§149.30. Definitions. — Inbound Citations

(a) A carrier must comply with requirements described in 26 CFR 54.9816-3, 54.9816-6A, 54.9816-6, 54.9816-8, 54.9816-9, 54.9817-2; 29 CFR 2590.716-3 through 2590.716-6, 2590.716-6A, 2590.716-8, 2590.717-1, 2590.717-2, 2590.722, 2590.725-1 through 2590.725-4; and 45 CFR 149.30, 149.100, 149.110 through 149.140, 149.310, 149.510 through 530, and 149.710 through 149.740 in the same manner as such provisions apply to a group health plan or health insurance issuer offering group or individual health insurance coverage, subject to 5 U.S.C. 8902(m)(1), and the provisions of the carrier's contract. For purposes of application of such sections, all carriers are deemed to offer health benefits in the large group market.

(2) Unless otherwise stated, the definitions in § 149.30 of this part apply to this section. Additionally, for purposes of this section, the following definitions apply:

(i) Batched qualified IDR items and services means multiple qualified IDR items or services that are considered jointly as part of one payment determination by a certified IDR entity for purposes of the Federal IDR process in accordance with paragraph (c)(4)(i) of this section.

(ii) Breach means the acquisition, access, use, or disclosure of individually identifiable health information (IIHI) in a manner not permitted under paragraph (e)(2)(v) of this section that compromises the security or privacy of the IIHI.

(A) (1) Any unintentional acquisition, access, or use of IIHI by personnel, a contractor, or a subcontractor of a certified IDR entity that is acting under the authority of that certified IDR entity, if the acquisition, access, or use was made in good faith and within the scope of that authority and that does not result in further use or disclosure in a manner not permitted under paragraph (e)(2)(v) of this section.

(2) Any inadvertent disclosure by a person who is authorized to access IIHI at a certified IDR entity to another person authorized to access IIHI at the same certified IDR entity, and the information received as a result of the disclosure is not further used or disclosed in a manner not permitted under paragraph (e)(2)(v) of this section.

(3) A disclosure of IIHI in which a certified IDR entity has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

(B) Except as provided in paragraph (a)(2)(ii)(A) of this definition, access, use, or disclosure of IIHI in a manner not permitted under paragraph (e)(2)(v) of this section is presumed to be a breach unless the certified IDR entity demonstrates that there is a low probability that the security or privacy of the IIHI has been compromised based on a risk assessment encompassing at least the following factors:

(1) The nature and extent of the IIHI involved, including the types of identifiers and the likelihood of re-identification;

(2) The unauthorized person who used the IIHI or to whom the disclosure was made;

(3) Whether the IIHI was actually acquired or viewed; and

(4) The extent to which the risk to the IIHI has been mitigated.

(iii) Certified IDR entity means an entity responsible for conducting determinations under paragraph (c) of this section that meets the certification criteria specified in paragraph (e) of this section and that has been certified by the Secretary, jointly with the Secretaries of Labor and the Treasury.

(iv) means, with respect to a party to a payment determination, or certified IDR entity, a material relationship, status, or condition of the party, or certified IDR entity that impacts the ability of the certified IDR entity to make an unbiased and impartial payment determination. For purposes of this section, a conflict of interest exists when a certified IDR entity is:

(A) A group health plan; a health insurance issuer offering group health insurance coverage, individual health insurance coverage, or short-term, limited-duration insurance; a carrier offering a health benefits plan under 5 U.S.C. 8902; or a provider, a facility, or a provider of air ambulance services;

(B) An affiliate or a subsidiary of a group health plan; a health insurance issuer offering group health insurance coverage, individual health insurance coverage, or short-term limited-duration insurance; a carrier offering a health benefits plan under 5 U.S.C. 8902; or a provider, a facility, or a provider of air ambulance services;

(C) An affiliate or subsidiary of a professional or trade association representing group health plans; health insurance issuers offering group health insurance coverage, individual health insurance coverage, or short-term limited duration insurance; carriers offering a health benefits plan under 5 U.S.C. 8902; or providers, facilities, or providers of air ambulance services.

(D) A certified IDR entity, that has, or that has any personnel, contractors, or subcontractors assigned to a determination who have, a material familial, financial, or professional relationship with a party to the payment determination being disputed, or with any officer, director, or management employee of the plan, issuer, or carrier offering a health benefits plan under 5 U.S.C. 8902; the plan or coverage administrator, plan or coverage fiduciaries, or plan, issuer or carrier employees; the health care provider, the health care provider's group or practice association; the provider of air ambulance services, the provider of air ambulance services' group or practice association, or the facility that is a party to the dispute.

(v) Credible information means information that upon critical analysis is worthy of belief and is trustworthy.

(vi) IDR entity means an entity that may apply or has applied for certification to conduct determinations under paragraph (c) of this section, and that currently is not certified by the Secretary, jointly with the Secretaries of Labor and the Treasury, pursuant to paragraph (e) of this section.

(vii) Individually identifiable health information (IIHI) means any information, including demographic data, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(A) That identifies the individual; or

(B) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

(viii) Material familial relationship means any relationship as a spouse, domestic partner, child, parent, sibling, spouse's or domestic partner's parent, spouse's or domestic partner's sibling, spouse's or domestic partner's child, child's parent, child's spouse or domestic partner, or sibling's spouse or domestic partner.

(ix) Material financial relationship means any financial interest of more than five percent of total annual revenue or total annual income of a certified IDR entity or an officer, director, or manager thereof, or of a reviewer or reviewing physician employed or engaged by a certified IDR entity to conduct or participate in any review in the Federal IDR process. The terms annual revenue and annual income do not include mediation fees received by mediators who are also arbitrators, provided that the mediator acts in the capacity of a mediator and does not represent a party in the mediation.

(x) Material professional relationship means any physician-patient relationship, any partnership or employment relationship, any shareholder or similar ownership interest in a professional corporation, partnership, or other similar entity; or any independent contractor arrangement that constitutes a material financial relationship with any expert used by the certified IDR entity or any officer or director of the certified IDR entity.

(xi) Qualified IDR item or service means an item or service:

(A) That is an emergency service furnished by a nonparticipating provider or nonparticipating facility subject to the protections of 26 CFR 54.9816-4T, 29 CFR 2590.716-4, or § 149.110, as applicable, for which the conditions of § 149.410(b) are not met, or an item or service furnished by a nonparticipating provider at a participating health care facility, subject to the requirements of 26 CFR 54.9816-5T, 29 CFR 2590.717-5, or § 149.120, as applicable, for which the conditions of § 149.420(c)-(i) are not met, or air ambulance services furnished by a nonparticipating provider of air ambulance services subject to the protections of 26 CFR 54.9817-1T, 29 CFR 2590.717-1, or § 149.130, as applicable, and for which the out-of-network rate is not determined by reference to an All-Payer Model Agreement under section 1115A of the Social Security Act or a specified State law as defined in § 149.30;

(B) With respect to which a provider or facility (as applicable) or group health plan or health insurance issuer offering group or individual health insurance coverage submits a notification under paragraph (b)(2) of this section;

(C) That is not an item or service that is the subject of an open negotiation under paragraph (b)(1) of this section; and

(D) That is not an item or service for which a notification under paragraph (b)(2) of this section is submitted during the 90-calendar-day period under paragraph (c)(4)(vi)(B) of this section, but that may include such an item or service if the notification is submitted during the subsequent 30-business-day period under paragraph (c)(4)(vi)(C) of this section.

(xii) Unsecured IIHI means IIHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary, jointly with the Secretary of the Treasury and the Secretary of Labor.

(a) Unless otherwise stated, the definitions in § 149.30 apply.

(iv) For self-insured group health plans not otherwise subject to State law, including self-insured church plans and self-insured non-Federal governmental plans, any State(s) in which the group health plan has properly effectuated an election to opt in to a specified State law as defined in § 149.30, or an All-Payer Model Agreement under section 1115A of the Social Security Act, if the terms of that agreement allow a plan not otherwise subject to the agreement to opt in; and for FEHB Program plans that adopt a specified State law or All-Payer Model Agreement under their FEHB Program carrier's contract terms, any State(s) in which they have made such an adoption;

For purposes of this subpart, the following definitions apply in addition to the definitions in § 149.30: