(ACO) regulations - American Society of Anesthesiologists

CMS-1345-P 123
permitted under the Privacy Act if we ensure that an appropriate Privacy Act System of
Records "routine use" is in place prior to making any disclosures.
(1) Sharing Data Related to Medicare Parts A and B
As discussed in section II.B. of this proposed rule, the ACOs are tasked with
working with ACO participants and ACO providers/suppliers to evaluate their
performance, conduct quality assessment and improvement activities, and conduct
population-based activities relating to improved health for their assigned beneficiary
population. When done by or on behalf of a covered entity, these are covered functions
and activities that would qualify as "health care operations" under the first and second
paragraphs of the definition of health care operations at 45 CFR 164.501. These
activities are done by the ACOs either on their own behalf as covered entities, or on
behalf of their covered entity ACO participants and ACO providers/suppliers, in which
case the ACOs would be the business associate of its ACO participants and ACO
providers/suppliers.
The proposed disclosure of Part A and B claims data would be permitted by the
HIPAA Privacy Rule provisions governing disclosures for "health care operations." As
discussed previously in the context of our proposed disclosure of the four data elements
about the historically assigned beneficiary population, a covered entity is permitted to
disclose PHI to another covered entity for the recipient's health care operations if both
covered entities have or had a relationship with the subject of the records to be disclosed
(which is true here), the records pertain to that relationship (which is also true here) and
the recipient plans to use the records for a "health care operations" function that falls
within the first two paragraphs of the definition of "health care operations" in the HIPAA