Change Control All systems processing and/or storing PHI COUNTY discloses to 14 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 15 must have a documented change control procedure that ensures separation of duties and protects the 16 confidentiality, integrity and availability of data.
Data Exchange Except where prohibited by law or regulation, MCP and MHP/DMC-ODS must share the minimum necessary data and information to facilitate referrals and coordinate care under this MOU. The Parties must have policies and procedures for supporting the timely and frequent exchange of Member information and data, including behavioral health and physical health data; for ensuring the confidentiality of exchanged information and data; and, if necessary, for obtaining Member consent, when required. The minimum necessary information and data elements to be shared as agreed upon by the Parties, are set forth in this MOU. To the extent permitted under applicable law, the Parties must share, at a minimum, Member demographic information, behavioral and physical health information, diagnoses, assessments, medications prescribed, laboratory results, referrals/discharges to/from inpatient or crisis services and known changes in condition that may adversely impact the Member’s health and/or welfare. The Parties must annually review and, if appropriate, update this MOU to facilitate sharing of information and data. MHP/DMC-ODS and MCP must establish policies and procedures to implement the following with regard to information sharing: i. A process for timely exchanging information about Members eligible for ECM, regardless of whether the Specialty Mental Health or DMC-ODS provider is serving as an ECM provider; ii. A process for MHP/DMC-ODS to send regular, frequent batches of referrals to ECM and Community Supports to MCP in as close to real time as possible; iii. A process for MHP/DMC-ODS to send admission, discharge, and transfer data to MCP when Members are admitted to, discharged from, or transferred from facilities contracted by MHP/DMC-ODS (e.g., psychiatric inpatient hospitals, psychiatric health facilities, residential mental health facilities, residential SUD treatment facilities, residential SUD withdrawal management facilities), and for MCP to receive this data. This process may incorporate notification requirements as described in Section 8(a)(v)(3); iv. A process to implement mechanisms to alert the other Party of behavioral health crises (e.g., MHP/DMC-ODS alerts MCP of Members’ uses of mobile health, psych inpatient, and crisis stabilization and MCP alerts MHP of Members’ visits to emergency departments and hospitals); and v. A process for MCP to send admission, discharge, and transfer data to MHP/DMC-ODS when Members are admitted to, discharged from, or transferred from facilities contracted by MCP (e.g., emergency department, inpatient hospitals, nursing facilities), and for MHP/DMC-ODS to receive this data. This process may incorporate notification requirements as described in Section 8(a)(v)(3). The Parties mutually agree to ensure the safe sharing of Protected Health Information (PHI) in a timely manner, in accordance with appropriate data sharing, confidentiality and data exchange methods as well as the applicable privacy law(s). If/when Member signed authorized is required to disclose PHI under 42 C.F.R. Part, HIPAA or WIC 5328, MCP and MHP/DMC-ODS mutually agree to utilize the MHP/DMC-ODS Authorization to Release PHI Form: COM001_E (English); COM001_S (Spanish); COM001_V (Vietnamese) that can be found on the MHP/DMC-ODS website.