OAR 410-120-1360: Requirements for Financial, Clinical and Other Records

(1) The Authority shall analyze, monitor, audit, and verify the accuracy and appropriateness of payment, utilization of services, medical necessity, medical appropriateness, quality of care, and access to care of the Medical Assistance Programs and the Children's Health Insurance Program. (2) The provider or the provider's designated billing service or other entity responsible for the maintenance of financial, clinical, and other records shall develop and maintain adequate financial and clinical records and other documentation that supports the specific care, items, or services for which payment has been requested. Payment shall be made only for services that are adequately documented. Documentation shall be completed before the service is billed to the Division and meet the following requirements: (a) All records shall document the specific service provided, the number of services or items comprising the service provided, the extent of the service provided, the dates on which the service is provided, and the individual providing the service. Patient account and financial records shall also include documentation of charges, identify other payment resources pursued, indicate the date and amount of all debit or credit billing actions, and support the appropriateness of the amount billed and paid. For cost reimbursed services, the provider shall maintain adequate records to thoroughly explain how the amounts reported on the cost statement were determined. The records shall be accurate and in sufficient detail to substantiate the data reported; (b) Clinical records, including records of all therapeutic services, shall document the client's diagnosis and the medical need for the service. The client's record shall be annotated each time a service is provided and signed or initialed by the individual who provided the service or shall clearly indicate the individual who provided the service. For purposes of medical review, the Authority adopts Medicare’s electronic signature policy as outlined in the CMS Medicare Program Integrity Manual. Information contained in the record shall be appropriate in quality and quantity to meet the professional standards applicable to the provider or practitioner and any additional standards for documentation found in this rule, the individual provider rules, and any relevant contracts. When a provider maintains records electronically, within an EHR, EMR or other electronic clinical trial management or billing system, the provider must be able to provide: (A) hard copy versions, upon request; and (B) an auditable means of demonstrating the date the record was created, the identity of the creator of a record, the date the record was modified, what was modified in the record, and the identity and credentials of any individual who has modified the record. (C) If the provider maintains records electronically or permits the use of electronic signatures, the provider must document any aspect of the provision of services. The provider must maintain appropriate safeguards to assure the authenticity of the electronic records and signatures. (c) Electronic Data Transmissions shall comply with the Uniform Electronic Transactions Act cited in ORS chapter 84 and OAR 943-120-0100; (d) Policies and procedures shall ensure the maintenance of the confidentiality of medical record information. These procedures ensure the provider may release information in accordance with federal and state statutes, ORS 179.505 through 179.507, 411.320, and 433.045, 42 CFR part 2, 42 CFR subpart F, 45 CFR 205.50. (e) Retain clinical records for seven years and financial and other records described in paragraphs (a) and (b) of this rule for at least five years from the date(s) of service. (f) Record requirements applicable only to providers who are providing routine services for clinical trials: (A) Information must be retained and provided if requested for medical review, audit or investigation by Authority, DOJ MFCU or other state or federal regulators and shall include: (i) The trial name, sponsor, and sponsor-assigned protocol number (This is the number assigned by the National Library of Medicine (NLM) ClinicalTrials.gov). (ii) A copy of the member’s signed consent form (B) Record for clinical trials must be maintained and accessible for 10 years (C) The records be stored and protected compliant with HIPAA and other applicable standards. (3) Upon written request from the Authority, the Medicaid Fraud Control Unit Oregon Secretary of State, the Department of Health and Human Services (DHHS), or their authorized representatives furnish requested documentation immediately or within the time-frame specified in the request. Copies of the documents may be furnished unless the originals are requested. At their discretion, official representatives of the Authority, Medicaid Control Unit, or DHHS may review and copy the original documentation in the provider's place of business. Upon the written request of the provider, the program or the unit may, at their sole discretion, modify or extend the time for providing records if, in the opinion of the program or unit good cause for an extension is shown. Factors used in determining whether good cause exists include: (a) Whether the written request was made in advance of the deadline for production; (b) If the written request is made after the deadline for production, the amount of time elapsed since that deadline; (c) The efforts already made to comply with the request; (d) The reason(s) for not meeting the deadline; (e) The degree of control that the provider had over its ability to produce the records prior to the deadline; (f) Other extenuating factors. (4) Access to records, inclusive of medical charts and financial records does not require authorization or release from the client if the purpose is: (a) To perform billing review activities; (b) To perform utilization review activities; (c) To review quality, quantity, and medical appropriateness of care, items, and services provided; (d) To facilitate payment authorization and related services; (e) To investigate a client's contested case hearing request; (f) To facilitate investigation by the Medicaid Fraud Control Unit or DHHS; or (g) Where review of records is necessary to the operation of the program. (5) Failure to comply with requests for documents within the specified time-frames means that the records subject to the request may be deemed by the Authority not to exist for purposes of verifying appropriateness of payment, medical appropriateness, the quality of care, and the access to care in an audit or overpayment determination may subject the provider to possible denial or recovery of payments made by the Division or to sanctions. [Publications: Publications referenced are available from the agency.]