U.S. Code > Title 42 The Public Health and Welfare > CHAPTER 7—SOCIAL SECURITY > SUBCHAPTER XIX—GRANTS TO STATES FOR MEDICAL ASSISTANCE PROGRAMS > § 1396w-2. Authorization to receive relevant information

§ 1396w-2. Authorization to receive relevant information

(a) In general
Notwithstanding any other provision of law, a Federal or State agency or private entity in possession of the sources of data directly relevant to eligibility determinations under this subchapter (including eligibility files maintained by Express Lane agencies described in section 1396a (e)(13)(F) of this title, information described in paragraph (2) or (3) of section 1320b–7 (a) of this title, vital records information about births in any State, and information described in sections 653 (i) and 1396a (a)(25)(I) of this title) is authorized to convey such data or information to the State agency administering the State plan under this subchapter, to the extent such conveyance meets the requirements of subsection (b).
(b) Requirements for conveyance
Data or information may be conveyed pursuant to subsection (a) only if the following requirements are met:
(1) The individual whose circumstances are described in the data or information (or such individual’s parent, guardian, caretaker relative, or authorized representative) has either provided advance consent to disclosure or has not objected to disclosure after receiving advance notice of disclosure and a reasonable opportunity to object.
(2) Such data or information are used solely for the purposes of—
(A) identifying individuals who are eligible or potentially eligible for medical assistance under this subchapter and enrolling or attempting to enroll such individuals in the State plan; and
(B) verifying the eligibility of individuals for medical assistance under the State plan.
(3) An interagency or other agreement, consistent with standards developed by the Secretary—
(A) prevents the unauthorized use, disclosure, or modification of such data and otherwise meets applicable Federal requirements safeguarding privacy and data security; and
(B) requires the State agency administering the State plan to use the data and information obtained under this section to seek to enroll individuals in the plan.
(c) Penalties for improper disclosure
(1) Civil money penalty
A private entity described in the [1] subsection (a) that publishes, discloses, or makes known in any manner, or to any extent not authorized by Federal law, any information obtained under this section is subject to a civil money penalty in an amount equal to $10,000 for each such unauthorized publication or disclosure. The provisions of section 1320a–7a of this title (other than subsections (a) and (b) and the second sentence of subsection (f)) shall apply to a civil money penalty under this paragraph in the same manner as such provisions apply to a penalty or proceeding under section 1320a–7a (a) of this title.
(2) Criminal penalty
A private entity described in the [1] subsection (a) that willfully publishes, discloses, or makes known in any manner, or to any extent not authorized by Federal law, any information obtained under this section shall be fined not more than $10,000 or imprisoned not more than 1 year, or both, for each such unauthorized publication or disclosure.
(d) Rule of construction
The limitations and requirements that apply to disclosure pursuant to this section shall not be construed to prohibit the conveyance or disclosure of data or information otherwise permitted under Federal law (without regard to this section).

[1] So in original.