MEDCHART | CBT

• 5 U.S.C. 552a, as amended, the Privacy Act of 1974 (hereafter referred to as “Privacy Act")
• Public Law 104-191, as amended, the Health Insurance Portability and Accountability Act of 1996 (hereafter referred to as “HIPAA”)
• 45 C.F.R. § 160 and 164, Final Privacy Rule and Final Security Rule
• Department of Defense, military service specific and component specific policies which further define and direct the use of information and systems covered in the statues listed above

Authority to Operate

System of Records Notice (SORN): A0040-66 ARNG, originally published in Federal Register, Vol. 79, No. 180, September 17, 2014.

Records Disposition Authority: DAA-AU-2016-0006

Although not designed to directly support the provision of care, certain information maintained within this system may be useful to the Military Health System (MHS) in providing care to individuals. As such, the military owners of this system adopt the MHS Notice of Privacy Practices with addendums or modifications as listed in this specific MEDCHART Notice of Privacy and Security Practices.

All users of MEDCHART (including those with read only access) will adhere to the requirements specified within this notice. Unless otherwise indicated, the term “users” includes contractors managing the system on behalf of the government and other agencies with whom MEDCHART maintains an information sharing agreement.

MEDCHART is accredited for Controlled Unclassified Information (CUI) and below only. Do not process, store, or transmit information classified above the accreditation level of this system.

All information, including personal information, placed on or sent over this system may be monitored. Statistics and other information about your visit may be recorded. Use of this system constitutes consent to monitoring for these purposes.

For site security purposes and to ensure that this service remains available to all users, this government computer system employs software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage.

By accessing this U.S. Government (USG) information site (IS), including any device attached to this IS, you consent to the following:

• The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
• At any time, the USG may inspect and seize data stored on this IS.
• Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
• This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
• Notwithstanding the above, using an information system does not constitute consent to personnel misconduct, law enforcement, or counterintelligence investigative searching or monitoring of the content of privileged communications or data (including work product) that are related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Under these circumstances, such communications and work product are private and confidential, as further explained below:
  • Nothing in this notice shall be interpreted to limit the user's consent to, or in any other way restrict or affect, any U.S. Government actions for purposes of network administration, operation, protection, or defense, or for communications security. This includes all communications and data on an information system, regardless of any applicable privilege or confidentiality.
  • The user consents to interception/capture and seizure of ALL communications and data for any authorized purpose (including personnel misconduct, law enforcement, or counterintelligence investigation). However, consent to interception/capture or seizure of communications and data is not consent to the use of privileged communications or data for personnel misconduct, law enforcement, or counterintelligence investigation against any party and does not negate any applicable privilege or confidentiality that otherwise applies.
  • Whether any particular communication or data qualifies for the protection of a privilege, or is covered by a duty of confidentiality, is determined in accordance with established legal standards and DoD policy. Users are strongly encouraged to seek personal legal counsel on such matters prior to using an information system if the user intends to rely on the protections of a privilege or confidentiality.
  • Users should take reasonable steps to identify such communications or data that the user asserts are protected by any such privilege or confidentiality. However, the user's identification or assertion of a privilege or confidentiality is not sufficient to create such protection where none exists under established legal standards and DoD policy.
  • A user's failure to take reasonable steps to identify such communications or data as privileged or confidential does not waive the privilege or confidentiality if such protections otherwise exist under established legal standards and DoD policy. However, in such cases the U.S. Government is authorized to take reasonable actions to identify such communication or data as being subject to a privilege or confidentiality, and such actions do not negate any applicable privilege or confidentiality.
  • These conditions preserve the confidentiality of the communication or data, and the legal protections regarding the use and disclosure of privileged information, and thus such communications and data are private and confidential. Further, the U.S. Government shall take all reasonable measures to protect the content of captured/seized privileged communications and data to ensure they are appropriately protected.
• In cases when the user has consented to content searching or monitoring of communications or data for personnel misconduct, law enforcement, or counterintelligence investigative searching, (i.e., for all communications and data other than privileged communications or data that are related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants), the U.S. Government may, solely at its discretion and in accordance with DoD policy, elect to apply a privilege or other restriction on the U.S. Government's otherwise-authorized use or disclosure of such information.
• All of the above conditions apply regardless of whether the access or use of an information system includes the display of a Notice and Consent Banner ("banner"). When a banner is used, the banner functions to remind the user of the conditions that are set forth in this User Agreement, regardless of whether the banner describes these conditions in full detail or provides a summary of such conditions, and regardless of whether the banner expressly references this User Agreement.
• Unauthorized use of the information system is prohibited and subject to criminal and civil penalties.

This Website does not use persistent cookies (persistent tokens that pass information back and forth from the client machine to the server).

This site may use session cookies (tokens that remain active only until you close your browser) in order to make the site easier to use.

This web site DOES NOT keep a database of information obtained from these cookies.

You can choose not to accept these cookies and still use the site, but it may take you longer to fill out the same information repeatedly and clicking on the banners will not take you to the correct link. Refer to the help information in your browser software for instructions on how to disable cookies.

All users of MEDCHART, regardless of the role and permissions used for access, are required to safeguard all PII and PHI contained in the system to the fullest extent possible.

MEDCHART users will use the “MINIMUM NECESSARY RULE” to guide all actions within the system, to include disclosure of information. Routine uses as described in this notice are not sufficient grounds for mishandling or inappropriate disclosure of either PII or PHI.

All MEDCHART users are required to complete comprehensive initial training on the proper handling of PII and PHI, and complete annual refresher training in order to retain system access.

Users are required to report known or suspected violations of PII and PHI privacy rules to their leadership or to the appropriate POC listed in the “FOR USERS OF THIS SYSTEM” section of “WHO TO CONTACT FOR PRIVACY OR SECURITY RELATED CONCERNS.” This includes accidental or incidental violations.

In general, routine uses of information in MEDCHART fall into two general categories:

• Standard Uses (the primary purposes for which the Government owners developed and maintain the system. This includes the routine uses of all “users” except those of the contractor responsible for managing the system)
• System Management Uses (actions and activities on the part of the contractor responsible for keeping the system functional)

The information managed and maintained in MEDCHART may be disclosed and used for routine purposes as indicated below without expressed authorization of the individual.

In ALL cases, only the MINIMAL NECESSARY information will be disclosed and/or used in order to perform necessary functions and duties.

(Note: An accounting of disclosure of information in any of these situations may be provided to the individual upon request. See “Who to Contact for Privacy or Security Related Concerns” for more information.)

System Owner Uses:
(the primary purposes for which the Government owners developed and maintain the system. This includes the routine uses of all “users” except those of the contractor responsible for managing the system)

• Armed Forces PHI for Military Activity and National Security. To certain officials and for special government functions including:
  • Military command authorities, where needed, to ensure the proper execution of the military mission, including evaluation of fitness for duty
  • The Department of Veterans Affairs (VA) for determinations of eligibility for benefits
  • State government agencies for determination of eligibility for state-sponsored benefits
  • Foreign military authorities with respect to their armed services members (if applicable)
  • Authorized Federal officials for national security or intelligence activities, or protective services for the President and others
• Health Readiness Activities and Health Care Operations. To support the necessary health care activities related to individual medical readiness. These activities include, but are not limited to, quality assessment activities, patient safety, investigations, oversight of staff performance, practitioner training, licensing, communications about a product or service, and conducting or arranging for other health care related activities. We do not use or disclose any genetic information for underwriting purposes.
• Treatment. To coordinate, manage, or support individual health care (aka, “continuity of care”). For example, PHI may be disclosed to a Military Treatment Facility (MTF), physician, or health care provider, such as a specialist, pharmacist, or laboratory, who, at the request of your provider, becomes involved with your health care.
• Payment. To obtain payment for health care services where applicable by law and policy. This may include certain activities needed to approve or pay for health care services, such as using or disclosing PHI to obtain approval for a hospital stay or payment of services by a third party involved in providing medical readiness activities.
• Business Associates. In support of authorized services provided by the Military Healthcare System (MHS), specific elements of PHI and PII may be disclosed to certain companies (“business associates”) that also provide various services to the MHS (for example, billing, transcription, software maintenance, legal services, and managed care support). The law requires that business associates protect your PHI and comply with the same HIPAA Privacy standards.
• Public Health. To public health authorities and parties regulated by them, as permitted by law. Examples of why they may need your PHI include prevention or control of disease, injury, or disability.
• Reporting Victims of Abuse, Neglect, or Domestic Violence. To government authorities that have authority to receive such information, including a social service or protective service agency.
• Communicable Diseases. To a person who might be at risk of contracting or spreading a communicable disease or condition.
• Workers’ Compensation. To workers’ compensation programs in support of compensation claims and payment. This includes coordination with appropriate government personnel agencies (such as G-1, A-1, etc.)
• Health Oversight. To a health oversight agency legally authorized for audits, investigations, and inspections. Such activities may include the health care system, government benefit programs, civil rights laws, and other government regulatory programs.
• Required by Law. To government and other entities as required by federal or state law (including DoD and Military Department regulations). For example, we may be required to disclose your PHI to the Department of Health and Human Services (HHS) investigating HIPAA violations or to a DoD Inspector General conducting other investigations.
• Legal Proceedings. To parties and entities in proceedings of courts and administrative agencies, including in response to a court order or subpoena.
• Inmates. To a correctional facility with respect to inmates who are, or were, members of the Armed Forces supported by MEDCHART.
• Coroners, Funeral Directors, and Organ Donations. To coroners, medical examiners, or funeral directors, and to determine the cause of death or for the performance of other duties. PHI also may be used and disclosed for cadaver organs, eyes, or tissue donations.
• Law Enforcement. To law enforcement authorities. For example, to investigate a crime involving individuals for whom data/information is maintained in MEDCHART.
• Research. To researchers. Government managers of MEDCHART will review any research proposals and protocols to ensure the privacy of your PHI requested for such research activities prior to release.
• Avert Threats. To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Disclosures by the Health Plan. To parties that need your PHI for health plan purposes such as enrollment, eligibility verification, coordination of coverage, or other benefit programs.
• Minors and Other Represented Beneficiaries. To parents, guardians, and other personal representatives, generally consistent with the law of the state where treatment is provided.

System Management Uses:
(actions and activities on the part of the contractor responsible for keeping the system functional)

• Database Maintenance and Development.
• System Help and Troubleshooting.
• Responses by System Owners for Data Queries.

Personally Identifiable Information (PII) contained in this system is subject to the 5 U.S.C. 552a, as amended, the Privacy Act of 1974 and DoD 5400.11-R, "Department of Defense Privacy Program." Personally Identifiable Information contained in this system may be used only by authorized persons in the conduct of official business. Any individual responsible for unauthorized disclosure or misuse of personal information may be subject to a fine of up to $5000. Executive Order 9397 authorizes solicitation and use of social security numbers (SSN's) as a numerical identifier for federal personnel that are identified in most federal record systems.

Protected Health Information (PHI) in this system is subject to Public Law 104-191, the Health Insurance Portability and Accountability Act of 1996 and the Final Privacy Rule and Final Security Rule codified in 45 C.F.R. § 160 and 164, DoD 6025.18-R, "DoD Health Information Privacy Regulation" and DoD 8580.02-R, "DoD Health Information Security Regulation." Information in this system may only be used and/or disclosed in strict conformance with these authorities.

The government owners of this system are required to and will apply appropriate sanctions against individuals who fail to comply with its privacy policies and procedures. By law these sanctions may be applied as follows:

You may exercise the following rights through a written request to the appropriate point of contact listed in “Who to Contact for Privacy or Security Related Concerns” below (hereafter collectively referred to as “POC”).

• Right to Inspect and Receive a Copy. As allowed by law, you may inspect and request a copy of your medical or billing records (including an electronic copy). You have the right to have the information sent directly to a party you designate, such as your physician. In limited situations, the POC may deny your request or part of it, but if they do, the POC will tell you why in writing and explain your right to review, if any.
• Right to Request Restrictions. You may ask the POC not to share any part of your PHI for treatment, payment, or health care operations. You may also request that a limit the information shared about you to someone who is involved in your care or the payment of your care. In your request, you must tell the POC what information you want restricted, and to whom you want the restriction to apply. None of the POCs are required to agree to your request; however, full consideration will be given to all requests and in most circumstances will likely be accepted. Requests to restrict disclosure of your PHI to a health plan (including a TRICARE health plan), where the PHI relates to the care in which you paid for in full out of pocket, will not be denied. Your PHI will not be used or disclosed in violation of any agreed-upon request, except for emergency treatment purposes. Previously agreed-upon restrictions may be revoked/ended by either you or the appropriate POC at any time by providing written notice to the appropriate party.
• Right to Request Confidential Communications. You may request that the POC or your medical management team communicate with you in a certain way or at a certain location (e.g., only at home or only by mail). They will accommodate reasonable requests.
• Right to Request Amendment. You may request an amendment to your PHI if you believe there is an error. You must tell the POC what you would like corrected or added to your information and why. If your request is approved, the correction or addition to your PHI will be made. If your request is denied, you will be told why and be given an explanation of your right to file a written statement of disagreement.
• Right to an Accounting of Disclosures. You may request, in writing, an accounting of when and to whom your PHI was disclosed outside of the routine uses mentioned above and, in most instanced, including some to those routine uses. Your request must state the time period for which you want to receive the accounting, which may be up to six years before the date of your request. You are entitled to one disclosure accounting in a 12-month period at no charge. You could possibly be charged a fee for additional requested accountings.

You are also responsible for certain actions to help ensure the records maintained in this system accurately reflect you and your health/readiness status. Some of these responsibilities include:

• Identifying/reporting any change in your health status that impacts your readiness or program benefits.
• Ensuring your contact information is current, including contact information in other personnel systems that may connect with MEDCHART.