Medical Support Enforcement under the IV-D Program and Privacy Protections under the Health Insurance Portability and Accountability Act

Policy Interpretation Questions

PIQ-04-03

DATE: June 24, 2004

TO: State IV-D Directors

FROM: Sherri Z. Heller, Ed.D.
Commissioner
Office of Child Support Enforcement

SUBJECT: Guidance Regarding Medical Support Enforcement under the IV-D Program and Privacy Protections under the Health Insurance Portability and Accountability Act

The Office of Child Support Enforcement (OCSE) developed the guidance below to respond to issues from states, employers, and health insurance plan administrators about the Health Insurance Portability and Accountability Act (HIPAA) privacy provisions. The Department of Health and Human Services Office of Civil Rights (OCR), which has oversight responsibilities and is responsible for providing guidance on HIPAA, reviewed the question and response below to ensure that the guidance accurately reflects OCR’s interpretation of the HIPAA privacy provisions. The OCR HIPAA website (http://www.hhs.gov/ocr/hipaa) provides additional guidance about HIPAA.

Some employers and health insurance plan administrators have expressed concerns about responding to, or have declined to respond to, a National Medical Support Notice (NMSN) issued to them by a IV-D agency. We requested policy guidance on the issue from OCR to ensure that states will be able to secure medical support for children, as required under title IV-D of the Act. The following question and response cleared by OCR confirms that HIPAA permits health plans to provide protected health information to IV-D agency in response to a NMSN.

Question: May a health plan disclose protected health information to a State child support enforcement (IV-D) agency in response to a National Medical Support Notice (NMSN)?

Response: The Privacy Rule would permit a health plan to respond to a request for information by a IV-D agency pursuant to a National Medical Support Notice (NMSN).

The Privacy Rule at 45 CFR 164.512(f) permits a covered entity to disclose protected health information to a "law enforcement official" for law enforcement purposes in compliance with court orders, grand jury subpoenas, or certain written administrative requests. 45 CFR 164.512(f)(l)(ii). As defined in 45 CFR 164.501, a "law enforcement official" means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to investigate or conduct an official inquiry into a potential violation of law or to prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law. An employee of a IV-D agency who is acting, in accordance with state or federal law, to enforce a medical child support order meets this definition of a law enforcement official. The NMSN, which is sent by the IV-D agency to the employer and health plan for completion, would constitute a written administrative request by a law enforcement official. The Privacy Rule allows a health plan to disclose protected health information in response to the NMSN, provided it includes or is accompanied by written assurances by the law enforcement official that (1) the information sought is material and relevant to a legitimate law enforcement inquiry; (2) the request is specific and limited in scope; and (3) de-identified information cannot reasonably be used. 45 CFR 164.512(f)(l)(ii)(C).

The health plan may reasonably rely on the NMSN as a request from a public official for the minimum information needed to meet the law enforcement purpose of the request. 45 CFR 164.514(d)(3)(iii)(A). Moreover, information that appears on this nationally uniform form would be sufficient to satisfy the requirements in 45 CFR 164.514(h) that the health plan verify the identity and authority of public officials seeking protected health information who are not known to the covered entity.

cc: ACF Regional Administrators
Regional Program Managers