T-5 Draft TOM.pdf

TRICARE Operations Manual 6010.59-M, June 1, 2020

Revision:

Foreword

Chapter 1 - Administration

Chapter 2 - Transitions

Chapter 3 - Financial Administration

Chapter 4 - Provider Certification And Credentialing

Chapter 5 - Provider Networks

Chapter 6 - Enrollment

Chapter 7 - Clinical Operations

Chapter 8 - Claims Processing Procedures

Chapter 9 - Records Management (RM)

Chapter 10 - Claims Adjustments And Recoupments

Chapter 11 - Communications and Customer Service (C&CS)

Chapter 12 - Appeals And Hearings

Chapter 13 - Program Integrity

Chapter 14 - Reports

Chapter 15 - Market Directors, MTF Directors, and Contractor Interfaces

Chapter 16 - TRICARE Prime Remote (TPR) Program

Chapter 17 - Supplemental Health Care Program (SHCP)

Chapter 18 - Demonstrations And Pilot Projects

Chapter 19 - Health Insurance Portability and Accountability Act (HIPAA) of 1996

Chapter 20 - TRICARE Medicare Eligible Program (TMEP)

Chapter 21 - TRICARE Alaska

Chapter 22 - Reserve Component Health Coverage Plans

Chapter 23 - TRICARE Pharmacy (TPharm)

Chapter 24 - TRICARE Overseas Program (TOP)

Chapter 25 - TRICARE Young Adult (TYA)

Chapter 26 - Continued Health Care Benefit Program (CHCBP)

Chapter 27 - Telehealth

Chapter 28 - Prescription Monitoring Program (PMP)

Appendix A - Definitions

Chapter 1

Administration

Section/Addendum Subject/Addendum Title

1 Organization Of The Defense Health Agency (DHA)

2 Contract Administration And Instructions

3 TRICARE Processing Standards

4 Management

5 Compliance With Federal Statutes

6 Legal Matters

Chapter 1 Section 1

Organization Of The Defense Health Agency (DHA)

Chapter 55, Title 10, of the United States Code (USC), provides that the Secretary of Defense and the Secretary of Health and Human Services (HHS) will jointly prescribe regulations for the administration of TRICARE. Department of Defense Directive (DoDD) 5136.13 (The DHA Charter) established DHA as an agency under the policy guidance and direction of the Assistant Secretary of Defense (Health Affairs) (ASD(HA)).

- END -

Chapter 1 Section 2

Contract Administration And Instructions

1.0 TRICARE MANUALS

1.1 These include the TRICARE Operations Manual (TOM), TRICARE Policy Manual (TPM), TRICARE Reimbursement Manual (TRM), and TRICARE Systems Manual (TSM). The TRICARE Manuals are the principal vehicles for general operating instructions to all health care delivery contractors and may be accessed at https://manuals.health.mil/. The official archive copies of these documents are maintained at Defense Health Agency (DHA). The documents and all official changes to them will be maintained at DHA in an electronic medium using the PDF (Portable Document Format) format, and are available at the above web site. Distribution of paper copies will be on an exception basis. Regardless of publication medium, their printed and displayed appearance will be identical. The principal means of distribution will be via an electronic notification of publication and the contractor’s subsequent download of the manual or change from the above website.

1.2 The Government will distribute all proposed changes to these documents for review and comment in an electronic medium, using PDF as the document format.

2.0 IMPLEMENTATION OF MANUAL CHANGES

2.1 The contractor shall implement changes in requirements as specified by the Contracting Officer (CO).

2.2 The contractor shall notify the CO in writing within 10 calendar days if a contractor is unable to comply by the effective date. The notification shall include the reasons for the noncompliance and a proposed plan for reaching compliance.

2.3 The contractor’s proposed plan shall include milestones, if appropriate, and a firm date for completion.

3.0 COMMUNICATIONS WITH DHA

3.1 The contractor shall furnish the CO with designated point(s) of contact and email address(es) for review and comment on proposed Manual changes, and notification of the final publication of Manual changes.

3.2 The contractor shall provide complete replies to routine DHA requests for Rough Order Of Magnitude (ROM) estimates, comments, and cost estimates on proposed changes https://manuals.heatlh.mil/ to the Manuals no later than 30 calendar days from the date of the request.

3.3 The contractor shall provide complete replies to urgent DHA requests for ROM estimates, comments, and cost estimates on proposed changes to the Manuals as directed by the Government (less than 30 calendar days from the date of the request). Urgent DHA requests will be generated in the event of an urgent need imposed by law or a program requirement under which significant loss to the Government would result from delay, whether it is a major or minor change.

3.4 The contractor shall return comments to DHA in a format agreed upon by the Government prior to the submission.

3.5 The contractor shall meet the suspense date for responses to requests for information directed to them by the CO.

3.6 The contractor shall use assigned Contracting Officer’s Representative (COR) at DHA as the initial POC for program interpretation or other forms of operational guidance.

4.0 DHA-REQUIRED MEETINGS

The contractor shall provide up to four representatives at up to four DHA-sponsored meetings or conferences per option year. The Government will provide a 14 calendar day notice for all DHA-sponsored meetings or conferences.

5.0 DHA DELEGATION OF RESPONSIBILITY

Responsibility has been delegated to a Government Designated Authority (GDA) to perform the following:

• Grant exceptions to the claims filing deadline.

• Grant “good faith payments.”

• Waive the signature requirements on TRICARE claims.

• Adjudicate and process unique claims requiring special handling, and claims for emergency care provided by a Department of Veterans Affairs (DVA)/Veterans Health Administration (VHA) facility or a facility under the Bureau of Indian Affairs (BIA).

• Authorize benefits for which the authority has not otherwise been delegated to other

DHA officials or contractors.

• Authorize an “override” of information contained on Defense Enrollment Eligibility Reporting System (DEERS), pending a system update, based on appropriate documentation regarding eligibility under the law, regulation and policy.

Chapter 1 Section 3

TRICARE Processing Standards

1.0 TIMELINESS AND QUALITY STANDARDS OF PERFORMANCE

1.1 The contractor shall provide or arrange for delivery of quality, timely health care services and timely and accurate processing of claims received into its custody, whether for network or non-network care.

1.2 The contractor shall provide courteous, accurate, and timely responses to inquiries from beneficiaries, providers and Defense Health Agency (DHA).

1.3 The contractor shall provide management reports which identify actual contractor performance in relation to contract standards. Details for reporting are identified in DD Form 1423, Contract Data Requirements List (CDRL), located in Section J of the applicable contract.

1.4 DHA has established standards of performance which will be monitored by DHA and other Government agencies to measure contractor performance. Minimum performance standards are listed below.

2.0 ENROLLMENT

2.1 The contractor shall process Primary Care Manager (PCM) change requests received from the Government furnished web-based self-service enrollment system/application within six calendar days of receiving the request.

2.1.1 The contractor shall modify the effective date to be the date the contractor received the request, or the date requested by the beneficiary up to 90 calendar days in the future.

2.2 The incoming contractor shall submit the transfer of enrollment to Defense Enrollment Eligibility Reporting System (DEERS) using the Government-furnished systems application, within four calendar days of receipt of a beneficiary request. For enrollment transfers rules refer to Chapter 6, Section 1 for effective date rules.

2.3 The contractor shall record enrollments using the Government-furnished web-based enrollment system/application within 10 business days of receipt.

2.3.1 The contractor shall provide the equipment needed to run the DEERS desktop enrollment application and shall meet technical specifications in the TRICARE Systems Manual

(TSM), Chapter 3.

2.4 The contractor shall process all PCM change requests submitted by beneficiaries enrolled to a civilian network PCM via any means other than the Government-furnished web-based self-service enrollment system/application within three business days of receipt, with an effective date no later than the third business day.

2.5 The Markets/Military Medical Treatment Facilities (MTFs) may request PCM reassignment, including panel reassignments using telephone, email or other electronic submissions. The preferred method for panel reassignments is the batch staging application within PCM Panel Reassignment tool (PCMRA). Regardless of the submission method, the Market/MTF will provide sufficient information identifying both the PCMs and beneficiaries involved in a move to allow the contractor to reasonably accomplish the move.

2.5.1 The contractor shall process each Direct Care (DC) PCM reassignment, both individual and panel reassignment, within three business days of receiving all required information from the Market/MTF.

3.0 CUSTOMER SERVICE

3.1 Beneficiary And Provider Services (BPS)

For all processing standards, the actual date of receipt shall be counted as the first day. The date the reply is mailed shall be counted as the processed to completion date.

3.2 The contractor shall comply with the following standards:

3.2.1 Telephone Inquiries

The following required levels of service shall be available at all times (e.g., daily, weekly, and monthly). Averages are not acceptable.

• Blockage rates shall not exceed 5%

• The average speed of answer shall not exceed 20 seconds

• The call abandonment rate shall be less than 5%

• Total “on hold” time for 95% of all calls shall not exceed 2 minutes during the entire telephone call

• 85% of all telephone caller inquiries shall achieve resolution in one call. (Includes calls transferred to an individual)

• Response accuracy 90% (responses provided by Call Center staff shall be accurate and complete according to the terms of the contract and all applicable TRICARE programs and policies).

Note: ASA- The average time the agent took to answer beneficiary's calls. This time includes the time while the agent's phone rings and the time waiting in queue, however does not include the time spent navigating the IVR.

3.2.2 Routine Written Inquiries

https://manuals.health.mil/pages/DisplayManualHtmlFile/TO15/62/AsOf/ts15/c3TOC.html#FM15637

3.2.2.1 The contractor shall stamp all routine written inquiries with the actual date of receipt within three business days of receipt in the contractor’s custody.

3.2.2.2 The contractor shall provide final responses to routine written inquiries as follows:

• 85% within 15 calendar days of receipt

• 97% within 30 calendar days of receipt, and

• 100% within 45 calendar days of receipt

3.2.3 Priority Written Inquiries (Congressional, Assistant Secretary of Defense-Health Affairs (ASD-HA), And DHA)

3.2.3.1 All priority written inquiries shall be stamped with the actual date of receipt within three business days of receipt in the contractor’s custody.

3.2.3.2 The contractor shall provide final responses to priority written inquiries as follows:

• 85% within 10 calendar days of receipt

• 100% within 30 calendar days of receipt

3.2.4 Grievances

3.2.4.1 The contractor stamp all written grievances with the actual date of receipt within three business days of receipt in the contractor’s custody.

3.2.4.2 The contractor shall provide interim written response by the 30th calendar day after receipt for all grievances not processed to completion by that date. The interim response shall include an explanation for the delay and an estimated date of completion. Ninety-five percent (95%) of all grievances shall be processed to completion within 60 calendar days from the date of receipt.

3.2.5 Walk-In Inquiries (TRICARE Overseas Contract Only)

• 95% of walk-in inquiries shall be acknowledged and be assisted by a service representative within 15 minutes of entering the reception area

• 99% of walk-in inquiries shall be acknowledged and assisted by a service representative within 20 minutes of entering the reception area

4.0 NETWORK ADEQUACY

4.1 Starting in Option Period 1, the following percent of claims for Prime enrollees region-wide in the contractor’s geographic area of responsibility (excluding TRICARE Prime Remote (TPR)/TRICARE Prime Remote for Active Duty Family Members (TPRADFM) enrollees) will be for care rendered by a network provider. This includes all claims for Prime enrollees except emergency room claims, urgent care claims, Point-of-Service (POS) claims, or claims with Other Health Insurance (OHI).

• 90% Option Period 1

• 91% Option Period 2

• 92% Option Period 3

• 93% Option Period 4

• 94% Option Period 5

• 95% Option Periods 6 through 8.

4.2 A minimum of 96% of referrals for Prime enrollees who reside in TRICARE Prime Service Areas (PSAs) and Prime enrollees who reside outside PSAs and have waived the travel-time access standards shall be to the Market/MTF or a civilian network provider. All referrals, except the following, will be included to determine compliance with the standard:

• Referrals that are unknown to the contractor before the visit (specifically Emergency Room (ER) visits, retroactively authorized referrals)

• Self-referrals and referrals of beneficiaries who use OHI as first payor

• MTF/Market directed referrals to non-network providers when network providers are available

• All other referrals are included without exception

5.0 PREAUTHORIZATIONS/AUTHORIZATIONS AND REFERRALS

5.1 Preauthorizations/Authorizations

5.1.1 The contractor shall issue determinations on at least:

• 90% of all requests for preauthorization/authorization within two business days following receipt of the request and all required information

• 100% of such requests within five business days following receipt of the request and all required information

• 100% of all Urgent authorizations shall be processed within one business day

5.2 Referral Processing

5.2.1 The contractor shall issue a referral authorization or denial following the date of receipt of a request for a referral, on at least:

•90% of all requests within eight business hours •100% of all requests within two business days •100% of all Urgent referrals shall be processed within eight business hours

5.2.2 The contractor shall achieve and continuously maintain a referral and authorization processing accuracy percentage of at least 95% during Option Period 1. Beginning with Option Period 2, this referral and authorization processing accuracy standard shall increase by 1% each Option Period until the standard reaches 99% during Option Period 5 and remain at 99% for the remainder of the contract, in addition to the referral timeliness standards identified in paragraph

5.2.1. For purposes of evaluation, a referral and authorization shall be considered to be processed accurately when all of the following actions are correctly performed and correctly reflected on the referral and authorization.

5.2.2.1 Referrals to a network provider which do not result in an authorization (e.g., a referral which is returned to the Market/MTF for missing information) shall not be considered in calculating referral processing accuracy.

5.2.2.1.1 The contractor shall provide a monthly report to the Government of the number of returned referrals and a summary of the most common types of information missing. This feedback shall also be provided with the returned referral. For reporting requirements, see Contract Data Requirements List, DD Form 1423, located in Section J of the applicable contract.

5.2.2.2 The contractor shall report on 100% of all referrals processed to completion in regards to timeliness standards and accuracy. For reporting requirements, see Contract Data Requirements List, DD Form 1423, located in Section J of the applicable contract.

6.0 CLAIMS

6.1 Claims Processing Timeliness

Unless otherwise specified, the standards below apply to all claims.

6.2 Retained Claims

6.2.1 The contractor shall process 98% retained and adjustment claims accurately and to completion within 30 calendar days from the date of receipt.

6.2.2 The contractor shall retain all claims that contain sufficient information to allow processing to completion and all claims for which missing information may be developed from in-house sources, including DEERS and contractor operated or maintained electronic, paper, or film files. A “retained claim” is defined as any claim retained (held in the contractor’s possession) for any reason.

Note: The above does not prohibit a contractor from retaining a claim for external development.

6.3 Retained and Excluded Claims

6.3.1 The contractor shall process One hundred percent (100%) retained and adjustment claims accurately and to completion within 90 calendar days from the date of receipt.

6.3.2 The contractor shall process claims with a first pass auto-adjudication rate of 80% of the total monthly claims volume in Option Period 1 and increase the percentage by at least 1% in each subsequent option periods.

6.3.3 The contractor shall not exceed 2% reprocessing rate of the total monthly claims volume processed for the first two option periods.

6.3.4 The contractor shall not exceed 1.75% reprocessing rate of the total monthly claims volume processed in Option Period 3 and for the remainder of the contract.

6.4 Duplicate Claims Resolution

6.4.1 The contractor shall utilize the automated TRICARE Duplicate Claims System (DCS) to resolve DHA identified potential duplicate claims payments.

6.4.2 The contractor shall move Open status potential duplicate claim sets to Pending, Validate, or Closed status on a first-in/first-out basis. To this end, contractor performance will be measured against the percentage of claim sets in Open status at the end of a month with load dates over 30 calendar days old. No more than 10% of the potential duplicate claim sets remaining in Open status at the end of a month shall have load dates over 30 calendar days old. For reporting requirements, see Contract Data Requirements List, DD Form 1423, located in Section J of the applicable contract.

6.4.3 Contractor compliance with this standard shall be determined from the Performance

Standard Report generated by the DCS (see the TRICARE Systems Manual (TSM), Chapter 4, Addendum C, Summary/Management Report entitled “Performance Standard,” for a description and example of the Performance Standard Report). The 10% standard becomes effective on the first calendar day of the seventh month following the Start of Healthcare Delivery (SHCD). For reporting requirements, see Contract Data Requirements List, DD Form 1423, located in Section J of the applicable contract.

6.5 Claims Processing Accuracy

6.5.1 Claim Payment Errors

The absolute value of the payment errors shall not exceed 2% of the total billed charges for the first two option periods. In all remaining option periods, the absolute value of the payment errors shall not exceed 1.75% of the total billed charges.

6.5.2 First Pass Auto-Adjudication

The contractor shall process claims with a first pass auto-adjudication rate of eighty percent (80%) of the total monthly claims volume in the base year of the contract and increase the percentage by at least 1% in each subsequent option year.

6.5.3 Claims Reprocessing

The contractor shall not exceed 2% reprocessing rate of the total monthly claims volume processed for the first two option periods. In all remaining option periods, the contractor shall not exceed 1.75% reprocessing rate of the total monthly claims volume processed.

7.0 APPEALS

7.1 Expedited Preadmission or Preprocedure Reconsiderations

The contractor shall process to completion 100% of requests for expedited preadmission or preprocedure reconsiderations within three business days of the date of receipt by the contractor of the reconsideration request (unless the reconsideration is rescheduled at the written request of the appealing party). Expedited preadmission or preprocedure requests are those requests filed by the beneficiary within three calendar days after the beneficiary receipt of the initial denial determination.

7.2 Non-expedited Medical Necessity Reconsiderations

The contractor shall meet the following processing standards for non-expedited medical necessity reconsiderations which begins from the date of receipt by the contractor until processed to completion:

• 95% within 30 calendar days

• 100% within 60 calendar days

7.3 Non-Expedited Factual Reconsiderations

The contractor shall meet the following standards for non-expedited factual reconsiderations which begins from the date of receipt by the contractor until processed to completion:

• 95% within 30 calendar days of receipt

• 100% within 60 calendar days from the date of receipt of the reconsideration request. The date of completion is considered to be the date the reconsideration determination is mailed to the appropriate parties

7.4 Determinations Reversed by DHA Appeals and Hearings Process

The contractor shall process to completion 100% of contractor determinations reversed by the appeals process within 21 calendar days of receipt.

-END-

Chapter 1 Section 4

Management

1.0 GENERAL

The contractor shall establish and maintain sufficient staffing and management support services and commit other resources and facilities to achieve and maintain compliance with all quantitative and qualitative standards of the contract.

2.0 SYSTEM ADDITIONS OR ENHANCEMENTS

2.1 Implementation of Changes in Program Requirements

The contractor shall have the capacity and personnel to maintain and operate all required systems, and to achieve timely implementation of changing program requirements as directed by the Contracting Officer (CO).

2.2 Maintaining Current Status of Diagnostic and Procedural Coding Systems

(PCS)

2.2.1 The contractor shall use the current versions of applicable coding systems, including, but not limited to: Current Procedural Terminology (CPT), Healthcare Common Procedural Coding System (HCPCS), International Classification of Diseases, 10th Revision (ICD-10-CM and ICD-10-PCS).

2.2.2 The contractor shall use the most current diagnostic and procedural codes correctly, which includes implementing any revisions based on periodic updates issued by the publishers.

2.3 ZIP Code File

2.3.1 The contractor shall maintain and update an electronic file of all ZIP codes using a Government-furnished electronic ZIP code directory.

2.3.2 The contractor shall incorporate this electronic file in its claims

Chapter 1, Section 4 processing system to determine the validity of a beneficiary or provider ZIP code. The Government will provide this directory no less than four and no more than 12 times per calendar year.

2.4 Updating and Maintaining TRICARE Reimbursement Systems

The contractor shall implement policy changes and clarifications to existing TRICARE reimbursement systems affecting both the level of payment and the basic method of reimbursement as they apply to current provider categories implemented at the time of contract award. The TRICARE Reimbursement Manual (TRM) is the source for instructions and guidance on existing reimbursement systems for current provider categories.

3.0 MANAGEMENT CONTROLS

The contractor shall develop and employ management procedures to ensure control, accuracy, and timeliness of transactions associated with operation of its call center, TRICARE Service Center (TSC) functions (TRICARE overseas contract only), enrollment, authorizations, provider referrals, claims processing, beneficiary services, provider services, reconsiderations, grievances, Automatic Data Processing (ADP), and financial functions to comply with contract requirements and standards.

4.0 QUALITY CONTROL

4.1 The contractor shall develop and implement a quality control program consisting of supervisory review of appeals, grievances, correspondence, and telephone responses. The review shall include a statistically valid sample or 30 records, whichever is greater, of each of the following: appeals, grievances, correspondence processed and telephonic responses completed.

For reporting requirements, see Contract Data Requirements List (CDRL), DD Form 1423, located in Section J of the applicable contract.

4.2 The contractor shall develop and implement an end-of-processing quality review program which assures accurate input and correct payments for authorized services received from certified providers by eligible beneficiaries. This shall begin by the end of the third month after the SHCD and be carried out quarterly thereafter. For reporting requirements, see CDRL, DD Form 1423, located in Section J of the applicable contract.

4.3 The contractor shall retain copies of the reviewed claims, appeals, grievances, correspondence, and related working documents, in separate files, for a period of no less than four months following submission of contract deliverables.

4.3.1 The contractor shall provide all documentation to the Government within 10 calendar days of a Government request. The Government will review the deliverables and documentation and will on a regular basis audit a selected sampling of the audited and quality review documents.

The review may occur at the contractor’s site or at a location specified by DHA.

5.0 REPORTING

5.1 The contractor shall provide special programming reports to the DHA on an “as needed” basis. The DHA CO or COR will not request a special programming report more than 10 times per contract period. The CO or COR will tell the contractor what information to include in the report. Examples of these reports include claims history data (either limited or complete) by provider, including one or more sub-identifiers; beneficiary; specific diagnosis(es); specific procedure code(s); and/or geographic region delineated by zip code(s).

5.2 The contractor shall submit the reports by means of electronic medium or a disc as specified by the CO or COR.

5.3 The contractor shall provide the completed reports to the CO or COR within 60 calendar days of the date on the written request from the PCO or COR.

5.4 The contractor shall inform the CO or COR of the cost, if any.

5.5 The contractor shall complete the special report within the time requested by DHA unless a different delivery date is approved.

5.6 For reporting requirements, see CDRL, DD Form 1423, located in Section J of the applicable contract.

6.0 STAFF TRAINING PROGRAM

6.1 The contractor shall develop and implement formal initial and ongoing training program for both internal contractor and subcontractor staff, including training on program updates as they occur, to ensure a high quality of service to beneficiaries and providers.

6.2 The contractor shall document the personnel files of staff members who receive the training. The contractor shall maintain centralized documentation of the training session agendas, identity of attendees, actual dates and duration of training sessions.

7.0 INTERNAL FINANCIAL/ACCOUNTING AUDITS AND CONTROL

PROGRAMS

7.1 The contractor shall verify that its accounting data are correct, reliable and comply with all Government accounting standards and requirements.

7.2 The contractor’s corporate internal review staff shall conduct regular, routine and ad-hoc reviews to ensure proper monitoring in the areas of finance, financial accounting, internal controls, and special checks issued and returned, and selected history maintenance transactions for possible fraud or abuse.

8.0 BENEFICIARY SURVEYS

8.1 In accordance with Department of Defense Instruction (DoDI) 1100.13, and Health Affairs Policy Memorandum 97-012, surveys of military members, retirees and their families must be approved and licensed through issuance of a Report Control Symbol (RCS).

8.2 The contractor shall not conduct written or telephonic beneficiary surveys without the approval of the DHA Decision Support Division (DSD).

8.2.1 DHA has an ongoing survey research and analysis program which includes periodic population-based and encounter-based surveys of DoD beneficiaries. The surveys address beneficiary information seeking strategies and preferences, health status, use of care, satisfaction with military and civilian care, and attitudes toward TRICARE. The data are collected at the Prime Service Area (PSA) level and can be aggregated to the geographic area of responsibility.

8.3 The contractor shall work with the Government Designated Authority (GDA) to define their ongoing and special purpose requirements for survey data.

8.3.1 The contractor may submit surveys, sampling plans, and cost estimates through the GDA to the DHA DSD for approval and licensing if it has a special need for a survey.

Chapter 1 Section 5

Compliance With Federal Statutes

1.0 GENERAL

1.1 The contractor shall comply with all federal privacy laws which apply to the administration of TRICARE health plans. In situations where federal law is in conflict with the law in the state(s) in which the contractor is based or operating, federal law as applicable to the Department of Defense (DoD) generally has precedence over state law, except as to the health privacy rights of minors.

1.1.1 This Manual incorporates by reference the federal regulations and DoD issuances referred to in this Section.

1.2 A key federal statute relating to information privacy applicable to Defense Health Agency (DHA) contractors is 5 United States Code (USC) 552a. The DoD has implemented the Privacy Act with DoD Instruction (DoDI) 5400.11 (2019), DoD Manual (DoDM) 6025.18, and DoD 5400.11-R (2007), referenced in this Manual collectively as “DoD Privacy Act Issuances.”

1.3 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a key federal statute governing health information privacy, 45 CFR Part 160 and 164. The Department of Health and Human Services (HHS) has issued the HIPAA Privacy, Security, Breach, and Enforcement Rules (collectively, HIPAA Rules). The DoD has implemented the HIPAA Privacy and Security Rules with the following issuances:

• DoDI 6025.18, “Privacy of Individually Identifiable Health Information in DoD

Programs,” March 13, 2019

• DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019; and

• "DoDI 8580.02, “Security of Individually Identifiable Health Information in DoD Health Care Programs,” August 12, 2015."

1.4 For Privacy related definitions see Appendix A

2.0 PRIVACY ACT AND RELATED REQUIREMENTS

2.1 The contractor shall ensure that beneficiary personally identifiable information (PII) collected in TRICARE records is limited to that which is legally authorized and necessary.

2.2 The contractor shall ensure PII is maintained in a manner which assures its confidentiality.

When confidentiality is not assured, a privacy breach may have occurred, which triggers requirements under the Privacy Act. When the PII is in electronic form, additional requirements under the Federal Information Security Modernization Act of 2014 (FISMA) apply. When the PII includes protected health information (PHI), requirements under the HIPAA Privacy, Breach, and Security Rules apply.

2.3 Electronic PII and Security Compliance

2.3.1 The contractor shall follow applicable FISMA and DoD cybersecurity requirements, including information security compliance under the National Institute of Standards and Technology (NIST) program as stated in the TRICARE Systems Manual (TSM), Chapter 1, Section 1. These requirements are concerned with not only confidentiality, but also integrity and availability of PII.

2.4 Breach Response - General Requirements

2.4.1 The contractor shall establish internal procedures to address the following areas of breach response: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

2.4.2 The contractor shall assign an investigator to report and respond to breaches and cybersecurity incidents. The investigator will conduct an investigation immediately upon discovery of a possible or confirmed breach or cybersecurity incident.

2.4.2.1 The contractor shall provide notification if a potential or actual breach, defined as an actual or possible loss of control, unauthorized disclosure of, or unauthorized access to, personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes occurs with respect to personally identifiable information or protected health information that has been created, received, maintained or transmitted by the contractor.

2.4.2.1.1 The contractor shall notify the DHA Privacy Office within 24 hours, at dha.privacyofficer@mail.mil. If such breach is a cybersecurity incident, the discovering party shall report this to the National Cybersecurity & Communications Integration Center (NCCIC) within one hour of the potential cybersecurity incident; and will complete the breach response actions required by DHA guidance.”

2.4.3 The contractor shall consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., mailto:dha.privacyofficer@mail.mil if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible).

2.4.5 The contractor shall consider relevant factors in determining whether an unauthorized access should be treated as a suspected breach; including, but not limited to:

• How the event was discovered

• Did the information stay within the covered entity’s control

• Was the information actually accessed or viewed

• Ability to ensure containment (e.g. recovered, destroyed, or deleted)

2.4.6 For reporting requirements, see Contract Data Requirements List (CDRL), DD Form 1423, located in Section J of the applicable contract.

2.4.7 Incidents Involving Electronic PII/PHI

2.4.7.1 The contractor shall report incidents (confirmed or potential) within one hour of confirmation to the National Cybersecurity and Communications Integration Center (NCCIC) (formerly known as United States Computer Emergency Readiness Team (US-CERT) Incident Reporting System at https://forms.us-cert.gov/report/, as required by the Department of Homeland Security (DHS)).

2.4.7.2 The contractor shall record the NCCIC incident reporting number, which shall be included in the initial report to the DHA Privacy Office. Information may not be known or complete, but available information shall be reported within the one-hour deadline for submission to NCCIC.

2.4.7.3 The contractor shall provide any updates to the initial NCCIC report by email to soc@us-cert.gov, with the “Reporting Number” in the subject line.

2.4.7.4 The contractor shall provide a copy of the initial or updated NCCIC report to the DHA Privacy Office. Any questions about NCCIC reporting shall be directed to the DHA Privacy Office, not the NCCIC office.

2.4.7.5 The contractor shall immediately take steps to minimize any adverse repercussions from the occurrence and proceed with further investigation of any relevant details such as root causes, vulnerabilities exploited, or actions needed (e.g., containment, mitigation, eradication, recovery and follow-up).

2.5 The contractor shall require subcontractors who discover a potential or confirmed breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery.

2.5.1 The contractor shall report to DHA Privacy Office within 24 hours of receiving the subcontractor’s report of a potential or confirmed breach. If a cybersecurity incident is involved, the contractor’s deadline for NCCIC reporting (one-hour) runs from the time the incident is confirmed.

2.5.2 The contractor shall require the subcontractor to meet deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein.

2.5.3 The contractor and subcontractor may agree that the subcontractor shall report incidents directly to NCCIC and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

2.5.3 The contractor shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged in accordance with HIPAA and Privacy Act requirements.

2.5.4 The contractor, when acting as a HIPAA-covered entities (rather than as a business associate), is not subject to the breach response requirements of this Manual. However, the contractor is subject to both the HIPAA Breach Rule (applicable to the contractor in its capacity as covered entities) and DoD cybersecurity requirements (applicable to the contractor in its capacity as a DoD contractor).

2.5.5 The contractor shall send the breach report form (required within 24 hours) to:

dha.privacyofficer@mail.mil. Encryption is not required since reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed in writing as soon as technically feasible.

2.5.6 The contractor shall prepare the breach reports required within the 24 hour deadline by completing the Breach Reporting DD Form 2959 (Breach of PII Report), available at the Breach Response link on the DHA Privacy Office web site, https://www.esd.whs.mil/Directives/forms/dd2500_2999/.

2.5.7 The contractor shall assign an internal tracking number and include that number in Box 1.e of the DD Form 2959 for non-cyber incidents without a NCCIC umber.

2.5.8 The contractor shall coordinate with the DHA Privacy Office for subsequent action such as beneficiary notification, and mitigation. For reporting requirements, see CDRL, DD Form 1423, located in Section J of the applicable contract provides guidance on completing and updating the Breach Reporting DD Form 2959.

2.5.8.1 The contractor shall update the DD Form 2959 as new information becomes available.

2.5.9 The contractor shall draft a notification letter for DHA Privacy Office review and endorsement prior to sending to the affected beneficiaries should the DHA Privacy Office determine that beneficiary notification is required.

2.5.9.1 The contractor shall send the draft notification letter to DHA Privacy within 10 business days from discovery of the breach and affected beneficiary(s) ascertainment. The 10 business day period begins when the contractor is able to determine the identities (including addresses) of the beneficiaries whose records were affected, however, in no case will notification take placed later than 60 calendar days following the discovery of a breach.

https://www.esd.whs.mil/Directives/forms/dd2500_2999/

2.5.9.2 The beneficiary notification letter shall include, but is not limited to the following:

• Specific data elements

• Basic facts and circumstances

• Recommended precautions the beneficiary can take

• Federal Trade Commission (FTC) identity theft hotline information

• Any mitigation support services offered such as credit monitoring

2.5.9.3The contractor shall ensure that envelopes containing written notifications to affected beneficiaries are clearly labeled to alert the recipient to the importance of its contents, i.e., “Data Breach Information Enclosed,” and that the envelope is marked with the identity of the contractor and/ or subcontractor organization that suffered the breach.

2.5.10. The contractor shall notify the DHA Privacy Office to determine needed follow-up actions if notification cannot be accomplished within 10 business days.

2.6 The contractor shall, following the discovery of a breach involving 500 or more residents of a State or jurisdiction and after approval by the DHA Privacy Office, notify prominent media outlets serving the State or jurisdiction.

2.6.1 The contractor shall, should media notice be required, submit a proposed notice and recommended media outlets for DHA Privacy Office review (which will include coordination with the DHA Communications Division) and approval within five business days, and in no case later than 60 calendar days following the discovery of a breach.

2.7 System of Records (SOR) Maintained or Operated by Contractors

2.7.1 Contractor activity is typically associated with the SOR described in System of Records Notice (SORN) EDTMA 04 - Medical/Dental Claim History Files (note that physical location of records in this SOR may be decentralized). However, some contractor records may instead be associated with the following SORs:

• EDTMA 01 - Health Benefits Authorization Files

• EDTMA 02 - Medical/Dental Care and Claims Inquiry Files

• EDHA 06 - Designated Provider Managed Care System Records, formerly known as USTF Managed Care System

• EDHA 07 - Military Health Information System, and

• EDHA 08 - Health Affairs Survey and Study Database

2.7.2 The contractor shall not disclose any record contained in a SOR to any person or agency outside DoD without prior written consent or request of the beneficiary to whom the record pertains except for “routine use” disclosures and other authorized disclosures as provided in DoD 5400.11-R, C4.1.1.3 and C4.2.

2.7.3 The Privacy Act permits use of PII throughout the Military Health System (MHS) for legitimate mission purposes, including when a TRICARE contractor has a need for the records in the performance of its duties.

2.7.3.1 TRICARE contractors should be aware that TRICARE Beneficiary Counseling and Assistance Coordinators (BCACs), Debt Collection Assistance Officers (DCAOs), and Uniformed Services Claims Officers (USCOs) are employees of the DoD authorized to receive information from TRICARE records if they have a need for the information in the performance of their duties.

2.7.3.2 A TRICARE BCAC, DCAO, USCO, or other authorized DHA/MHS representative who is assisting a beneficiary may receive TRICARE information pertaining to that beneficiary, provided that the identity and authority of such representative is verified (e.g., through the Customer Service Community Directory). The restriction on disclosure of only that information directly releasable to the beneficiary also applies to the BCAC, DCAO, USCO, or other representative.

2.7.4 The contractor shall coordinate through the DHA Privacy Office, regarding any needed updates following proper SORN publication and Government confirmation of contractor authority to operate the applicable system(s).

2.7.5 The contractor shall advise the DHA Privacy Office within 30 calendar days of changes in SORs or their use that may require a change in the applicable SORN, whether EDTMA 04 or otherwise.

2.8 Collecting Information

2.8.1 The Privacy Act requires personal information to be collected, to the greatest extent practicable, directly from the subject beneficiary when the information may result in adverse determinations about the beneficiary’s rights, benefits, or privileges under federal programs. The collection of information from third parties shall be minimized except where there is a need to obtain the information directly from a third party, such as a need to verify information provided by the subject beneficiary.

2.8.2 The contractor shall provide a Privacy Act Statement (PAS) whenever PII is solicited and collected (by paper, electronic, or verbal means) from a beneficiary for a SOR. The PAS informs the beneficiary of the authority for soliciting and collecting PII, the principal purposes for which that PII will be used, where that PII may be disclosed outside of DoD, whether furnishing that information is voluntary or mandatory, and the effects on the beneficiary of choosing not to provide all or part of that requested PII. The PAS must be conspicuously posted before the point of collection. On paper forms this usually means placing the PAS at the beginning of the form, immediately following the title, before the first official heading or selection, or immediately prior to the first collection field. On electronic forms, this means placing the PAS so that the beneficiary sees it before providing information. A PAS may not be displayed via a hyper-link or pop-up that the beneficiary could bypass. When information is collected by telephone, a brief oral explanation of the Privacy Act shall be given to the beneficiary.

2.8.3 The contractor shall use the following language for an oral PAS, showing the mandatory portion of the PAS:

• This information is being collected to: Process your request to change your provider

• Providing this information is: Voluntary. However, failure to provide all requested information may result in a delay or denial of your request to change your provider

• This information may be disclosed for routine uses consistent with why it was collected

• This information is being collected under the authority of: 10 USC Chapter 55;

32 CFR Part 199; and E.O. 9397 (SSN), as amended

• To hear this again please tell me / press 1 [If answer is “yes,” repeat script.]

• If you do not want it repeated, please tell me / press 2 [If answer is “yes,” continue with script.]

• If you would like to hear a full list of routine uses which may be made of your information, and the complete legal authorities for collecting this information, please tell me / press 9 now

Note: The last few lines may change depending on whether the PAS is being provided by a human or automated system and on how that system would operate. The point is to actively ask whether the beneficiary (1) would like the PAS to be repeated, and (2) would like to hear the routine uses and authority titles.

2.8.4 The contractor shall process claims for payment that do not indicate that the claimant received a PAS.

2.8.5 The contractor shall, if requiring additional claim information from the beneficiary, include the appropriate PAS language.

2.9 Access To Contractor Records Under The Privacy Act

2.9.1 The contractor shall develop policies and procedures by which a beneficiary is permitted access to records pertaining to him or her under the Privacy Act.

2.9.2 The contractor shall treat any record request as a HIPAA request if the following exists:

• The record contains any individually identifiable health information

• Is transmitted or maintained in any form or medium including identifiable demographic

• The information relating to the past, present, or future physical or mental health condition of an individual

• The provision or payment of healthcare to an individual

2.9.3 Upon request, a beneficiary must be informed whether or not the Medical and Dental Claim History Files contain a record pertaining to him or her. If the beneficiary so desires, he or she shall be permitted to review such record. Furthermore, a beneficiary is permitted to obtain a copy of such record in a form which is comprehensible to him or her.

2.9.4 The contractor shall act on a request for access no later than 30 calendar days after receipt of the request.

2.9.5 The contractor shall not require the beneficiary or personal representative to provide a reason or justification before granting the beneficiary or personal representative access to a record containing his or her PII.

2.9.5.1 However, the beneficiary or personal representative shall be required to provide such information as is necessary to determine where and how to look for the records.

2.9.5.2 The beneficiary or personal representative shall also be required to provide reasonable identity verification, in accordance with 45 Code of Federal Regulations (CFR) 164.514(h), before access is granted.

2.9.5.3 Since most records in the Medical and Dental Claim History Files relate to medical information, a beneficiary or personal representative may be required to submit a written request for access to the file. This allows the contractor time to review the medical information in accordance with the following procedures to determine if direct access by the beneficiary or personal representative to the medical information would have an adverse effect on the beneficiary.

2.9.6 Neither the Privacy Act nor the HIPAA Privacy Rule distinguish between custodial and non- custodial parents in cases involving separation or divorce. A minor’s PII/PHI may be released to either parent, unless the contractor is informed of divorce or legal separation or a court order or other documentation potentially affecting parental authority with respect to the minor’s health care.

2.9.6.1 The contractor shall review the documentation to verify which parent has authority with respect to the minor’s health care and whether disclosure of the minor’s PHI to either parent is restricted.

2.9.6.2 The contractor shall make disclosure to minors in accordance with State law in the jurisdiction in which the minor resides.

2.9.6.3 The contractor shall disclose to the minor only if the minor consents to care and parental consent is not required under state law, or the minor and parent have agreed that the minor may have a confidential relationship with the provider of the care about which the disclosure is requested, or if the minor has been granted a legal emancipation.

2.9.6.4 The contractor shall provide the appropriate disclosures to the court or appointee if the minor obtains care at the direction of a court or guardian or other court appointee.

2.9.6.5 The contractor shall not disclose a minor’s PII/PHI to the minor’s parent if the contractor reasonably believes, in the exercise of professional judgment, that disclosure would not be in the minor’s best interest (e.g., due to risk of abuse or neglect by the parent or other risk of endangerment to the minor, or where the minor has signed a claim related to sensitive matters such as abortion, substance abuse or sexually transmitted disease).