Medicare Basics

Interoperability and Patient Access

ᏓᏠᎯᏍᏔᏅ ᏣᏤᎵ ᎠᏰᎸ ᏄᏍᏗᏓᏅᎢ ᎠᎦᏎᏍᏗᏍᎩ

New options for managing your digital medical records.

Starting in 2021,a new federal law will make it easier for members* to manage their digital medical records.

The Interoperability and Patient Access rule CMS-9115-F makes it easier for members to get their health records when they need it most. You now have full access to your health records on your mobile device. This allows you to manage your health better and know what resources are available to you.

Starting in 2022, the Payer-to-Payer Data Exchange portion of the rule* will allow former and current members to request that their health records go with them as they switch health plans. For more information about this rule, visit the Payer-to-Payer Data Exchange section found on this web page.

ᎢᏰᎵᏍᏗ:

• You go to a new healthcare provider because you don't feel well and you can show that provider your health history from the past five years
• ᎾᏍᎩᏃ ᎠᏓᏁᏢᏍᎩ ᏗᎬᏗᏍᎩ ᎾᏍᎩᎾᎢ ᎧᏃᎮᏢᎥᏍᎩ ᎾᎢ ᏣᏩᏛᎡᎸᎩ ᎠᎴ ᎤᎵᏍᏗᏳ ᏗᏩᏛᏓ ᎾᏍᎩ ᏚᏳᎪᏛ ᎠᏏᎾᏍᏛ ᏄᏩᎤ ᎠᎪᎵᏰᏍᎩ ᎾᏍᎩ ᎠᏤᎲᏍᏔᏅᎢ-ᎾᎢ-ᎢᎦ ᎠᏓᏁᏢᏍᎩ ᎠᏓᏎᎮᎯ ᏫᎦᎷᎯᏍᏗ
• You have a question about a claim, so you go to your computer and, in minutes, you see if it's paid or denied or still being processed
• You can take your health history with you as you switch health plans.

ᎾᏍᎩᏃ ᎢᏤ ᎠᎧᎾᏩᏛᏍᏙᏗ ᏗᎪᏢᏅ ᎾᏍᎩ ᏂᎯ ᏰᎵᏊ ᎠᎯᏗᏳ ᎠᏩᏛᏗ ᎧᏃᎮᏢᎥᏍᎩ** ᎤᎾᎢ:

• Claims (paid and denied)
• Healthcare providers
• Specific parts of your clinical information
• Pharmacy directory data***

Samples of data we maintain include:

ᏧᏂᏢᎩ ᏗᏎᎸᎯ ᎢᏗᎬᎾᏕᎾ ᏓᏁᎲ ᎠᏂᏴᏫ

• First name
• Last name
• ᏧᏩᎫᏔᏅ ᏚᏙᎥ
• Middle name
• Suffix
• Birth sex
• Date of birth
• Race
• Ethnicity
• Preferred language.

ᏗᏁᎴᎩᏍᏏ ᎠᎴ ᎠᎵᏐᏆᎸᏍᎩ ᏂᎨᏒᎾ

• Substances (medications)
• Substances (drug class)
• Reaction.

ᎢᏤ ᏗᏎᎸᎯ ᎢᏗᎬᎾᏕᎾ ᏓᏁᎲ ᎠᏂᏴᏫ

• Current address
• Previous address
• Phone number
• Phone number type
• Email address

• Health Concerns
• Immunization
• Procedures
• Medications
• Laboratory Tests and Results
• Assessment and Treatment Plan
• Care
• Team Members

* Applies to Medicare Advantage, Medicaid and CHIP Managed Care and federally-funded ACA exchange plans
** Data will be available for dates of service on or after Jan. 1, 2016 data for Payer-to-Payer only covers clinical data
*** For Medicare Advantage Prescription Drug (MAPD) plans

Why Is This So Important?

Having your medical information in one place helps you and your providers:

• Understand your health better
• Make better decisions
• Improve your health outcomes
• Reduce healthcare costs
• Carry information to new providers or health plans

Keeping Your Protected Health Information (PHI) Safe Is Important To Us
Your privacy and the security of your PHI is a top concern of ours. The new rule allows you to use an app from a third-party application developer (a company with no connection to Wellcare). You can use this app to look up your health information. When choosing an app, it is important to consider how your data can be used and the app's security and privacy practices.

The CARIN alliance is working to advance the exchange of health information. We will require third-party application developers to agree to follow certain privacy standards outlined in the CARIN Code of Conduct. The CARIN Code of Conduct is a set of best practices these applications have voluntarily adopted to protect and secure your health information. Visit My Health Application for a list of apps that have attested to the CARIN Code of Conduct. We will give you information on federal agencies you can contact if you feel your rights to patient privacy have not been protected. Learn more about the CARIN Alliance.

Before sharing your data with a third party application, we will ask you to agree to an Access Your Data statement. This is an added security step to protect your data.

Current Members: What To Do Now?

1. Find a trusted app.
   Visit My Health Application website for a list of apps that have meet the CARIN Code of Conduct.

By agreeing to the CARIN Code of Conduct, the app developer attests it meets certain standard security practices. These practices include, but are not limited to:

Protection of a user's personal data against:

• Loss or unauthorized access
• Use
• Alteration
• Destruction
• Unauthorized annotation
• Disclosure

Protect personal data through a combination of mechanisms including:

• Secure storage
• Encryption of digital records both in transit and at rest
• Data-use agreements and contractual obligations
• Accountability measures (examples: access controls, logs and independent audits)

Comply with applicable breach notification laws.

Provide meaningful remedies to address security breaches or other violations due to a misuse of the user's personal data.

Adopt internal policies and secure contractual commitments with third parties to prohibit the re-identification of de-identified or anonymized data.

2. Download the app. Smartphone apps are available through the Google Play Store (Android) and the App Store (iOS). Web apps are available for computers.
3. Create your account. Use the app to do so.

• To link your health information, choose your health plan
• On the login screen, enter your member portal username and password
• Read the Access your Health Data statement. If you agree to the terms, click "Allow Access"

4. Use your information to manage your healthcare.

ᎢᏳᏓᎵ ᎠᏛᏛᏅ ᏗᏛᏛᎲᏍᎩ

How do I find the right third-party app?
Read our Frequently Asked Questions or Contact Us.

How does Payer-to-Payer data exchange work for both current and former members?
Members may request that Wellcare send health records to other health plans. They can also request that Wellcare receive health records from other health plans. If a member switches health plans, Wellcare will send their clinical records (included in the USCDI data set) to another health plan. This is in order to build a complete health record. A complete health record will help a member make decisions that improve their quality of care and health outcomes.

Former members of Wellcare should start the request through their new health plan.
Based on this request, Wellcare will send the clinical records to their new health plan.

Current members of Wellcare may start the request by logging into the Wellcare secure member portal. There they can request and receive the clinical records from their previous health plan.

How does the new Interoperability and Patient Access Rule affect me?
To learn more Contact Us.

How many years back will my health information go back?
You will have access to your health information with a date of service January 1, 2016 or later.

Can I access my health information I go to a different health plan or provider?
Yes. You will be able to access to your health information, no matter what health plan or provider you go to.

Can I find out if I'm up to date on my immunizations?
Yes, you can use an app to see what shots you've had with a date of service January 1, 2016 or later.

Do I have to use an app from Wellcare?
No. The app is not affiliated with Wellcare. Visit the My Health Application website for a list of apps. This includes apps that promise to meet the CARIN Code of Conduct. Follow the instructions on the app to connect it with your health record.

Will all of the apps keep my health information private?
Not every app has agreed to meet the CARIN Code of Conduct or any other set of guidelines. We will let you know which apps have agreed to follow our privacy guidelines. You will have a chance to select another app if you selected the app before they shared their privacy practices with us.

We suggest that you request a Notice of Privacy Practices from the app. Read it carefully before using that app. If the app does not provide you with a Notice of Privacy Practices, we suggest that you choose another app. Visit the My Health Application website for a list of apps that agree to follow the CARIN Code of Conduct.

When will I have access to my healthcare information through the app?
You will be able to access your health plan information in the apps starting on July 1, 2021.

Do I have to use an app to get my health information?
No, you do not have to use an app to access your health information. You can contact your provider or health plan for needed information.

What health data will the app collect?
It depends on the app you choose. Some apps will collect your health data. This includes (but is not limited to):

• Claims
• Medications
• Diagnoses
• Procedures
• Doctor visits

You give the app permission to collect your health information when you sign up for it. The app's Notice of Privacy Practices should tell you what information it collects.

Will the app collect non-health data from my device, such as my location?
The app's Notice of Privacy Practices should tell you what information it collects. Apps do have the ability to collect non-health data, such as your location. Some apps give you the option to provide that information. We suggest that you ask your app provider.

Does sharing my data with this app have an impact on my family members?
If a family member is linked to your health account, there is a chance that their health information will be shared.

How do I correct mistakes in my health data?
You will need to contact your provider or health plan. The app only makes data available from healthcare sources. The app does not create this data.

What are my rights under the Health Insurance Portability and Accountability Act (HIPAA)?
We suggest that you ask the app provider for their Notice of Privacy and Practices.

Most apps will not be covered by HIPAA. They will instead fall under the jurisdiction of the Federal Trade Commission (FTC) and the protections provided by the FTC Act. The FTC Act protects against deceptive acts. For example, if an app shares personal data without permission. This is though the privacy policy that says it will not do so.

For more information:

• The FTC has information about mobile app privacy and security for consumers on the FTC consumer information website.
• For apps that are subject to HIPAA, the HHS.gov website has information about patient rights and who is obligated to follow HIPAA.
• The HHS.gov website also has HIPAA FAQs for individuals.

What are my rights when it comes to my data collected on this app?
We recommend that you request a Notice of Privacy Practices from the app provider to understand your rights.

What should I do if my data has been shared or stolen or an app has used my data inappropriately?
We recommend that you request a Notice of Privacy Practices from the app provider to understand how they respond to a privacy and security incident. You have the right to file a complaint with enforcement agencies including the Office for Civil Rights (OCR) and the Federal Trade Commission (FTC).

Most apps will not be considered covered entities under HIPAA. They will instead be covered by the Federal Trade Commission (FTC) and the protections provided by the FTC Act. The FTC Act protects against deceptive acts. For example, if an app shares personal data without permission. This is though the privacy policy that says it will not do so.

For more information:

• To learn more about filing a complaint with OCR under HIPAA, visit the HHS.gov website.
• Individuals can file a complaint with OCR using the OCR complaint portal.
• Individuals can file a complaint with the FTC using the FTC complaint assistant.

How will the app use my data?
Although the purpose of the app is for you to be able to see your data in one place, we recommend that you request a Notice of Privacy Practices to understand how the app will use your data.

Can the app share my data with third parties?
We recommend that you request a Notice of Privacy Practices from the app provider to understand if the app will share your data with third parties.

If I no longer want to use this app. How do I stop the app from accessing my health information? Do I have to do more than delete the app from my device?
We suggest that you request a Notice of Privacy Practices from the app provider. This is so you can understand what happens to your data after you stop using the app.

Does the app delete my data after I stop using it?
We suggest that you request a Notice of Privacy Practices from the app provider. This is so you can understand what happens to your data after you stop using the app.

How do I stop sharing my data?
The best way to stop sharing data is through the app or contacting the app's support. If this doesn't work, call Wellcare member services.

Will this app sell my data for any reason, such as advertising or research?
We suggest that you request a Notice of Privacy Practices from the app provider. This is so you can understand if the app will share your data with third parties for advertising and research.

How does this app collect and respond to user complaints?
App providers may respond to user complaints in different ways. We recommend that you ask your app provider this question.

Will my data be stored in a de-identified or anonymized form?
We suggest that you request a Notice of Privacy Practices from the app provider. This is so you can understand how the app stores your data.

What security measures does this app use to protect my data? Will they inform me if an incident occurs?
We recommend that you request a Notice of Privacy Practices and additional information on security practices from the app provider. This is so you can understand how they handle a security incident.

How can I limit this app's use and release of my data?
We recommend that you request a Notice of Privacy Practices from the app provider. This is so you can understand how to limit the use and release of your data.

As a developer, how do I access and use the Patient Access API?
Go to our Partner Portal. Click on “FHIR – Patient Access.” and go to the “Getting Started” tab.

As a developer, how do I access and use the Provider Directory API?
Go to our Partner Portal. Click on “FHIR – Provider Directory” and go to the “Getting Started” tab.