Provider Notice Issued 03/09/2022

Date:   March 9, 2022

To:       All Medical Assistance Program Providers

Re:      HIPAA Implications of Illinois PASRR Program Redesign Implementation

________________________________________________________________________________________________________ 

The State of Illinois, Department of Healthcare and Family Services (HFS) is working with its vendor, Maximus, for the fulfillment of the federally mandated Pre-admission Screening and Resident Review (PASRR) process. This transition includes moving PASRR processes to a new web-based management system, AssessmentPro, for admissions to nursing facilities. This critical change will impact all PASRR submissions for individuals applying to, or residing in, Medicaid-certified nursing facilities moving forward from the transition date, including: 

• The way all PASRR Level I screens will be submitted 
• The review of all PASRR Level I screens 
• The completion of PASRR Level II Assessments for Serious Mental Illness (SMI).

 The PASRR program transition to AssessmentPro will launch on Monday, March 14, 2022.

HFS and Maximus have heard concerns from providers about privacy and protected health information in the process of providing training and user support on the new system. The purpose of this notice is to clarify that HIPAA is not an obstacle to using AssessmentPro to submit PASRR-related materials. 

Maximus does not need a Business Associate Agreement (BAA) with Illinois providers. Providers' disclosure of PHI to Maximus (a HIPAA Business Associate to HFS) for the purposes of PASRR is a permitted disclosure under HIPAA.  

Illinois providers are allowed to disclose PASRR-related information to HFS (a Covered Entity) directly, for the purposes of Treatment, Payment, and Healthcare Operations under HIPAA. 45 CFR 164.506.
 
A BAA is required when a Covered Entity uses a Business Associate to perform certain functions or activities on behalf of a covered entity.  

• Maximus is not performing a function or activity on behalf of the provider. A BAA between Maximus and the provider is not required nor appropriate. 
• See also Business Associates ! HHS.gov
• Maximus is a Business Associate of HFS.
• As long as a covered entity is allowed to disclose information to another covered entity under HIPAA, the covered entity is permitted to make that disclosure directly to the business associate acting on behalf of the other covered entity.
• See May a covered entity share protected health information directly with another covered entity's business associate? ! HHS.gov

 
See also, guidance from federal CMS contractor PTAC:  https://www.pasrrassist.org/combined/Director's-Corner%3A-Why-HIPAA-Is-NOT-A-Barrier-to-Getting-PASRR-Done

Kelly Cunningham, Administrator
Division of Medical Programs