quality review program will sample each quarter, a sufficient number of all processed claims and adjustments to ensure maintenance of the required quality of adjudication and processing and provide adequate management control. Claims in the sample shall include all claim types and be selected randomly, or by other acceptable statistical methods, in sufficient number to yield at least a 90% confidence level with a precision of 2%. The sample will be drawn at or near the end of each quarter from claims completed during the review period. The contractor may draw the sample up to 15 calendar days prior to the close of the quarter, but must include claims completed in the period between the date the sample is drawn and the close of the quarter in the next quarterly sample. The contractor shall reflect the inclusive processing dates of the claims in the sample in the report submitted to DHA. The sampling will begin by the end of the first quarter of processing.

Documentation of the results shall be completed within 45 calendar days of the close of each contract quarter.

4.4 The contractor shall retain copies of the reviewed claims, appeals, grievances, correspondence, and related working documents, in separate files, for a period of no less than four months following submission of audit results to the Procuring Contracting Officer (PCO). DHA staff will review the results and will on a regular basis audit a selected sampling of the audited/quality review documents., either at the contractor’s site or via forwarding of selected work for review at DHA. The review may occur at the contractor’s site or at a location specified by DHA. The contractor shall provide all documentation supporting this review within 10 calendar days of a DHA request.

5.0 STAFF TRAINING PROGRAM

The contractor shall develop and implement a formal initial and ongoing staff training program including training on program updates as they occur, to ensure a high quality of service to beneficiaries and providers. Such training shall include mandatory, documented training in Confidentiality of Patient Records (42 United States Code (USC) [290dd-3]) requirements (see Section 5). The contractor shall not only provide education in on these requirements but must document the personnel files of the staff members who receive the training. Centralized documentation shall also be maintained of the training session agendas, identity of attendees, actual dates and duration of training sessions, etc. The contractor is also responsible for ensuring that subcontractor staff is also fully trained.

Management

6.0 INTERNAL AUDITS AND MANAGEMENT CONTROL PROGRAMS

6.1 Using its corporate internal review capability, the contractor is responsible for verifying that accounting data are correct, reliable and comply with all Government accounting standards and requirements. The contractor’s corporate internal review staff must conduct regular, routine reviews to ensure proper monitoring in the areas of finance, financial accounting, internal controls, special checks issued and returned, and selected history maintenance transactions for possible fraud or abuse.

6.2 Within one year of the start of health care delivery (SHCD), and any time a new function is added to requirements, contractor management shall perform vulnerability assessments in accordance with the Office of Management and Budget’s (OMB’s) Circular A-123.

6.3 An internal control review of all functions which are rated as highly vulnerable shall be performed by the corporate audit staff within one year of the date of the vulnerability assessment.

Within three years of the date of the vulnerability assessment, the internal audit staff shall make an internal control review of all functions rated as having a medium vulnerability. Internal control reviews shall be performed in accordance with the OMB’s Circular A-123.

7.0 BENEFICIARY SURVEYS

In accordance with Department of Defense Instruction (DoDI) 1100.13, and Health Affairs Policy Memorandum 97-012, surveys of military members, retirees and their families must be approved and licensed through issuance of a Report Control Symbol (RCS). Contractors shall not conduct written or telephonic beneficiary surveys without the approval of the DHA Decision Support Division (DSD). DHA has an ongoing survey research and analysis program which includes periodic population-based and encounter-based surveys of DoD beneficiaries. The surveys address beneficiary information seeking strategies and preferences, health status, use of care, satisfaction with military and civilian care, and attitudes toward TRICARE. The data are collected at the Prime Service Area (PSA) level and can be aggregated to the regional level. Regional reports containing PSA data are available through the Director, TRICARE Regional Offices (TROs)/Program Office. Contractors shall work with the Director, TROs/Program Offices to define both their ongoing and special purpose requirements for survey data.

Contractors with special needs not met by an existing instrument may submit surveys, sampling plans, and cost estimates through the Director, TROs/Program Office to the DHA, DSD, for approval and licensing.

Chapter 1, Section 5

Compliance With Federal Statutes created or received by or on behalf of a covered entity (health care provider that conducts standard electronic transactions, health plan, or health care clearinghouse). It relates to the past, present, or future physical or mental health or condition of a beneficiary; the provision of health care to a beneficiary; or the past, present, or future payment for the provision of health care to a beneficiary; and it identifies the beneficiary, or could be used to identify the beneficiary. The protected status of PHI continues for 50 years after death of the beneficiary. PHI excludes such health information held in employment or educational records.

1.4.2 Electronic Protected Health Information (ePHI)

ePHI is PHI in electronic form.

1.4.3 Personally Identifiable Information (PII)

PII is any information about a beneficiary that identifies, links, relates, or is unique to, or describes him or her, e.g., a Social Security Number (SSN); age; military rank; civilian grade; marital status; race; salary; home/office phone number; other demographic; biometric; personnel; medical; and financial information; and any other information that is linked or linkable to a specific beneficiary.

1.4.4 Record

A record is any item, collection, or grouping of information about a beneficiary which is maintained (collected, used or disseminated) by TRICARE or a TRICARE contractor, including, but not limited to, his or her education, financial transactions, medical history, and criminal or employment history, and which contains the beneficiary’s name or the identifying number, symbol, or other personal identifiers.

1.4.5 Privacy Act System of Records (SOR)

A Privacy Act SOR is a group of records containing PII/PHI maintained by or on behalf of DoD where the PII/PHI in the records is specifically retrieved by personal identifiers.

1.4.6 Medical/Dental Claim History Files

This term includes, but is not limited to, any record of claims or billings for medical, dental, hospital or related services, application or approval forms which reflect diagnoses, treatment or medical conditions, family history files, or any other correspondence, memorandum or report reflecting these data with respect to any beneficiary which are acquired or used by the contractor in the development and processing of claims or in carrying out the other functions under the TRICARE contract.

Note: The term “TRICARE Contractor Claims Records” is used by the National Archives and Records Administration (NARA). The terms “Medical/Dental Claim History Files (formerly “Beneficiary History and Deductible Files”) includes but is not limited to “TRICARE Contractor Claims Records”.

1.4.7 Routine Use

With respect to the disclosure of a record from a Privacy Act SOR, a routine use is defined in the DoD Privacy Act Issuances.; Also see also the Defense Privacy and Civil Liberties Office’s (DPCLO’s)

Compliance With Federal Statutes published list of blanket routine uses for sharing PII outside the agency.

2.0 PRIVACY ACT

Under the Privacy Act, contractors must assure that PII about beneficiaries collected in TRICARE records is limited to that which is legally authorized and necessary, and is maintained in a manner which assures its confidentiality. TRICARE records are property of the United States (U.S.) Government.

2.1 Contractor Procedures for Handling Inappropriate Disclosures of Data (Breaches)

2.1.1 A breach, as defined in DoD 5400.11-R, is the actual or possible loss of control, unauthorized disclosure, or unauthorized access of PII where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected. A “possible breach” means a known occurrence that is suspected to constitute a breach; an “actual breach” is a known occurrence that has been confirmed as constituting a breach. A HIPAA Breach is a breach that satisfies the HIPAA Breach Rule definition of a breach in 45 CFR 164.402.

2.1.2 The contractor must comply with the breach response requirements under the DoD Privacy Act Issuances. Such compliance shall begin with the initial breach response activity set forth in paragraph 2.2, including the one hour and 24 hour reporting deadlines. The contractor should consult with the Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility to report (e.g., if the contractor discovers a breach not caused by the contractor), or when the contractor is uncertain as to whether an occurrence must be treated as a possible breach.

2.1.3 Cybersecurity incidents may or may not involve a breach of PII/PHI. In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity requirements under its contract. If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (suspected or confirmed), the contractor shall immediately initiate the breach response procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and applicable DoD cybersecurity requirements under its contract and the TRICARE Systems Manual (TSM).

2.1.4 Contractors, when acting as HIPAA-covered entities (rather than as business associates), are not subject to the breach response requirements of this Manual.

2.2 Breach Response

2.2.1 As required by the Department of Homeland Security (DHS), within one hour of a breach discovery, the contractor shall report the breach, suspected or confirmed, to the United States- Computer Emergency Readiness Team (US-CERT) Incident Reporting System at https://forms.us-cert.gov/report/. Before submission to US-CERT, the contractor shall save a copy of the on-line report.

After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to DHA as described in paragraph 2.2.6. Information may not be known or complete, but available information shall be reported within the one hour deadline for submission.

https://forms.us-cert.gov/report/ https://forms.us-cert.gov/report/

Compliance With Federal Statutes

2.2.2 The contractor shall provide any updates to the information by e-mail to soc@us-cert.gov, with the Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the DHA Privacy Office, not the US-CERT office.

2.2.3 In conjunction with submitting the US-CERT report, the contractor shall immediately take steps to minimize the impact of a breach and initiate further investigation of any relevant details.

2.2.4 The contractor shall report a PII/PHI breach (suspected or confirmed) by submitting the form specified below within 24 hours of discovery to the DHA Privacy Office.

2.2.5 The breach reports required within the 24 hour deadline shall be sent by e-mail to:

PrivacyOfficerMail@dha.mil. Encryption is not required, because reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed in writing as soon as technically feasible.

2.2.6 Contractors shall prepare the breach reports required within the 24 hour deadline by completing the Breach Reporting Form DD 2959 (Breach of PII Report), available at the Breach Response link on the DHA Privacy Office web site, http:// www.tricare.mil/tma/privacy/breach.aspx. The contractor shall coordinate with the Privacy Office for subsequent action such as beneficiary notification, and mitigation. The corresponding Contract Data Requirements List (CDRL) provides guidance on completing and updating the Breach Reporting Form DD 2959. The contractor must promptly update the DD Form 2959 as new information becomes available.

2.2.7 If the DHA Privacy Office determines that beneficiary notification is required, the contractor shall provide written notification to beneficiaries affected by the breach as soon as possible, but no later than 10 working days after the breach is discovered and the identities of the beneficiaries are ascertained. The 10 day period begins when the contractor is able to determine the identities (including addresses) of the beneficiaries whose records were impacted.

2.2.8 The contractor’s proposed notification to be issued to the affected beneficiaries shall be submitted to the Privacy Office for approval. The notification to the beneficiaries, at a minimum, shall include the following:

• Specific data elements.

• Basic facts and circumstances.

• Recommended precautions the beneficiary can take.

• Federal Trade Commission (FTC) identity theft hotline information.

• Any mitigation support services offered such as credit monitoring.

2.2.9 Contractors shall ensure that envelopes containing written notifications to affected beneficiaries are clearly labeled to alert the recipient to the importance of its contents, e.g., “Data Breach Information Enclosed,” and that the envelope is marked with the identity of the contractor and/ or subcontractor organization that suffered the breach.

2.2.10 If notification cannot be accomplished within 10 working days, the contractor shall notify the Privacy Office to determine needed follow-up actions.

http:// www.tricare.mil/tma/privacy/breach.aspx

Compliance With Federal Statutes

2.2.11 If media notice is required, the contractor will submit a proposed notice and suggested media outlets for Privacy Office review (which will include coordination with the DHA Office of Strategic Communications) and approval.

2.2.12 The contractor shall, at no cost to the Government, bear any costs associated with a breach of PII/PHI that the contractor has caused or is otherwise responsible for addressing.

2.3 System of Records (SOR) Maintained or Operated by Contractors

2.3.1 Contractor activity is typically associated with the SOR described in System of Records Notice (SORN) EDTMA 04 - Medical/Dental Claim History Files (note that physical location of records in this SOR may be decentralized). However, some contractor records may instead be associated with the following SORs:

• EDTMA 01 - Health Benefits Authorization Files;

• EDTMA 02 - Medical/Dental Care and Claims Inquiry Files;

• EDHA 06 - Designated Provider Managed Care System Records, formerly known as USTF Managed Care System;

• EDHA 07 - Military Health Information System; and

• EDHA 08 - Health Affairs Survey and Study Data Base.

Except for “routine use” disclosures and other authorized disclosures as provided in DoD 5400.11-R, C4.1.1.3 and C4.2, no record contained in a SOR operated and maintained by the contractor for the Government shall be disclosed to any person or to any agency outside DoD without prior written consent or request of the beneficiary to whom the record pertains.

2.3.2 The Privacy Act permits use of PII throughout the Military Health System (MHS) for legitimate mission purposes, including when TRICARE contractors have a need for the records in the performance of their duties. TRICARE contractors should be aware that TRICARE Beneficiary Counseling and Assistance Coordinators (BCACs), Debt Collection Assistance Officers (DCAOs), and Uniformed Services Claims Officers (USCOs) are employees of the DoD authorized to receive information from TRICARE records if they have a need for the information in the performance of their duties. A TRICARE BCAC, DCAO, USCO, or other authorized DHA/MHS representative who is assisting a beneficiary may receive TRICARE information pertaining to that beneficiary, provided that the identity and authority of such representative is verified (e.g., through the Customer Service Community Directory). The restriction on disclosure of only that information directly releasable to the beneficiary also applies to the BCAC, DCAO, USCO, or other representative.

2.3.3 Following proper SORN publication and Government confirmation of contractor authority to operate the applicable system(s), the contractor shall coordinate through the DHA Privacy Office, regarding any needed updates. The contractor shall promptly advise the DHA Privacy Office of changes in SORs or their use that may require a change in the applicable SORN, whether EDTMA 04 or otherwise.

Compliance With Federal Statutes

2.4 Confidentiality Of Medical/Dental Claim History Files

Certain categories of PII/PHI (such as SSN or Date of Birth (DOB) data, or PHI relating to mental health, sexually transmitted disease, etc.) are sensitive. Except as otherwise permitted in this paragraph or as permitted by law, the contractor shall not release such sensitive PII/PHI to a third party unless the beneficiary who is the subject of the PII/PHI has specifically consented to disclosure of such sensitive information in accordance with applicable consent/authorization requirements (under Privacy Act, HIPAA, or Substance Abuse and Mental Health Services Administration (SAMHSA) rules). However, if the contractor is uncertain about whether disclosure without consent is warranted (for example, on the basis of a HIPAA Privacy Rule exception), the contractor shall consult with DHA Privacy Office or DHA Office of General Counsel (OGC). In determining what PHI is sensitive, the contractor may take into account the Explanation of Benefits (EOB) issuance exceptions in Chapter 8, Section 8, the contractor’s own internal guidelines, and/or the contractor’s case-by-case determinations.

2.5 Collecting Information

2.5.1 The Privacy Act requires personal information to be collected, to the greatest extent practicable, directly from the subject beneficiary when the information may result in adverse determinations about the beneficiary’s rights, benefits, or privileges under federal programs. The collection of information from third parties shall be minimized except where there is a need to obtain the information directly from a third party, such as a need to verify information provided by the subject beneficiary.

2.5.2 Whenever PII is solicited and collected (by paper, electronic, or verbal means) from a beneficiary for a SOR, a Privacy Act Statement (PAS) shall be provided. The PAS informs the beneficiary of the authority for soliciting and collecting PII, the principal purposes for which that PII will be used, where that PII may be disclosed outside of DoD, whether furnishing that information is voluntary or mandatory, and the effects on the beneficiary of choosing not to provide all or part of that requested PII. The PAS must be conspicuously posted before the point of collection. On paper forms this usually means placing the PAS at the beginning of the form, immediately following the title, before the first official heading/selection, or immediately prior to the first collection field. On electronic forms, this means placing the PAS so that the beneficiary sees it before providing information. A PAS may not be displayed via a hyper-link or pop-up that the beneficiary could bypass. When information is collected by telephone, a brief oral explanation of the Privacy Act shall be given to the beneficiary. The following text illustrates acceptable language for an oral PAS, showing the mandatory portion of the PAS with example language in bold (this is only illustrative; modify as needed):

This information is being collected to: Process your request to change your provider.

Providing this information is: Voluntary. However, failure to provide all requested information may result in a delay or denial of your request to change your provider.

This information may be disclosed for routine uses consistent with why it was collected.

This information is being collected under the authority of: 10 U.S.C. Chapter 55; 32 CFR Part 199; and E.O. 9397 (SSN), as amended.

Compliance With Federal Statutes the record, shall be sent to DHA, ATTENTION: OGC, within 10 working days of receipt of the request.

Written acknowledgment of receipt of the request for amendment shall be provided to the beneficiary.

2.8 Accounting For Disclosures

2.8.1 The Privacy Act requires an accurate accounting for disclosures of PII to third parties outside the DoD that are not disclosures under the FOIA or disclosures to DoD personnel for use in official duties. Such accounting requires tracking:

• The name and address of the person and, if appropriate, the agency to whom the disclosure is made.

• The date, nature, and purpose of each disclosure.

• For disclosures requiring consent, the consent of the beneficiary to whom the record pertains.

2.8.2 The contractor must keep a record of each disclosure or be able to reconstruct from its system the required accounting information when needed. Accounting records must be retained for at least five years after the last disclosure, to assure compliance with HIPAA as well as the Privacy Act. If the PII to which the accounting request applies includes PHI, then the contractor must apply the disclosure accounting requirements of the HIPAA Privacy Rule and DoD 6025.18-R, C13 in such a manner that both the Privacy Act and the HIPAA Privacy Rule are satisfied. See the provisions on HIPAA accounting in Chapter 19, Section 3 and TSM, Chapter 1, Section 1.1.

2.9 Safeguards

Contractors must implement administrative and physical safeguards to protect Medical/Dental Claim History Files from unauthorized or unintentional access, disclosure, modification, or destruction.

All persons whose official duties require access to or processing and maintenance of personal information shall be advised of the proper safeguarding and use of such information. In addition, all employees should be aware of their responsibilities under the Privacy Act.

2.10 General Correspondence

In responding to general correspondence, the reply should be sent to the beneficiary regardless of who made the inquiry. If a spouse or other family member makes an inquiry concerning a beneficiary’s claim, etc., the inquiry shall not be returned to the spouse or family member unanswered.

Rather, a reply should be addressed to the beneficiary with an explanation that under the Privacy Act the reply could not be made to the spouse or family member who made the inquiry. Also, if an inquiry is made by the beneficiary, including an eligible family member regardless of age, the reply shall be addressed to the beneficiary, not the beneficiary’s spouse (Service member) or parent. The only exceptions are when a parent writes on behalf of a minor child (under 18 years of age) or when a guardian writes on behalf of a physically or mentally incompetent beneficiary.