441—73.18(249A) Records and reports.
	73.18(1) Records system. The managed care organization shall document and maintain clinical and fiscal records in accordance with federal and state requirements, including rule 441—79.3(249A) and 42 CFR 456 as amended to October 16, 2015, throughout the course of the contract. The records system shall:
	a. 	Identify transactions with or on behalf of each enrollee by the state identification number assigned to the enrollee by the department.
	b. 	Provide a rationale for and documentation of decisions made by the managed care organization, based upon medical necessity.
	c. 	Permit effective professional review for medical audit processes.
	d. 	Facilitate an adequate system for monitoring treatment reimbursed by the managed care organization including follow up of the implementation of discharge plans and referral to other providers.
	73.18(2) Content of individual treatment record. The managed care organization shall ensure that participating providers maintain an adequate record-keeping system that includes a complete medical or service record for each enrolled member including documentation of all services provided to each enrollee in compliance with the contract and provisions of rule 441—79.3(249A) and pursuant to federal funding requirements, including 42 CFR 456 as amended to October 16, 2015. Beginning January 1, 2021, the managed care organization shall require use of an electronic visit verification system for personal care services.
	73.18(3) Confidentiality of health care, mental health care, and substance abuse information. The managed care organization shall protect and maintain the confidentiality of health care, mental health care, and substance abuse information by implementing policies for staff and through contract terms with participating providers. The policies must comply with applicable state and federal laws.
[ARC 2358C, IAB 1/6/16, effective 1/1/16; ARC 5597C, IAB 5/5/21, effective 7/1/21]