TO15C-0AOComposite.pdf

TRICARE Operations Manual 6010.59-M, April 1, 2015

D R A F T

Revision:

Chapter 1 - Administration

Chapter 2 - Records Management

Chapter 3 - Financial Administration

Chapter 4 - Provider Certification And Credentialing

Chapter 5 - Provider Networks

Chapter 6 - Enrollment

Chapter 7 - Utilization And Quality Management

Chapter 8 - Claims Processing Procedures

Chapter 9 - TRICARE Duplicate Claims System (DCS) - TRICARE Encounter Data (TED) Version

Chapter 10 - Claims Adjustments And Recoupments

Chapter 11 - Beneficiary Education And Support Division (BE&SD)

Chapter 12 - Appeals And Hearings

Chapter 13 - Program Integrity

Chapter 14 - Audits, Inspections, And Reports

Chapter 15 - TRICARE Regional Offices (TROs)/Military Treatment Facility (MTF)/Enhanced Multi-Service Market (eMSM) and Contractor Interfaces

Chapter 16 - TRICARE Prime Remote (TPR) Program

Chapter 17 - Supplemental Health Care Program (SHCP)

Chapter 18 - Demonstrations

Chapter 19 - Health Insurance Portability and Accountability Act (HIPAA) of 1996

Chapter 20 - TRICARE Dual Eligible Fiscal Intermediary Contract (TDEFIC)

Chapter 21 - TRICARE Alaska

Chapter 22 - Reserve Component Health Coverage Plans

Chapter 23 - TRICARE Pharmacy (TPharm)

Chapter 24 - TRICARE Overseas Program (TOP)

Chapter 25 - TRICARE Young Adult (TYA)

Chapter 26 - Continued Health Care Benefit Program (CHCBP)

Appendix A - Definitions

Index

D R A F T

Chapter 1

Administration

Revision:

Section/Addendum Subject/Addendum Title

1 Organization Of The TRICARE Management Activity (TMA)

2 Contract Administration And Instructions

3 TRICARE Processing Standards

4 Management

5 Compliance With Federal Statutes

6 Legal Matters

7 Transitions

Administration

D R A F T

Chapter 1 Section 1

Organization Of The TRICARE Management Activity (TMA)

Revision:

Chapter 55, Title 10, of the United States Code (USC), provides that the Secretary of Defense and the Secretary of Health and Human Services (HHS) shall jointly prescribe regulations for the administration of TRICARE. Department of Defense Directive (DoDD) 5136.12 (The TMA Charter) established TMA as a field activity under the policy guidance and direction of the Assistant Secretary of Defense (Health Affairs) (ASD(HA)).

- END -

Administration

D R A F T

Chapter 1 Section 2

Contract Administration And Instructions

Revision:

1.0 TRICARE MANUALS

These include the TRICARE Operations Manual (TOM), TRICARE Policy Manual (TPM), TRICARE Reimbursement Manual (TRM), and TRICARE Systems Manual (TSM). The TRICARE Manuals are the principal vehicles for general operating instructions to all health care delivery contractors and may be accessed at http://manuals.tricare.osd.mil/. The official archive copies of these documents are maintained at TRICARE Management Activity (TMA). The documents and all official changes to them will be maintained at TMA in an electronic medium using the PDF (Portable Document Format) format, and are available at the above web site. Distribution of paper copies will be on an exception basis.

Regardless of publication medium, their printed and displayed appearance will be identical. The principal means of distribution will be via an electronic notification of publication and the contractor’s subsequent download of the manual or change from the above web site. All proposed changes to these documents will be distributed for review and comment in an electronic medium, using PDF as the document format, and comments must be returned to TMA in an acceptable electronic format.

Contractors shall furnish the TMA Procuring Contracting Officer (PCO) with designated point(s) of contact and e-mail address(es) for review and comment on proposed manual changes, and notification of final publication of manual changes.

2.0 IMPLEMENTATION OF MANUAL CHANGES

The contractor shall implement changes in requirements as specified by the PCO. If a contractor is unable to comply by the effective date, the PCO shall be notified in writing. The notification shall include the reasons for the noncompliance and a plan for reaching compliance. The proposal shall include milestones, if appropriate, and a firm date for completion.

3.0 COMMUNICATIONS WITH TMA

The contractor shall:

3.1 Provide complete replies to TMA requests for Rough Order Of Magnitude (ROM) estimates, comments, and/or cost estimates on proposed changes to the manuals no later than 30 days from the date of the request. In addition, in the event of an urgent need imposed by law or a program requirement under which significant loss to the Government would result from delay, a period of less than 30 days will be imposed, whether it is a major or minor change.

3.2 Provide timely responses to all requests for information directed to them by TMA.

http://manuals.tricare.osd.mil/

Chapter 1, Section 2

Contract Administration And Instructions

D R A F T

3.3 Use assigned Contracting Officer’s Representative (COR) at TMA as the initial POC for program interpretation or other forms of operational guidance.

4.0 TMA-REQUIRED MEETINGS

Generally, a 14 calendar day notice will be provided for all meetings hosted by TMA. The contractor shall provide representation at two regional contractors/TRICARE Regional Offices (TROs), and two regional provider conferences. The contractor shall provide up to four contractor representatives at up to four additional meetings at the direction of the PCO per contract year.

5.0 TMA DELEGATION OF RESPONSIBILITY

Responsibility has been delegated to TMA, Beneficiary Education and Support Division (BE&SD) to perform the following:

• Grant exceptions to the claims filing deadline;

• Grant “good faith payments”;

• Waive the signature requirements on TRICARE claims;

• Adjudicate and process unique claims requiring special handling, and claims for emergency care provided by a Department of Veterans Affairs (DVA) facility or a facility under the Bureau of Indian Affairs (BIA);

• Authorize benefits for which the authority has not otherwise been delegated to other TRICARE officials or contractors;

• Authorize an “override” of information contained on Defense Enrollment Eligibility Reporting System (DEERS), pending a system update, based on appropriate documentation regarding eligibility under the law, regulation and policy.

Administration

D R A F T

Chapter 1 Section 3

TRICARE Processing Standards

Revision:

1.0 TIMELINESS AND QUALITY STANDARDS OF PERFORMANCE

Contractors are charged with providing or arranging for delivery of quality, timely health care services and have the responsibility for providing the timely and accurate processing of all claims received into their custody, whether for network or non-network care. In addition, the contractor must provide courteous, accurate, and timely response to all inquiries from beneficiaries, providers, TRICARE Management Activity (TMA), and other legitimately interested parties. TMA has established standards of performance which will be monitored by TMA and other government agencies to measure contractor performance. Minimum performance standards are listed below.

1.1 Preauthorizations/Authorizations

The contractor shall issue determinations on at least:

• Ninety percent (90%) of all requests for preauthorization/authorization within two working days following receipt of the request and all required information.

• One hundred percent (100%) of such requests within five working days following receipt of the request and all required information.

1.2 Referrals/Network Adequacy

1.2.1 Following the date of receipt of a request for a referral, the contractor shall issue a referral authorization or denial on at least:

• Ninety percent (90%) of all requests within two workdays

• One hundred percent (100%) of all requests within three workdays

1.2.2 A minimum of 96% of referrals for Prime enrollees who reside in TRICARE Prime Service Areas (PSAs) and Prime enrollees who reside outside PSAs and have waived the travel-time access standards shall be to the Military Treatment Facility (MTF)/Enhanced Multi-Service Market (eMSM) or a civilian network provider. All referrals, except the following, will be included to determine compliance with the standard:

• Referrals that are unknown to the contractor before the visit (specifically Emergency Room (ER) visits, retroactively authorized referrals);

• Self referrals and referrals of beneficiaries who use Other Health Insurance (OHI) as first

Chapter 1, Section 3

TRICARE Processing Standards

D R A F T payor;

• MTF/eMSM directed referrals to non-network providers when network providers are available; and

• The eight mental health self-referrals.

1.2.3 All other referrals are included without exception.

1.3 Network Adequacy

Starting in Option Period (OP) One, the following percent of claims for Prime enrollees region-wide (excluding TPR enrollees) will be for care rendered by a network provider. This includes all claims for Prime enrollees except emergency room claims, Point of Service (POS) claims, or claims with OHI.

• 90% OP 1

• 91% OP 2

• 92% OP 3

• 93% OP 4

• 94% OP 5

This percent for the number of claims from network providers will increase 1% each option period.

1.4 Claims Processing Timeliness

Unless otherwise specified, the standards below apply to all claims.

1.4.1 Retained Claims

1.4.1.1 Ninety-eight (98%) of retained claims and adjustment claims shall be processed to completion within 30 calendar days from the date of receipt.

1.4.1.2 A “retained claim” is defined as any claim retained (held in the contractor’s possession) for any reason. Contractors shall retain all claims that contain sufficient information to allow processing to completion and all claims for which missing information may be developed from in-house sources, including DEERS and contractor operated or maintained electronic, paper, or film files.

Note: Nothing in this definition prohibits a contractor from retaining a claim for external development.

1.4.2 Retained and Excluded Claims

One hundred percent (100%) of all claims (both retained and excluded, including adjustments), shall be processed to completion within 90 calendar days unless the Government specifically directs the contractor to continue pending a claim or group of claims. “Excluded claims” are defined as:

• Claims retained at the discretion of the contractor for the external development of

TRICARE Processing Standards

D R A F T information necessary to process the claim to completion;

• Claims requiring development for possible Third Party Liability (TPL);

• Claims requiring intervention by another Prime contractor; and

• Claims requiring government intervention (i.e., claims held for CHAMPUS Maximum Allowable Charge (CMAC) updates, claims held pending the issuance of a policy change, etc.).

1.5 Claims Processing Cycle

The contractor shall generate an initial submission claims processing cycle and transmit related TRICARE Encounter Data (TED) and required documents to TMA not less than three times every seven calendar days. The contractor shall have an updated beneficiary processed claims history and deductible file available and accessible within one workday following each processing cycle. The contractor shall ensure only one processed claims history and deductible file is maintained for each beneficiary.

1.6 Claims Processing Accuracy

1.6.1 Claim Payment Errors

The absolute value of the payment errors shall not exceed 2% of the total billed charges for the first two option periods. In all remaining option periods, the absolute value of the payment errors shall not exceed 1.75% of the total billed charges.

1.6.2 Claim Occurrence Errors

The TED occurrence error rate shall not exceed 3% for all types of TEDs.

1.7 TEDs - Timeliness

• One hundred percent (100%) of initial submission vouchers/batches shall be transmitted to TMA within five calendar days of the date of the batch/voucher create date.

• Eighty-five percent (85%) of all unprocessable vouchers/batches, including but not limited to, out-of-balance conditions and invalid header record information shall be corrected by the contractor and returned for receipt at TMA within 20 calendar days of the date the invalid data was transmitted to the contractor by TMA.

• One hundred percent (100%) of unprocessable vouchers/batches shall be corrected and returned for receipt at TMA within 30 calendar days of the date the invalid data was transmitted to the contractor by TMA.

• Ninety-nine and one-half percent (99.5%) of all vouchers/batches having TEDs (initial submissions, resubmissions, and adjustment/cancellation submissions) failing the edit system shall be corrected and resubmitted to TMA within 30 calendar days after the errors and rejected TEDs were transmitted to the contractor by TMA. The resubmission data shall

TRICARE Processing Standards

D R A F T contain all TEDs rejected on the voucher/batch in question.

• One hundred percent (100%) of all remaining vouchers/batches having TEDs failing the edit system shall be corrected and resubmitted to TMA within 45 calendar days after the errors and rejected TEDs were transmitted to the contractor by TMA. The resubmission data shall contain all TEDs rejected in the voucher/batch.

1.8 TEDs - Accuracy

1.8.1 Following the start of health care delivery, the contractor shall have the following percentages of TEDs (initial submissions, resubmissions and adjustment/cancellation submissions) passing the TMA edit system at the following time lines:

• One through three months - 80%

• Four through six months - 85%

• Seven through nine months - 90%

• Ten through 11 months - 95%

• Twelve through 23 months - 96%

• Month 24 through contract close - 97%

1.8.2 Vouchers/Batches

Three months following the start work date of the contract, the contractor shall have no more than 2% of the vouchers/batches being unprocessable due to, but not limited to, such problems as:

• Out-of-balance;

• Invalid header conditions;

• Invalid record type;

• Invalid contractor number;

• Invalid voucher/batch identifier;

• Invalid voucher/batch date;

• Invalid sequence number;

• Invalid resubmission number;

• Invalid period begin date;

• Invalid period end date;

• Invalid total number of records; and

• Invalid total amount paid.

2.0 MANAGEMENT

2.1 Filing

The contractor shall file all hard copy, microform copies and digital/optical disk imaging of claims/adjustment claims, with attached documentation by Internal Control Number (ICN) by state or contract number within five calendar days after they are processed to completion. The claim and all supporting documents shall be maintained in hard copy, microcopy, or digital image or optical disk.

Provisions shall be made for appropriate retention and disposition of files in accordance with the Federal Records Act and TMA instructions (see Chapter 2).

TRICARE Processing Standards

D R A F T

2.2 Availability Of Information

Information required for appropriate responses to inquiries, including but not limited to claim files, appeals files, previous correspondence, and check files shall be retrievable and forwarded within five workdays following a request for the information.

3.0 BENEFICIARY AND PROVIDER SERVICES (BPS)

For all processing standards, the actual date of receipt shall be counted as the first day. The date the reply is mailed shall be counted as the processed to completion date. The standards with which the contractor shall comply include:

3.1 Routine Written Inquiries

All routine written inquiries shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide final responses to routine written inquiries as follows:

• Eighty-five percent (85%) within 15 calendar days of receipt;

• Ninety-seven percent (97%) within 30 calendar days of receipt; and

• One hundred percent (100%) within 45 calendar days of receipt.

3.2 Priority Written Inquiries (Congressional, ASD(HA), And TMA)

All priority written inquiries shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide final responses to priority written inquiries as follows:

• Eighty-five percent (85%) within 10 calendar days of receipt;

• One hundred percent (100%) within 30 calendar days of receipt.

3.3 Walk-In Inquiries (TRICARE Overseas Contract Only)

• Ninety-five percent (95%) of walk-in inquiries shall be acknowledged and be assisted by a service representative within 15 minutes of entering the reception area.

• Ninety-nine percent (99%) of walk-in inquiries shall be acknowledged and assisted by a service representative within 20 minutes of entering the reception area.

3.4 Telephone Inquiries

The following required levels of service shall be available at all times - daily, weekly, monthly, etc.

Averages are not acceptable.

• Blockage rates shall never exceed 5%. Never is defined as at any time during any day.

• The call abandonment rate shall be less than 5%.

• The average speed of answer shall not exceed 45 seconds.

TRICARE Processing Standards

D R A F T

• If transferred to an individual, 90% of all calls shall be answered by an individual (not an answering machine) within 30 seconds.

• Total “on hold” time for 95% of all calls shall not exceed 30 seconds during the entire telephone call.

• Eighty-five percent (85%) of all telephone caller inquiries shall achieve resolution in one call.

(Includes calls transferred to an individual.)

• Ninety-nine and one-half percent (99.5%) of all inquiries not fully and completely resolved on the initial call shall be fully and completely resolved to the customer’s satisfaction within 10 business days.

4.0 APPEALS

4.1 Expedited Preadmission/Preprocedure Reconsiderations

One hundred percent (100%) of requests for expedited preadmission/preprocedure reconsiderations processed to completion within three working days of the date of receipt by the contractor of the reconsideration request (unless the reconsideration is rescheduled at the written request of the appealing party). Expedited preadmission/preprocedure requests are those requests filed by the beneficiary within three calendar days after the beneficiary receipt of the initial denial determination.

4.2 Nonexpedited Medical Necessity Reconsiderations

From the date of receipt by the contractor until processed to completion, the contractor shall meet the following processing standards for non-expedited medical necessity reconsiderations:

• Eighty-five percent (85%) within 30 calendar days;

• Ninety-five percent (95%) within 60 calendar days; and

• One hundred percent (100%) within 90 calendar days.

4.3 Nonexpedited Factual Reconsiderations

From the date of receipt by the contractor until processed to completion, the contractor shall meet the following standards for non expedited factual reconsiderations:

• Ninety-five percent (95%) within 60 calendar days of receipt; and

• One hundred percent (100%) within 90 calendar days from the date of receipt of the reconsideration request. The date of completion is considered to be the date the reconsideration determination is mailed to the appropriate parties.

4.4 Determinations Reversed by the Appeals Process

One hundred percent (100%) of contractor determinations reversed by the appeals process shall be processed to completion within 21 calendar days of receipt.

TRICARE Processing Standards

D R A F T

5.0 GRIEVANCES

All written grievances shall be stamped with the actual date of receipt within three workdays of receipt in the contractor’s custody. The contractor shall provide interim written response by the 30th calendar day after receipt for all grievances not processed to completion by that date. The interim response shall include an explanation for the delay and an estimated date of completion. Ninety-five percent (95%) of all grievances shall be processed to completion within 60 calendar days from the date of receipt.

6.0 POTENTIAL DUPLICATE CLAIM RESOLUTION

6.1 The contractor shall utilize the automated TRICARE Duplicate Claims System (DCS) to resolve TMA identified potential duplicate claims payments.

6.2 The contractor shall move Open status potential duplicate claim sets to Pending, Validate, or Closed status on a first-in/first-out basis. To this end, contractor performance will be measured against the percentage of claim sets in Open status at the end of a month with load dates over 30 days old. No more than 10% of the potential duplicate claim sets remaining in Open status at the end of a month shall have load dates over 30 days old. Contractor compliance with this standard shall be determined from the Performance Standard Report generated by the DCS (see Chapter 9, Summary/Management Report entitled “Performance Standards,” for a description and example of the Performance Standard Report). The 10% standard becomes effective on the first day of the seventh month following the start of health care delivery or following system installation whichever is later.

6.3 The contractor shall not be responsible for meeting the performance standard during any month in which access to the DCS is prevented for two working days due to failure of any system component for which the Government is responsible.

6.4 All overpayment recovery, refund, offset collection and adjustment requirements, including timeliness standards, are applicable to the operation of the DCS. Offsets shall be applied against any future payments to a debtor until the debt is satisfied.

Administration

D R A F T

Chapter 1 Section 4

Management

Revision:

1.0 GENERAL

The contractor shall establish and maintain sufficient staffing and management support services and commit all other resources and facilities necessary to achieve and maintain compliance with all quantitative and qualitative standards for claims processing timeliness, claims inventory levels, claims control, and claims accuracy. The requirements below outline minimum requirements of TRICARE Management Activity (TMA). Contractors are encouraged to develop and employ the most effective management techniques available to ensure economical and effective operation.

2.0 SYSTEM ADDITIONS OR ENHANCEMENTS

2.1 Implementation of Changes in Program Requirements

The contractor shall have the capacity, using either directly employed personnel or contracted personnel, to maintain and operate all required systems and to achieve timely implementation of changing program requirements.

2.2 Maintaining Current Status of Diagnostic and Procedural Coding Systems (PCS)

Contractors are required to use the current versions of the updated American Medical Association Physicians Current Procedural Terminology, 4th Edition (CPT-4), and the International Classification of Diseases, 9th Revision, Clinical Modification (ICD-9-CM) diagnostic coding system; and any special codes that may be directed by TMA. Beginning with dates of service on or after the mandated date, as directed by Health and Human Services (HHS), for International Classification of Diseases, 10th Revision (ICD-10) implementation, for outpatient facility and all non-facility services, and for inpatient facility charges with discharge dates on or after the mandated date, as directed by HHS, for ICD-10 implementation, contractors will be required to replace the use of ICD-9-CM diagnosis codes with the current version of the ICD-10-CM and the International Classification of Diseases, 10th Revision, Procedure Coding System (ICD-10-PCS) for inpatient hospital procedures. The contractor is responsible for using the most current codes correctly. That responsibility includes making any needed revisions required by periodic CPT-4 and ICD-9-CM or ICD-10-CM and ICD-10-PCS updates issued by the publishers. When updates occur, contractors will be notified of the date the TRICARE Encounter Data (TED) editing system will be accepting changes in the codes.

2.3 Zip Code File

The contractor shall maintain and update an electronic file of all zip codes using a Government-furnished electronic zip code directory. The contractor shall incorporate this electronic file in its claims

Chapter 1, Section 4

Management

D R A F T processing system to determine the validity of a beneficiary or provider zip code. This directory will be provided by the Government no less than four and no more than 12 times per calendar year. Updates to the electronic zip code directory for the purposes of contract modifications, directed policy actions, and expansion or termination of zip codes by the U.S. Postal Service (USPS), shall be accomplished at no additional cost to the Government.

2.4 Updating And Maintaining TRICARE Reimbursement Systems

The contractor, at no additional cost to the Government and as directed by TMA shall implement all policy changes and clarifications to existing TRICARE reimbursement systems affecting both the level of payment and the basic method of reimbursement as they apply to current provider categories implemented at the time of contract award. The TRICARE Reimbursement Manual (TRM) is the source for instructions and guidance on all existing reimbursement systems for current provider categories.

3.0 MANAGEMENT CONTROLS

The contractor shall develop and employ management procedures necessary to ensure control, accuracy, and timeliness of transactions associated with operation of their call center, TRICARE Service Center (TSC) functions (TRICARE overseas contract only), authorizations, provider referrals, claims processing, beneficiary services, provider services, reconsiderations, grievances, Automatic Data Processing (ADP), and financial functions. These procedures include such elements as:

3.1 An automated claims aging report, by status and location, for the purpose of identifying backlogs or other problem areas delaying claims processing. At a minimum, this report must be sorted to enable a count of the total number of claims pending for a specified length of time, e.g., the time periods specified in the Monthly Cycle Time/Aging Report.

3.2 An automated returned claims report counting the number of claims returned by the time periods specified in the Monthly Cycle Time/Aging Report.

3.3 Procedures to assure confidentiality of all beneficiary and provider information, to assure that the rights of the individual are protected in accordance with the provisions of the Privacy Act and the HIPAA and Health and Human Services (HHS) Privacy Regulation and prevent unauthorized use of TMA files.

3.4 A system to control adjustments to processed claims which will document the actual date the need for adjustment is identified, the reason for the adjustment and the names of both the requesting and authorizing persons. The controls shall also ensure the accurate and timely update of the beneficiary history files, the timely and accurate submission of the TED data and issuance of the proper notice to the beneficiaries and providers affected by the adjustments.

3.5 A set of processing guidelines, desk instructions/user’s manuals and reference materials for internal use, at least 10 calendar days prior to the first day of delivery of health care services. These materials shall be maintained, on a current basis, for the life of the contract. Desk instructions shall be available to each employee in the immediate work area. Reference material such as procedure codes, diagnostic codes, and special processing guidelines, shall be available to each work station with a need for frequent referral. Other reference materials shall be provided in each unit with a reasonable need and in such quantity as to ensure the ease of availability needed to facilitate work flow. Electronic versions may be used.

Management

D R A F T

4.0 QUALITY CONTROL

4.1 The contractor shall develop and implement an end-of-processing quality control program which assures accurate input and correct payments for authorized services received from certified providers by eligible beneficiaries.

4.2 The contractor shall have a quality control program consisting of supervisory review on all appeals, grievances, correspondence, and telephone responses. This must begin by the end of the third month of operation and be carried out monthly thereafter. The review shall include a statistically valid sample or 30 records which ever is greater of all appeals, grievances and correspondence processed and telephonic responses completed. The criteria for review shall be accuracy and completeness of the written or telephonic response, clarity of the response, and timeliness with reference to the quantitative standards for the processing of appeals, grievances, and correspondence. Any lack of courtesy or respect in the response shall also be noted. All findings shall be documented, provided to TMA Contracting Officer’s Representative (COR) staff, or authorized auditors, and used in a documented training program.

4.3 The quality review program will sample each quarter, a sufficient number of all processed claims and adjustments to ensure maintenance of quality of adjudication and processing and provide adequate management control. Claims in the sample shall include all claim types and be selected randomly, or by other acceptable statistical methods, in sufficient number to yield at least a 90% confidence level with a precision of 2%. The sample will be drawn at or near the end of each quarter from claims completed during the review period. The contractor may draw the sample up to 15 calendar days prior to the close of the quarter, but must include claims completed in the period between the date the sample is drawn and the close of the quarter in the next quarterly sample. The contractor shall reflect the inclusive processing dates of the claims in the sample in the report submitted to TMA. The sampling will begin by the end of the first quarter of processing.

Documentation of the results shall be completed within 45 calendar days of the close of each contract quarter.

4.4 The contractor shall retain copies of the reviewed claims, appeals, grievances, correspondence, and related working documents, in separate files, for a period of no less than four months following submission of audit results to the Procuring Contracting Officer (PCO). TMA staff will review the results and will on a regular basis audit a selected sampling of the audited/quality review documents, either at the contractor’s site or via forwarding of selected work for review at TMA.

5.0 STAFF TRAINING PROGRAM

The contractor shall develop and implement a formal initial and ongoing staff training program including training on program updates as they occur, to ensure a high quality of service to beneficiaries and providers. Such training shall include mandatory, documented training in Confidentiality of Patient Records (42 United States Code (USC) [290dd-3]) requirements (see Section 5). The contractor shall not only provide education in these requirements but must document the personnel files of the staff members who receive the training. Centralized documentation shall also be maintained of the training session agendas, identity of attendees, actual dates and duration of training sessions, etc. The contractor is also responsible for ensuring that subcontractor staff is also trained.

Management

D R A F T

6.0 INTERNAL AUDITS AND MANAGEMENT CONTROL PROGRAMS

6.1 Using its corporate internal review capability, the contractor is responsible for verifying that accounting data are correct, reliable and comply with all Government accounting standards and requirements. The contractor’s corporate internal review staff must conduct regular, routine reviews to ensure proper monitoring in areas of finance, financial accounting, internal controls, special checks issued and returned, and selected history maintenance transactions for possible fraud or abuse.

6.2 Within one year of the start of health care delivery, and any time a new function is added to requirements, contractor management shall perform vulnerability assessments in accordance with the Office of Management and Budget’s (OMB’s) Circular A-123.

6.3 An internal control review of all functions which are rated as highly vulnerable shall be performed by the corporate audit staff within one year of the date of the vulnerability assessment. Within three years of the date of the vulnerability assessment, the internal audit staff shall make an internal control review of all functions rated as having a medium vulnerability. Internal control reviews shall be performed in accordance with the OMB’s Circular A-123.

Administration

D R A F T

Chapter 1 Section 5

Compliance With Federal Statutes

Revision:

1.0 GENERAL

1.1 Contractors shall comply with all federal laws which apply to the administration of TRICARE health plans. In many situations where federal law is in conflict with the law in the state(s) in which the contractor is based or operating, federal law as applicable to the Department of Defense (DoD) generally has precedence over state law, except as to the health privacy rights of minors. This Manual incorporates by reference the federal regulations and DoD issuances referred to in this Section. If one of these authorities is amended or replaced, the new authority does not become a part of this Manual until it is incorporated under applicable contract change procedures. DoD issuances are available at http://www.dtic.mil/whs/directives.

1.2 A key federal statute relating to information privacy applicable to TRICARE Management Activity (TMA) contractors is the Privacy Act of 1974 (“Privacy Act”), 5 United States Code (USC) 552a. The DoD has implemented the Privacy Act with DoD Directive 5400.11 (2007) and DoD 5400.11-R, referenced in this Manual collectively as “DoD Privacy Act Issuances.” The requirements of the DoD Privacy Act Issuances are addressed below under the heading “Privacy Act” (paragraph 2.0).

1.3 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is another key federal statute governing information privacy. The Department of Health and Human Services (HHS) has issued the HIPAA Privacy, Security, Breach, and Enforcement Rules (collectively, HIPAA Rules). The DoD has implemented the HIPAA Privacy and Security Rules with the following three issuances:

• DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003.

• DoD Instruction (DoDI) 6025.18, “Privacy of Individually Identifiable Health Information in DoD Programs,” December 2, 2009.

• DoD 8580.02-R, “DoD Health Information Security Regulation,” July 12, 2007.

Note: DoD 6025.18-R, DoDI 6025.18, and DoD 8580.02-R are referenced in this Manual collectively as “DoD HIPAA Issuances.” The requirements of the HIPAA Rules and the DoD HIPAA Issuances are addressed primarily in Chapter 19, Section 3.

1.4 The following definitions are applicable to this Section:

1.4.1 Protected Health Information (PHI)

Under the HIPAA Rules, PHI is information in any format (electronic, paper, oral) that is created http://www.dtic.mil/whs/directives

Chapter 1, Section 5

Compliance With Federal Statutes

D R A F T or received by or on behalf of a covered entity (health care provider that conducts standard electronic transactions, health plan, or health care clearinghouse). It relates to the past, present, or future physical or mental health or condition of a beneficiary; the provision of health care to a beneficiary; or the past, present, or future payment for the provision of health care to a beneficiary; and it identifies the beneficiary, or could be used to identify the beneficiary. The protected status of PHI continues for 50 years after death of the beneficiary. PHI excludes such health information held in employment or educational records.

1.4.2 Electronic Protected Health Information (ePHI)

ePHI is PHI in electronic form.

1.4.3 Personally Identifiable Information (PII)

PII is any information about a beneficiary that identifies, links, relates, or is unique to, or describes him or her, e.g., a Social Security Number (SSN); age; military rank; civilian grade; marital status; race; salary; home/ office phone number; other demographic; biometric; personnel; medical;

and financial information; and any other information that is linked or linkable to a specific beneficiary.

1.4.4 Record

A record is any item, collection, or grouping of information about a beneficiary which is maintained (collected, used or disseminated) by TRICARE or a TRICARE contractor, including, but not limited to, his or her education, financial transactions, medical history, and criminal or employment history, and which contains the beneficiary’s name or the identifying number, symbol, or other personal identifiers.

1.4.5 Privacy Act System of Records (SOR)

A Privacy Act SOR is a group of records containing PII/PHI maintained by or on behalf of DoD where the PII/PHI in the records is specifically retrieved by personal identifiers.

1.4.6 Medical/Dental Claim History Files

This term includes, but is not limited to, any record of claims or billings for medical, dental, hospital or related services, application or approval forms which reflect diagnoses, treatment or medical conditions, family history files, or any other correspondence, memorandum or report reflecting these data with respect to any beneficiary which are acquired or used by the contractor in the development and processing of claims or in carrying out the other functions under the TRICARE contract.

Note: The term “TRICARE Contractor Claims Records” is used by the National Archives and Records Administration (NARA). The terms “Medical/Dental Claim History Files (formerly “Beneficiary History and Deductible Files”) includes but is not limited to “TRICARE Contractor Claims Records”.

1.4.7 Routine Use

With respect to the disclosure of a record from a Privacy Act SOR, a routine use is defined in the DoD Privacy Act Issuances; see also the Defense Privacy and Civil Liberties Office’s (DPCLO’s)

Compliance With Federal Statutes

D R A F T published list of blanket routine uses for sharing PII outside the agency.

2.0 PRIVACY ACT

Under the Privacy Act, contractors must assure that PII about beneficiaries collected in TRICARE records is limited to that which is legally authorized and necessary, and is maintained in a manner which assures its confidentiality. TRICARE records are property of the United States Government.

2.1 Contractor Procedures for Handling Inappropriate Disclosures of Data (Breaches)

2.1.1 A breach, as defined in DoD 5400.11-R, is the actual or possible loss of control, unauthorized disclosure, or unauthorized access of PII where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected. A “possible breach” means a known occurrence that is suspected to constitute a breach; an “actual breach” is a known occurrence that has been confirmed as constituting a breach. A HIPAA Breach is a breach that satisfies the HIPAA Breach Rule definition of a breach in 45 CFR 164.402.

2.1.2 The contractor must comply with the breach response requirements under the DoD Privacy Act Issuances. Such compliance shall begin with the initial breach response activity set forth in paragraph 2.2, including the one hour and 24 hour reporting deadlines. The contractor should consult with the Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility to report (e.g., if the contractor discovers a breach not caused by the contractor), or when the contractor is uncertain as to whether an occurrence must be treated as a possible breach.

2.1.3 Cybersecurity incidents may or may not involve a breach of PII/PHI. In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity requirements under its contract. If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (suspected or confirmed), the contractor shall immediately initiate the breach response procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and applicable DoD cybersecurity requirements under its contract and the TRICARE Systems Manual (TSM).

2.1.4 Contractors, when acting as HIPAA-covered entities (rather than as business associates), are not subject to the breach response requirements of this Manual.

2.2 Breach Response

2.2.1 As required by the Department of Homeland Security (DHS), within one hour of breach discovery, the contractor shall report the breach, suspected or confirmed, to the United States- Computer Emergency Readiness Team (US-CERT) Incident Reporting System at https://forms.us-cert.gov/report/. Before submission to US-CERT, the contractor shall save a copy of the on-line report.

After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to TMA as described in paragraph 2.2.6. Information may not be known or complete, but available information shall be reported within the one hour deadline for submission.

https://forms.us-cert.gov/report/ https://forms.us-cert.gov/report/

Compliance With Federal Statutes

D R A F T

2.2.2 The contractor shall provide any updates to the information by e-mail to soc@us-cert.gov, with the Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the TMA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the TMA Privacy Office, not the US-CERT office.

2.2.3 In conjunction with submitting the US-CERT report, the contractor shall immediately take steps to minimize impact of a breach and initiate further investigation of any relevant details.

2.2.4 The contractor shall report a PII/PHI breach (suspected or confirmed) by submitting the form specified below within 24 hours of discovery to the TMA Privacy Office.

2.2.5 The breach reports required within the 24 hour deadline shall be sent by e-mail to:

PrivacyOfficerMail@dha.mil. Encryption is not required, because reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed in writing as soon as technically feasible.

2.2.6 Contractors shall prepare the breach reports required within the 24 hour deadline by completing the Breach Reporting Form DD 2959 (Breach of PII Report), available at the Breach Response link on the TMA Privacy Office web site, http:// www.tricare.mil/tma/privacy/breach.aspx. The contractor shall coordinate with the Privacy Office for subsequent action such as beneficiary notification, and mitigation. The corresponding Contract Data Requirements List (CDRL) provides guidance on completing and updating the Breach Reporting Form DD 2959. The contractor must promptly update the DD Form 2959 as new information becomes available.

2.2.7 If the TMA Privacy Office determines that beneficiary notification is required, the contractor shall provide written notification to beneficiaries affected by the breach as soon as possible, but no later than 10 working days after the breach is discovered and the identities of the beneficiaries are ascertained. The 10 day period begins when the contractor is able to determine the identities (including addresses) of the beneficiaries whose records were impacted.

2.2.8 The contractor’s proposed notification to be issued to the affected beneficiaries shall be submitted to the Privacy Office for approval. The notification to the beneficiaries, at a minimum, shall include the following:

• Specific data elements

• Basic facts and circumstances

• Recommended precautions the beneficiary can take

• Federal Trade Commission (FTC) identity theft hotline information

• Any mitigation support services offered such as credit monitoring

2.2.9 Contractors shall ensure that envelopes containing written notifications to affected beneficiaries are clearly labeled to alert the recipient to the importance of its contents, e.g., “Data Breach Information Enclosed,” and that the envelope is marked with the identity of the contractor and/ or subcontractor organization that suffered the breach.

2.2.10 If notification cannot be accomplished within 10 working days, the contractor shall notify the Privacy Office to determine needed follow-up actions.

http:// www.tricare.mil/tma/privacy/breach.aspx

Compliance With Federal Statutes

D R A F T

2.2.11 If media notice is required, the contractor will submit a proposed notice and suggested media outlets for Privacy Office review (which will include coordination with the TMA Office of Strategic Communications) and approval.

2.2.12 The contractor shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the contractor has caused or is otherwise responsible for addressing.

2.3 System of Records (SOR) Maintained or Operated by Contractors

2.3.1 Contractor activity is typically associated with the SOR described in System of Records Notice (SORN) EDTMA 04 - Medical/Dental Claim History Files (note that physical location of records in this SOR may be decentralized). However, some contractor records may instead be associated with the following SORs:

• EDTMA 01 - Health Benefits Authorization Files;

• EDTMA 02 - Medical/Dental Care and Claims Inquiry Files;

• EDHA 06 - Designated Provider Managed Care System Records, formerly known as USTF Managed Care System;

• EDHA 07 - Military Health Information System; and

• EDHA 08 - Health Affairs Survey and Study Data Base.

Except for “routine use” disclosures and other authorized disclosures as provided in DoD 5400.11-R, C4.1.1.3 and C4.2, no record contained in a SOR operated and maintained by the contractor for the Government shall be disclosed to any person or to any agency outside DoD without prior written consent or request of the beneficiary to whom the record pertains.

2.3.2 The Privacy Act permits use of PII throughout the Military Health System (MHS) for legitimate mission purposes, including when TRICARE contractors have a need for the records in performance of their duties. TRICARE contractors should be aware that TRICARE Beneficiary Counseling and Assistance Coordinators (BCACs), Debt Collection Assistance Officers (DCAOs), and Uniformed Services Claims Officers (USCOs) are employees of the DoD authorized to receive information from TRICARE records if they have a need for the information in the performance of their duties. A TRICARE BCAC, DCAO, USCO, or other authorized TMA/MHS representative who is assisting a beneficiary may receive TRICARE information pertaining to that beneficiary, provided that identity and authority of such representative is verified (e.g., through the Customer Service Community Directory). The restriction on disclosure of only that information directly releasable to the beneficiary also applies to the BCAC, DCAO, USCO, or other representative.

2.3.3 Following proper SORN publication and Government confirmation of contractor authority to operate the applicable system(s), the contractor shall coordinate through the TMA Privacy Office, regarding any needed updates. The contractor shall promptly advise the TMA Privacy Office of changes in SORs or their use that may require a change in the applicable SORN, whether EDTMA 04 or otherwise.

Compliance With Federal Statutes

D R A F T

2.4 Confidentiality Of Medical/Dental Claim History Files

Certain categories of PII/PHI (such as SSN or Date of Birth (DOB) data, or PHI relating to mental health, sexually transmitted disease, etc.) are sensitive. Except as otherwise permitted in this paragraph or as permitted by law, the contractor shall not release such sensitive PII/PHI to a third party unless the beneficiary who is the subject of the PII/PHI has specifically consented to disclosure of such sensitive information in accordance with applicable consent/authorization requirements (under Privacy Act, HIPAA, or Substance Abuse and Mental Health Services Administration (SAMHSA) rules). However, if the contractor is uncertain whether disclosure without consent is warranted (for example, on the basis of a HIPAA Privacy Rule exception), the contractor shall consult with TMA Privacy Office or TMA Office of General Counsel (OGC). In determining what PHI is sensitive, the contractor may take into account the Explanation of Benefits (EOB) issuance exceptions in Chapter 8, Section 8, the contractor’s own internal guidelines, and/or the contractor’s case-by-case determinations.

2.5 Collecting Information

2.5.1 The Privacy Act requires personal information to be collected, to the greatest extent practicable, directly from the subject beneficiary when the information may result in adverse determinations about the beneficiary’s rights, benefits, or privileges under federal programs. The collection of information from third parties shall be minimized except where there is a need to obtain the information directly from a third party, such as a need to verify information provided by the subject beneficiary.

2.5.2 Whenever PII is solicited and collected (by paper, electronic, or verbal means) from a beneficiary for a SOR, a Privacy Act Statement (PAS) shall be provided. The PAS informs the beneficiary of the authority for soliciting and collecting PII, the principal purposes for which that PII will be used, where that PII may be disclosed outside of DoD, whether furnishing that information is voluntary or mandatory, and the effects on the beneficiary of choosing not to provide all or part of that requested PII. The PAS must be conspicuously posted before the point of collection. On paper forms this usually means placing the PAS at the beginning of the form, immediately following the title, before the first official heading/selection, or immediately prior to the first collection field. On electronic forms, this means placing the PAS so that the beneficiary sees it before providing information. A PAS may not be displayed via a hyper-link or pop-up that the beneficiary could bypass. When information is collected by telephone, a brief oral explanation of the Privacy Act shall be given to the beneficiary.