OAR 333-004-3150: RH Access Fund Requirements for Financial, Health, and Other Records

(1) The RH Program is responsible for analyzing and monitoring the operation of the RH Access Fund, and for auditing and verifying the accuracy and appropriateness of payment and utilization of services. An agency shall: (a) Develop and maintain adequate financial and health records and other documentation that supports the services, drugs, devices, and supplies for which payment has been requested from the RH Program. Documentation shall be completed before the service, drug, device, or supply is billed to the RH Program. (b) Document the specific services provided, diagnosis codes for the services, the date on which the service was provided, and the agency staff who provided the services in every health record. Enrollee account and financial records must also include documentation of charges, identification of other payment resources pursued, the date and amount of all debit or credit billing actions, and must support the appropriateness of the amount billed and paid. The records must be accurate and in sufficient detail to substantiate the data reported. (c) Sufficiently document that the purpose of the visit was for reproductive health or abortion services and that the diagnosis codes are included on the list of allowable codes on the RH Program’s website. The enrollee’s health record must be annotated each time a service is provided and signed or initialed by the agency staff that provided the service or must clearly indicate the agency staff that provided the service. Information contained in the record must meet the requirements for reproductive health or abortion services as described in OAR 333-004-3030 (Agency Certification Requirements) and must be appropriate in quality and quantity to meet the professional standards applicable to the provider and any additional standards for documentation found in this rule. (2) An agency must have and implement policies and procedures that ensure personal health information is kept secure and confidential in accordance with applicable federal and state security and privacy laws. (3) Agencies are prohibited from sharing client information with federal or state law enforcement officials unless required by an order from a court of competent jurisdiction. (4) An agency must retain health records for seven years and financial and other records described in this rule for at least five years from the date of service. Original RH Access Fund enrollment records must be retained for seven years. (5) Upon written request from the RH Program, the Health Systems Division, the Authority, or the Oregon Department of Justice Medicaid Fraud Unit, an agency must furnish requested documentation, without charge, immediately or within the timeframe specified in the written request. Copies of the documents may be furnished unless the originals are requested. Alteration of clinical or billing records that have been requested by the RH Program or a designated requestor is prohibited. (6) If an agency fails to comply with requests for records within the specified timeframes it may result in the Authority deeming those records not to exist for purposes of verifying appropriateness of payment, medical appropriateness, the quality of care, and the access to care in an audit or overpayment determination, and accordingly subjects the agency to possible denial or recovery of payments made by the Authority, or to sanctions. (7) Upon the written request of the agency, the RH Program may, at its sole discretion, modify or extend the time for providing records if, in the opinion of the RH Program, good cause for an extension is shown. Factors used in determining whether good cause exists include: (a) Whether the written request was made in advance of the deadline for production; (b) If the written request is made after the deadline for production, the amount of time elapsed since that deadline; (c) The efforts already made to comply with the request; (d) The reasons the deadline cannot be met; (e) The degree of control that the agency had over its ability to produce the records prior to the deadline; and (f) Other extenuating factors. (8) Access to records by the RH Program, including personal health information and RH Access Fund financial records does not require authorization or release from the enrollee if the purpose is: (a) To perform billing review activities; (b) To perform utilization review activities; (c) To review quality, quantity, and medical appropriateness of care, items, and services provided; (d) To facilitate payment authorization and related services; (e) Related to a client's contested case hearing for enrollment denial; or (f) To facilitate investigation by the RH Program related to compliance with these rules. (9) The agency, and any officers, employees, agents, and subcontractors of the agency shall comply with the following requirements for the RH Access Fund eligibility database: (a) Complete and submit to the RH Program and its contracted data and claims processing vendor a User ID/Password Request Form to gain access to the RH Access Fund eligibility database. (b) Implement security measures that reasonably and appropriately provide administrative, physical, and technical safeguards that protect the confidentiality and integrity of the RH Access Fund eligibility database. The agency’s security measures must be documented in writing and be available for review by the RH Program upon request. RH Program reviews of the reasonableness of security measures, as well as the agency’s compliance with RH Program-assigned access control or security requirements, shall take into account the agency’s physical, administrative, and technical capabilities related to security measures and the potential risk of unauthorized use or disclosure of the RH Access Fund eligibility database by the agency, its officers, employees, agents or subcontractors; (c) Prevent any unauthorized access to or disclosure of information from the RH Access Fund eligibility database; (d) Take necessary actions to comply with RH Program determinations of the level of access that may be granted, as well as changes in level of access, or suspension or termination of access as determined by the RH Program; (e) Keep any RH Program-assigned access control requirements such as identification of authorized users and access-control information in a secure location until access is terminated; monitor and securely maintain access by the agency and its agents or subcontractors in accordance with security requirements or access controls assigned by the RH Program; and make available to the RH Program upon request all information about the agency’s use or application of the RH Access Fund eligibility database; and (f) Report any privacy or security incidents by the agency, its officers, employees, agents or subcontractors that compromise, damage, or cause a loss of protection to the RH Access Fund eligibility database, as follows: (A) Report to the RH Program in writing within five business days of the date on which the agency becomes aware of such incident; and (B) Provide the RH Program the results of any incident assessment findings and resolution strategies. (10) The agency must comply with RH Program requests for corrective action concerning a privacy or security incident, and with laws requiring mitigation of harm caused by the unauthorized use or disclosure of confidential information, if any. (11) If the RH Program determines that the agency’s security measures or actions required under section (10) of this rule are inadequate to address the security requirements, the RH Program shall notify the agency. The RH Program and the agency may meet to discuss appropriate security measures or action. If security measures or corrective actions acceptable to the RH Program cannot be agreed upon, the RH Program reserves the right to take such actions as it determines appropriate under the circumstances. Actions may include, but are not limited to, restricting access, or amending or terminating the agency agreement. (12) The RH Program reserves the right to request additional information from the agency related to security measures, and to change, suspend or terminate access to or use of the RH Access Fund eligibility database by the agency, its officers, employees, agents or subcontractors. (13) Wrongful use or disclosure of the RH Access Fund eligibility database by the agency, officers, its employees, agents or its subcontractors may cause the immediate suspension or revocation of any access granted, in the sole discretion of the RH Program. The RH Program may also pursue any other legal remedies provided under the law.