Ohio Admin. Code 4123-6-15 - Confidentiality of records
(A) Subject to sections
2317.02,
4123.27,
and
4123.88
of the Revised Code, certain employer premium, payroll, and claim file
information is confidential and exempt from the general open records laws of
Ohio, as set forth in section
149.43
of the Revised Code.
(B) In the
course of medical management in the HPP, some confidential information may be
provided by the bureau to the MCO, and/or exchanged among the bureau, the MCO,
the employer and its representative, the employee
injured
worker and his or her
the injured worker's representative, the
provider, and the provider's employees and agents. All such parties receiving
and/or exchanging confidential information for use in the HPP shall ensure
transmission of confidential information through secured methods approved by
the bureau, including but not limited to encryption, password protection,
facsimile, and other secure methods.
(C) All parties receiving and/or exchanging
confidential information for use in the HPP shall not use such confidential
information for any use other than to perform duties required by the HPP, and
shall prevent such information from further disclosure or use by unauthorized
persons. MCOs shall not release any confidential information, other than in
accordance with rule
4123-3-22
of the Administrative Code, to any third parties (including, but not limited
to, parent, subsidiary, or affiliate companies, or subcontractors of the MCO)
without the express prior written authorization of the bureau.
(D) MCOs shall comply with, and shall assist
the bureau in complying with, all disclosure, notification or other
requirements contained in sections
1347.12,
1349.19,
1349.191
and
1349.192
of the Revised Code, as may be applicable, in the event computerized data that
includes personal information, obtained by the MCO for use in the HPP, is or
reasonably is believed to have been accessed and acquired by an unauthorized
person and the access and acquisition by the unauthorized person causes, or
reasonably is believed will cause a material risk of identity theft or other
fraud.
(E) MCOs shall comply with
all electronic data security measures as may be required by Ohio law, Ohio
department of administrative services or other state agency directive,
executive order of the governor of Ohio, and/or the MCO contract.
Notes
Promulgated Under: 119.03
Statutory Authority: 4121.12, 4121.121, 4121.30, 4121.31, 4121.44, 4121.441, 4123.05
Rule Amplifies: 149.43, 1347.12, 1347.19, 1347.191, 1347.192, 2317.02, 4121.12, 4121.121, 4121.44, 4121.441, 4123.27, 4123.88
Prior Effective Dates: 02/16/1996, 02/01/2010, 11/13/2015
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
(A) Subject to sections 2317.02, 4123.27, and 4123.88 of the Revised Code, certain employer premium, payroll, and claim file information is confidential and exempt from the general open records laws of Ohio, as set forth in section 149.43 of the Revised Code.
(B) In the course of medical management in the HPP , some confidential information may be provided by the bureau to the MCO, and/or exchanged among the bureau, the MCO, the employer and its representative, the employee injured worker and his or her the injured worker's representative, the provider , and the provider 's employees and agents. All such parties receiving and/or exchanging confidential information for use in the HPP shall ensure transmission of confidential information through secured methods approved by the bureau, including but not limited to encryption, password protection, facsimile, and other secure methods.
(C) All parties receiving and/or exchanging confidential information for use in the HPP shall not use such confidential information for any use other than to perform duties required by the HPP , and shall prevent such information from further disclosure or use by unauthorized persons. MCOs shall not release any confidential information, other than in accordance with rule 4123-3-22 of the Administrative Code, to any third parties (including, but not limited to, parent, subsidiary, or affiliate companies, or subcontractors of the MCO ) without the express prior written authorization of the bureau.
(D) MCOs shall comply with, and shall assist the bureau in complying with, all disclosure, notification or other requirements contained in sections 1347.12, 1349.19, 1349.191 and 1349.192 of the Revised Code, as may be applicable, in the event computerized data that includes personal information, obtained by the MCO for use in the HPP , is or reasonably is believed to have been accessed and acquired by an unauthorized person and the access and acquisition by the unauthorized person causes, or reasonably is believed will cause a material risk of identity theft or other fraud.
(E) MCOs shall comply with all electronic data security measures as may be required by Ohio law, Ohio department of administrative services or other state agency directive, executive order of the governor of Ohio, and/or the MCO contract.
Notes
Promulgated Under: 119.03
Statutory Authority: 4121.12, 4121.121, 4121.30, 4121.31, 4121.44, 4121.441, 4123.05
Rule Amplifies: 149.43, 1347.12, 1347.19, 1347.191, 1347.192, 2317.02, 4121.12, 4121.121, 4121.44, 4121.441, 4123.27, 4123.88
Prior Effective Dates: 02/16/1996, 02/01/2010, 11/13/2015