C-4000, Confidential Nature of Medical Information

Revision 15-2; Effective June 1, 2015

Applicants/recipients requesting assistance on the basis of disability must complete a medical information release form.

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that sets additional standards to protect the confidentiality of individually identifiable health information. Individually identifiable health information is information that identifies or could be used to identify an individual and that relates to the:

  • past, present or future physical or mental health or condition of the individual;
  • provision of health care to the individual; or
  • past, present or future payment for the provision of health care to the individual.

C-4100, Privacy Notice

Revision 21-4; Effective December 1, 2021
 
HIPAA requires HHSC to provide a notice of privacy practices that explains:

  • the person’s privacy rights;
  • the duties of HHSC to protect the person’s health information; and
  • how HHSC may use or disclose the person’s health information without an authorization. For example, HHSC may share health information with the person’s providers to:
    • arrange for services; or 
    • with other government entities to report suspected abuse or neglect.

Provide Form 0401, Notice of Privacy Practices (English), or Form 0401S, Aviso de Normas Sobre la Privacidad (Spanish), as appropriate, to each household with a person enrolled in a medical program.

Provide Form 0401 or Form 0401S with Form TF0001, Notice of Case Action, to each household enrolled in a medical program:

  • at initial certification; or
  • at recertification after a break in services of more than 180 days.

Form 0403, Explanation to Health Information Privacy Rights, provides a reminder of privacy practices and where to locate Form 0401.

Provide Form 0403 with Form TF0001 to each head of household:

  • at each recertification;
  • after a break in services of at least 30 days but not more than 180 days; or
  • when a new person is added to a case.

C-4200, Applicant/Recipient Authorization

Revision 11-4; Effective December 1, 2011

The applicant/recipient may authorize the release of his or her health information from HHSC records by using a valid authorization form. Form H1003, Appointment of an Authorized Representative, includes all the authorization elements required by HIPAA privacy regulations. See Section C-3000, When and What Information May Be Disclosed, for the elements necessary for a valid authorization.

C-4300, Minimum Necessary

Revision 09-4; Effective December 1, 2009

Reasonable efforts must be made to limit the use, request or disclosure of individually identifiable health information to the minimum necessary to determine eligibility and operate the program. The disclosure of individual medical information from HHSC records must be limited to the minimum necessary to accomplish the requested disclosure. For example, if an applicant/recipient authorizes release of income verification, including disability income, do not release related case medical information unless specifically authorized by the applicant/recipient.