42 U.S.C. § 1396w–2 — Authorization to receive relevant information

(a) General rule. Despite other law, a Federal or State agency or private entity holding data sources directly relevant to Medicaid eligibility may send the data to the State agency administering the State plan, if subsection (b) is satisfied. Examples include Express Lane agency eligibility files, information described in section 1320b–7(a)(2) or (3), State birth records, and information described in sections 653(i) and 1396a(a)(25)(I). (b) Conditions. Data may be sent only if (1) the person whose circumstances the data describe, or that person’s parent, guardian, caretaker relative, or authorized representative, consented in advance or did not object after advance notice and a reasonable chance to object; (2) the data are used only to (A) identify people eligible or potentially eligible for Medicaid and enroll or try to enroll them, or (B) verify Medicaid eligibility; and (3) an agreement consistent with Secretary standards (A) prevents unauthorized use, disclosure, or alteration and meets Federal privacy and data-security requirements, and (B) requires the State agency to use the data to seek to enroll people. (c) Improper-disclosure penalties. (1) A private entity covered by (a) that publishes, discloses, or otherwise makes available information obtained under this section without Federal-law authorization is subject to a $10,000 civil penalty for each unauthorized publication or disclosure. The provisions of section 1320a–7a, except subsections (a) and (b) and the second sentence of subsection (f), apply as they apply to a penalty or proceeding under section 1320a–7a(a). (2) A private entity that willfully makes such an unauthorized publication or disclosure may be fined up to $10,000, imprisoned up to one year, or both, for each one. (d) Construction. These disclosure limits do not prohibit conveying or disclosing data otherwise allowed by Federal law without regard to this section.