208.217.  Department may obtain medical insurance information — failure to provide information, attorney general to bring action, penalty — confidential information, penalty for disclosure — applicability to department of mental health. — 1.  As used in this section, the following terms mean:

  (1)  "Data match", a method of comparing the department's information with that of another entity and identifying those records which appear in both files.  This process is accomplished by a computerized comparison by which both the department and the entity utilize a computer readable electronic media format;

  (2)  "Department", the Missouri department of social services;

  (3)  "Entity":

  (a)  Any insurance company as defined in chapter 375 or any public organization or agency transacting or doing the business of insurance; or

  (b)  Any health service corporation or health maintenance organization as defined in chapter 354 or any other provider of health services as defined in chapter 354;

  (c)  Any self-insured organization or business providing health services as defined in chapter 354; or

  (d)  Any third-party administrator (TPA), administrative services organization (ASO), or pharmacy benefit manager (PBM) transacting or doing business in Missouri or administering or processing claims or benefits, or both, for residents of Missouri;

  (4)  "Individual", any applicant or present or former participant receiving public assistance benefits under sections 208.151 to 208.159 or a person receiving department of mental health services for the purposes of subsection 9 of this section;

  (5)  "Insurance", any agreement, contract, policy plan or writing entered into voluntarily or by court or administrative order providing for the payment of medical services or for the provision of medical care to or on behalf of an individual;

  (6)  "Request", any inquiry by the MO HealthNet division for the purpose of determining the existence of insurance where the department may have expended MO HealthNet benefits.

  2.  The department may enter into a contract with any entity, and the entity shall, upon request of the department of social services, inform the department of any records or information pertaining to the insurance of any individual.

  3.  The information which is required to be provided by the entity regarding an individual is limited to those insurance benefits that could have been claimed and paid by an insurance policy agreement or plan with respect to medical services or items which are otherwise covered under the MO HealthNet program.

  4.  A request for a data match made by the department pursuant to this section shall include sufficient information to identify each person named in the request in a form that is compatible with the recordkeeping methods of the entity.  Requests for information shall pertain to any individual or the person legally responsible for such individual and may be requested at a minimum of twice a year.

  5.  The department shall reimburse the entity which is requested to supply information as provided by this section for actual direct costs, based upon industry standards, incurred in furnishing the requested information and as set out in the contract.  The department shall specify the time and manner in which information is to be delivered by the entity to the department.  No reimbursement will be provided for information requested by the department other than by means of a data match.

  6.  Any entity which has received a request from the department pursuant to this section shall provide the requested information in compliance with HIPAA required transactions within sixty days of receipt of the request.  Willful failure of an entity to provide the requested information within such period shall result in liability to the state for civil penalties of up to ten dollars for each day thereafter.  The attorney general shall, upon request of the department, bring an action in a circuit court of competent jurisdiction to recover the civil penalty.  The court shall determine the amount of the civil penalty to be assessed.  A health insurance carrier, including instances where it acts in the capacity of an administrator of an ASO account, and a TPA acting in the capacity of an administrator for a fully insured or self-funded employer, is required to accept and respond to the HIPAA ANSI standard transaction for the purpose of validating eligibility.

  7.  The director of the department shall establish guidelines to assure that the information furnished to any entity or obtained from any entity does not violate the laws pertaining to the confidentiality and privacy of an applicant or participant receiving MO HealthNet benefits.  Any person disclosing confidential information for purposes other than set forth in this section shall be guilty of a class A misdemeanor.

  8.  The application for or the receipt of benefits under sections 208.151 to 208.159 shall be deemed consent by the individual to allow the department to request information from any entity regarding insurance coverage of said person.

  9.  The provisions of this section that apply to the department of social services shall also apply to the department of mental health when contracting with any entity to supply information as provided for in this section regarding an individual receiving department of mental health services.