(a) Section 1902(a)(7) of the Act requires that a State plan must provide safeguards that restrict the use or disclosure of information concerning applicants and beneficiaries to purposes directly connected with the administration of the plan. This subpart specifies State plan requirements, the types of information to be safeguarded, the conditions for release of safeguarded information, and restrictions on the distribution of other information.

(b) For purposes of this subpart, information concerning an applicant or beneficiary includes information on a non-applicant, as defined in § 435.4 of this subchapter.

(c) Section 1137 of the Act, which requires agencies to exchange information to verify the income and eligibility of applicants and beneficiaries (see § 435.940 through § 435.965 of this subchapter), requires State agencies to have adequate safeguards to assure that—

(1) Information exchanged by the State agencies is made available only to the extent necessary to assist in the valid administrative needs of the program receiving the information, and information received under section 6103(l)(7) of the Internal Revenue Code is exchanged only with agencies authorized to receive that information under that section of the Code; and

(2) The information is adequately stored and processed so that it is protected against unauthorized disclosure for other purposes.

(d) Section 1943 of the Act and section 1413 of the Affordable Care Act.

A State plan must provide, under a State statute that imposes legal sanctions, safeguards meeting the requirements of this subpart that restrict the use or disclosure of information concerning applicants and beneficiaries to purposes directly connected with the administration of the plan.

Purposes directly related to plan administration include—

(a) Establishing eligibility;

(b) Determining the amount of medical assistance;

(c) Providing services for beneficiaries; and

(d) Conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the administration of the plan.

The Medicaid agency must have authority to implement and enforce the provisions specified in this subpart for safeguarding information about applicants and beneficiaries.

(a) The agency must publicize provisions governing the confidential nature of information about applicants and beneficiaries, including the legal sanctions imposed for improper disclosure and use.

(b) The agency must provide copies of these provisions to applicants and beneficiaries and to other persons and agencies to whom information is disclosed.

(a) The agency must have criteria that govern the types of information about applicants and beneficiaries that are safeguarded.

(b) This information must include at least—

(1) Names and addresses;

(2) Medical services provided;

(3) Social and economic conditions or circumstances;

(4) Agency evaluation of personal information;

(5) Medical data, including diagnosis and past history of disease or disability; and

(6) Any information received for verifying income eligibility and amount of medical assistance payments (see § 435.940 through § 435.965 of this subchapter). Income information received from SSA or the Internal Revenue Service must be safeguarded according to the requirements of the agency that furnished the data, including section 6103 of the Internal Revenue Code, as applicable.

(7) Any information received in connection with the identification of legally liable third party resources under § 433.138 of this chapter.

(8) Social Security Numbers.

(a) The agency must have criteria specifying the conditions for release and use of information about applicants and beneficiaries.

(b) Access to information concerning applicants or beneficiaries must be restricted to persons or agency representatives who are subject to standards of confidentiality that are comparable to those of the agency.

(c) The agency must not publish names of applicants or beneficiaries.

(d) The agency must obtain permission from a family or individual, whenever possible, before responding to a request for information from an outside source, unless the information is to be used to verify income, eligibility and the amount of medical assistance payment under section 1137 of this Act and §§ 435.940 through 435.965 of this chapter.

(e) The agency's policies must apply to all requests for information from outside sources, including governmental bodies, the courts, or law enforcement officials.

(f) If a court issues a subpoena for a case record or for any agency representative to testify concerning an applicant or beneficiary, the agency must inform the court of the applicable statutory provisions, policies, and regulations restricting disclosure of information.

(g) Before requesting information from, or releasing information to, other agencies to verify income, eligibility and the amount of assistance under § 435.940 through § 435.965 of this subchapter, the agency must execute data exchange agreements with those agencies, as specified in § 435.945(i) of this subchapter.

(h) Before requesting information from, or releasing information to, other agencies to identify legally liable third party resources under § 433.138(d) of this chapter, the agency must execute data exchanges agreements, as specified in § 433.138(h)(2) of this chapter.

(a) All materials distributed to applicants, beneficiaries, or medical providers must—

(1) Directly relate to the administration of the Medicaid program;

(2) Have no political implications except to the extent required to implement the National Voter Registration Act of 1993 (NVRA) Pub. L. 103-931; for States that are exempt from the requirements of NVRA, voter registration may be a voluntary activity so long as the provisions of section 7(a)(5) of NVRA are observed;

(3) Contain the names only of individuals directly connected with the administration of the plan; and

(4) Identify those individuals only in their official capacity with the State or local agency.

(b) The agency must not distribute materials such as “holiday” greetings, general public announcements, partisan voting information and alien registration notices.

(c) The agency may distribute materials directly related to the health and welfare of applicants and beneficiaries, such as announcements of free medical examinations, availability of surplus food, and consumer protection information.

(d) Under NVRA, the agency must distribute voter information and registration materials as specified in NVRA.