Privacy and Rights Notices

CMS MEDICARE DMEPOS SUPPLIER STANDARDS

1. A supplier must be in compliance with all applicable Federal and State licensure and regulatory requirements.
2. A supplier must provide complete and accurate information on the DMEPOS supplier application. Any changes to this information must be reported to the National Supplier Clearinghouse within 30 days.
3. A supplier must have an authorized individual (whose signature is binding) sign the enrollment application for billing privileges.
4. A supplier must fill orders from its own inventory, or contract with other companies for the purchase of items necessary to fill orders. A supplier may not contract with any entity that is currently excluded from the Medicare program, any State health care programs, or any other Federal procurement or non-procurement programs.
5. A supplier must advise beneficiaries that they may rent or purchase inexpensive or routinely purchased durable medical equipment, and of the purchase option for capped rental equipment.
6. A supplier must notify beneficiaries of warranty coverage and honor all warranties under applicable State law, and repair or replace free of charge Medicare covered items that are under warranty.
7. A supplier must maintain a physical facility on an appropriate site and must maintain a visible sign with posted hours of operation. The location must be accessible to the public and staffed during posted hours of business. The location must be at least 200 square feet and contain space for storing records.
8. A supplier must permit CMS or its agents to conduct on-site inspections to ascertain the supplier’s compliance with these standards.
9. A supplier must maintain a primary business telephone listed under the name of the business in a local directory or a toll-free number available through directory assistance. The exclusive use of a beeper, answering machine, answering service or cell phone during posted business hours is prohibited.
10. A supplier must have comprehensive liability insurance in the amount of at least $300,000 that covers both the supplier’s place of business and all customers and employees of the supplier. If the supplier manufactures its own items, this insurance must also cover product liability and completed operations.
11. A supplier is prohibited from direct solicitation to Medicare beneficiaries. For complete details on this prohibition see 42 CFR § 424.57 (c) (11).
12. A supplier is responsible for delivery of and must instruct beneficiaries on the use of Medicare covered items, and maintain proof of delivery and beneficiary instruction.
13. A supplier must answer questions and respond to complaints of beneficiaries, and maintain documentation of such contacts.
14. A supplier must maintain and replace at no charge or repair cost either directly, or through a service contract with another company, any Medicare-covered items it has rented to beneficiaries.
15. A supplier must accept returns of substandard (less than full quality for the particular item) or unsuitable items (inappropriate for the beneficiary at the time it was fitted and rented or sold) from beneficiaries.
16. A supplier must disclose these standards to each beneficiary it supplies a Medicare-covered item.
17. A supplier must disclose any person having ownership, financial, or control interest in the supplier.
18. A supplier must not convey or reassign a supplier number; i.e., the supplier may not sell or allow another entity to use its Medicare billing number.
19. A supplier must have a complaint resolution protocol established to address beneficiary complaints that relate to these standards. A record of these complaints must be maintained at the physical facility.
20. Complaint records must include: the name, address, telephone number and health insurance claim number of the beneficiary, a summary of the complaint, and any actions taken to resolve it.
21. A supplier must agree to furnish CMS any information required by the Medicare statute and regulations.
22. All suppliers must be accredited by a CMS-approved accreditation organization in order to receive and retain a supplier billing number. The accreditation must indicate the specific products and services, for which the supplier is accredited in order for the supplier to receive payment for those specific products and services (except for certain exempt pharmaceuticals).
23. All suppliers must notify their accreditation organization when a new DMEPOS location is opened.
24. All supplier locations, whether owned or subcontracted, must meet the DMEPOS quality standards and be separately accredited in order to bill Medicare.
25. All suppliers must disclose upon enrollment all products and services, including the addition of new product lines for which they are seeking accreditation.
26. A supplier must meet the surety bond requirements specified in 42 CFR § 424.57 (d).
27. A supplier must obtain oxygen from a state-licensed oxygen supplier.
28. A supplier must maintain ordering and referring documentation consistent with provisions found in 42 CFR § 424.516(f).
29. A supplier is prohibited from sharing a practice location with other Medicare providers and suppliers.
30. A supplier must remain open to the public for a minimum of 30 hours per week except physicians (as defined in section 1848(j) (3) of the Act) or physical and occupational therapists or a DMEPOS supplier working with custom made orthotics and prosthetics.

DMEPOS suppliers have the option to disclose the following statement to satisfy the requirement outlined in Supplier Standard 16 in lieu of providing a copy of the standards to the beneficiary.

The products and/or services provided to you by ( supplier legal business name or DBA) are subject to the supplier standards contained in the Federal regulations shown at 42 Code of Federal Regulations Section 424.57(c). These standards concern business professional and operational matters (e.g. honoring warranties and hours of operation). The full text of these standards can be obtained at http://www.ecfr.gov. Upon request we will furnish you a written copy of the standards.

NOTICE OF PRIVACY PRACTICES

Effective [DATE]
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions, please contact our Compliance Officer at the address or phone number available below.

Who will follow this notice?
HCD provides health care products and supplies to our patients and/or their loved ones in partnership with physicians and other professionals and organizations. The privacy practices in this notice will be followed by:
• All departments and units of HCD.
• All employed teammates and contract staff, including Billing and Information Technology personnel with whom we may share information.
• Any business associate of HCD with whom we share health information in order to provide your supplies and bill your insurer.

Our pledge to you
We understand that medical information about you is personal. We are committed to protecting medical information about you. We create a record of your medical condition and the products, supplies, and/or services HCD provides to ensure appropriate care and to comply with legal requirements.
This notice applies separately to each department of our organization, whether the documents are created by company staff or your personal doctor. Your personal doctor may have different policies or notices regarding the doctor’s use and disclosure of your medical information created in the doctor’s office. We are required by law to:
• Keep medical information about you private and notify you of any breach of unsecured protected health information about you.
• Give you this notice of our legal duties and privacy practices with respect to medical information about you.
• Follow the terms of the notice that is currently in effect.

Changes to this notice
We may change our policies. Changes will apply to medical information we already hold, as well as new information received after a change occurs. Before we make a significant change in our policies, we will change our notice and post the new notice on our website at www.HCD.com. You may request a copy of the current notice at any time by contacting HCD’s Corporate Compliance Department at (800) 565-5644.
How we may use and disclose medical information about you
• We may use and disclose medical information about you for treatment (such as sending medical information about you to your doctor’s office as part of obtaining required physician authorization); to obtain payment for products, supplies, and/or services (such as sending a list of products or supplies purchased to your insurer); and to support our business operations (such as operating our website and comparing patient data to improve product availability). For more information regarding how we use your information in connection with our website, please see our website Privacy Policy at https://www.hcd.com/legal/privacy-policy.
• We may use or disclose medical information about you without your prior authorization for several other reasons, such as complying with the law, reporting abuse and neglect, public health and safety purposes, business oversight audits or inspections, research studies, worker’s compensation purposes, to respond to lawsuits and legal actions, and emergencies. We may also disclose medical information when required by law, such as in response to a request from law enforcement in specific circumstances, or in response to valid judicial or administrative orders.
• We also may contact you to tell you about or recommend products, supplies, or services options, alternatives, or health-related benefits that may be of interest to you, but only if we do not receive financial remuneration from a third party in exchange for making those communications.
• We may disclose medical information about you to a friend or family member who is designated by you or your caregiver and is involved in your medical care.
• As part of ongoing quality improvement efforts, we may send you a survey via mail or email about your experience.

Other uses of medical information
• In any other situation not covered by this notice, we will ask for your written authorization before using or disclosing medical information about you. Examples of uses and disclosures of medical information that require your authorization include but are not limited to: most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and disclosures that constitute a sale of protected health information. If you choose to authorize use or disclosure, you can later revoke that authorization by notifying HCD in writing of your decision.

Your rights regarding medical information about you
• When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
• In most cases, you have the right to review or receive a copy of medical information that we use to make decisions about your products, supplies or services, when you submit a written request; if any of this medical information is maintained by us electronically, you may request an electronic copy. If you would like, we also can send this information in either paper or electronic form to another person you identify within your request. Ask us how to do this. If you request copies, we may charge a reasonable, cost-based fee for the cost of copying, mailing or other related supplies. If we deny your request to review or obtain a copy, you may submit a written request for a review of that decision.
• If you believe that information in your record is incorrect or if important information is missing, you have the right to request that we correct the records, by submitting a request in writing that provides your reason for requesting the amendment. We could deny your request to amend a record if the information was not created by us; if it is not part of the medical information maintained by us; or if we determine the record is accurate. You may appeal, in writing, a decision by us not to amend a record.
• You have the right to request a list of those instances where we have disclosed medical information about you, other than for treatment, payment, business operations or where you specifically authorized a disclosure, when you submit a written request. The request must state the time desired for the accounting, which must be less than a 6-year period and starting after April 14, 2003. You may receive the list in paper or electronic form. The first disclosure list request in a 12-month period is free; other requests will be charged according to our cost of producing the list. We will inform you of the cost before you incur any costs.
• If this notice was sent to you electronically, you have the right to a paper copy of this notice.
• You have the right to request that medical information about you is communicated to you in a confidential manner, such as sending mail to an address other than your home, by notifying us in writing of the specific way or location for us to use to communicate with you.
• You may request, in writing, that we not use or disclose medical information about you for treatment, payment or business operations or to persons involved in your care except when specifically authorized by you, when required by law, or in an emergency. We will consider your request but we are not legally required to accept it, unless your request is with respect to a disclosure of medical information to a health plan for the purpose of payment or health care operations, and the disclosure relates to an item or service for which we have been paid in full (either by you or by someone, other than the health plan, acting on your behalf). We will inform you of our decision on your request. All written requests or appeals should be submitted to our Compliance Officer listed at the end of this notice.

Complaints
• If you are concerned that your privacy rights may have been violated, or you disagree with a decision we made about access to your records, you may contact our Compliance Officer (Home Care Delivered, Attn: Compliance Officer, 11013 West Broad Street, 4th Floor, Glen Allen, VA 23060). In addition, you may contact CHAP (Community Health Accreditation Program, Inc.) directly at (800) 656-9656 (Monday – Friday 8:00 AM -5:00 PM Eastern time). In Texas complaints may be submitted to the Office of the Ombudsman. There are four ways to contact the Ombudsman (1) Call: 866-566-8989, 8 a.m. – 5 p.m., Monday – Friday If you have a hearing or speech disability, call the toll-free Relay Texas service at 7-1-1 or 800-735-2989. (2) Online: Submit your question or complaint online. (3) Mail: Texas Health and Human Services Commission Ombudsman for Managed Care P.O. Box 13247 Austin, TX 78711-3247. (4) Fax: 888-780-8099.

Finally, you may send a written complaint to the U.S. Department of Health and Human Services Office of Civil Rights. Our Compliance Officer can provide you with the address. Under no circumstance will you be penalized or retaliated against for filing a complaint.

NOTICE OF NON-DISCRIMINATION

Please view our website for more information – https://www.hcd.com/need-medical-supplies/notice-of-non-discrimination/