Privacy Act of 1974; Report of a New System of Records, 60713-60717 [E6-17052]
Download as PDF
Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
1402, fax: (301) 427–1341, e-mail:
anna.caponiti@ahrq.hhs.gov.
To facilitate handling of submissions,
please include full information about
the instrument developer or contact; (a)
Name, (b) title, (c) organization, (d)
mailing address, (e) telephone number,
(f) fax number, and (g) e-mail address.
Also, please submit a copy of the
instrument or items for consideration as
well as evidence that they meet the
criteria below. It would be appreciated
if each citation of a peer-reviewed
journal article pertaining to the
instrument include the title of the
article, author(s), publication year,
journal name, volume, issue, and page
numbers where article appears, but all
of these details are not required.
Submitters must also provide a
statement of willingness to grant to
AHRQ the right to use and authorize
others to use submitted measures and
their documentation as part of a
CAHPS-trademarked instrument. This
CAHPS instrument for patients’
perspectives on the quality of health
information will be made publicly
available, free of charge. Electronic
submissions are encouraged.
FOR FURTHER INFORMATION CONTACT:
Anna Caponiti, at the address above.
SUPPLEMENTARY INFORMATION:
jlentini on PROD1PC65 with NOTICES
Background Information
The CAHPS program was initiated in
1995 to develop a survey and report on
consumers’ perspectives on the quality
of their health plans. Since that time,
the CAHPS program, in partnership
with the Centers for Medicare and
Medicaid Services (CMS) and others,
has expanded its scope and developed
consumer surveys and reports regarding
consumer perspectives on individual
clinicians, group practices, in-center
hemodialysis services, nursing homes
and hospitals. AHRQ determined that
the CAHPS teams should develop a
survey to obtain the consumers’
perspective on the quality of health
information.
The vision of the Agency for
Healthcare Research and Quality is to
foster health care research that helps the
American health care system provide
access to high-quality, cost-effective
services; be accountable and responsive
to consumers and purchasers; and
improve health status and quality of life.
The CAHPS program was developed as
a result of AHRQ’s vision. One of the
components not examined in the
current measurement set is an
assessment of patients’ perspectives on
how well health plans, hospitals,
clinicians, and group practices address
health literacy issues.
VerDate Aug<31>2005
16:16 Oct 13, 2006
Jkt 211001
Submission Criteria
Instruments submitted should focus
on patient perspectives on quality of
health information provided by plans,
hospitals, clinicians, and/or group
practices.
AHRQ is interested in measures that:
(a) Assess patients’ and their caregivers’
experiences receiving health
information and (b) demonstrate a high
degree of reliability and validity.
Accordingly, each submission should
include, in addition to the name of the
pertinent instrument, domains
included, and the language(s) the
instrument is available in, the following
information: Evidence of cultural/cross
group comparability, if any; instrument
reliability (internal consistency, testretest, etc.); validity (content, construct,
criterion-related); response rates;
methods and results of cognitive testing
and field-testing and description of
sampling strategies (including payer
type); as well as data collection
protocols, including such elements as
mode of administration, use of advance
letters, timing and frequencies of
contacts. Evidence addressing these
criteria should be demonstrated through
submission of peer-reviewed journal
article(s) or through the best evidence
available at the time of submission.
In addition, a list of where the
instrument has been fielded should also
be included in the submission.
Submission of copies of existing report
formats developed to disclose findings
to consumers and providers is desirable,
but not required. Additionally,
information about existing database(s)
for the instrument(s) submitted is
helpful, but not required for submission.
Submitters’ willingness to grant to
AHRQ the right to use and authorize
others to use their instrument or item
and accompanying explanatory material
means that the CAHPS trademark will
be applied to a new instrument which
will combine the best features of the
submissions as well as any ideas that
may develop from reviewing them, and
also free access to this instrument, and
free access to the instrument’s
supportive/administrative information
will be ensured. AHRQ, in collaboration
with CAHPS grantees, will evaluate all
submitted instruments or items. As they
construct the CAHPS instrument, they
may select one or more either in whole
or in part or modify the items prior to
testing them. AHRQ will assume
responsibility for the final instruments
as well as any future modifications.
The final instruments will bear the
CAHPS trademark and it will be made
available without charge for use by all
interested parties. Submitters will have
PO 00000
Frm 00028
Fmt 4703
Sfmt 4703
60713
relinquished ownership of any items
that appear in the final instrument.
However, item ownership will be
protected during testing of the survey.
As a matter of quality control, there will
be warnings that the CAHPS trademark
or identification may not be used if any
changes are made to the instrument or
final measure set without review and
permission of the agency.
Dated: October 5, 2006.
Carolyn M. Clancy,
Director.
[FR Doc. 06–8673 Filed 10–13–06; 8:45 am]
BILLING CODE 4160–90–M
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Medicare & Medicaid
Services
Privacy Act of 1974; Report of a New
System of Records
Centers for Medicare &
Medicaid Services (CMS), Department
of Health and Human Services (HHS).
ACTION: Notice of a New System of
Records (SOR).
AGENCY:
SUMMARY: In accordance with the
requirements of the Privacy Act of 1974,
we are proposing to establish a new
system titled, ‘‘Competitive Bidding for
Clinical Laboratory Services (CBCLS),
System No. 09–70–0589.’’ The
demonstration project is mandated by
section 302(b) of the Medicare
Prescription Drug Improvement, and
Modernization Act of 2003 (MMA)
(Public Law (Pub. L.) 108–173), which
was enacted into law on December 8,
2003, and amended Title XVIII of the
Social Security Act (the Act). The
CBCLS demonstration and evaluation
seek to determine whether competitive
bidding can be used to provide quality
laboratory services at prices below
current Medicare reimbursement rates.
Independent, hospital, and physician
office laboratories providing non-patient
Medicare Part B laboratory services will
be required to participate in the
demonstration.
The purpose of this system is to
collect and maintain demographic and
health related data on the target
population of Medicare beneficiaries
who reside in the demonstration area
and providers and/or suppliers that are
potential participants in the
demonstration who provide Medicare
Part B clinical laboratory services to
such beneficiaries. Information retrieved
from this system may be disclosed to:
(1) Support regulatory, reimbursement,
and policy functions performed within
E:\FR\FM\16OCN1.SGM
16OCN1
jlentini on PROD1PC65 with NOTICES
60714
Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
the agency or by a contractor, grantee,
or consultant; (2) assist another Federal
or state agency with information to
contribute to the accuracy of CMS’s
proper payment of Medicare benefits,
enable such agency to administer a
Federal health benefits program, or to
enable such agency to fulfill a
requirement of Federal statute or
regulation that implements a health
benefits program funded in whole or in
part with Federal funds; (3) support an
individual or organization for a research
project or in support of an evaluation
project related to the prevention of
disease or disability, the restoration or
maintenance of health, or payment
related projects; (4) support litigation
involving the agency; and (5) combat
fraud, waste, and abuse in certain
Federally-funded health benefits
programs. We have provided
background information about the new
system in the SUPPLEMENTARY
INFORMATION section below. Although
the Privacy Act requires only that CMS
provide an opportunity for interested
persons to comment on the proposed
routine uses, CMS invites comments on
all portions of this notice. See EFFECTIVE
DATES section for comment period.
DATES: Effective Date: CMS filed a new
SOR report with the Chair of the House
Committee on Government Reform and
Oversight, the Chair of the Senate
Committee on Homeland Security &
Governmental Affairs, and the
Administrator, Office of Information
and Regulatory Affairs, Office of
Management and Budget (OMB) on
October 6, 2006. To ensure that all
parties have adequate time in which to
comment, the new system will become
effective 30 days from the publication of
the notice, or 40 days from the date it
was submitted to OMB and the
Congress, whichever is later. We may
defer implementation of this system or
one or more of the routine use
statements listed below if we receive
comments that persuade us to defer
implementation.
ADDRESSES: The public should address
comments to the CMS Privacy Officer,
Division of Privacy Compliance,
Enterprise Architecture and Strategy
Group, Mail-stop N2–04–27, 7500
Security Boulevard, Baltimore,
Maryland 21244–1850. Comments
received will be available for review at
this location by appointment during
regular business hours, Monday through
Friday from 9 a.m.–3 p.m., eastern time.
FOR FURTHER INFORMATION CONTACT:
Linda Lebovic, Division Payment Policy
Demonstrations, Medicare
Demonstrations Program Group, Office
of Research, Development &
VerDate Aug<31>2005
16:16 Oct 13, 2006
Jkt 211001
Information, Mail Stop C4–17–27,
Centers for Medicare & Medicaid
Services, 7500 Security Boulevard,
Baltimore, MD 21244–1849. She can be
reached by telephone at 410–786–3402,
or via e-mail at
Linda.Lebovic@cms.hhs.gov.
SUPPLEMENTARY INFORMATION: The
demonstration is mandated by section
302(b) of the MMA (Pub. L. 108–173),
which was enacted into law on
December 8, 2003, and amended Title
XVIII of the Act. The CBCLS
demonstration and evaluation seek to
determine whether competitive bidding
can be used to provide quality
laboratory services at prices below
current Medicare reimbursement rates.
Independent, hospital, and physician
office laboratories providing Medicare
Part B clinical laboratory services to
non-patient beneficiaries will be
required to participate.
The demonstration and its evaluation
include all clinical laboratory services
paid under the Clinical Laboratory Fee
Schedule (except pap smears and
colorectal cancer screening tests) for
Medicare Part B fee-for-service
beneficiaries who live in the
demonstration area. The payment basis
determined for each competitive
acquisition area will be substituted for
payment under the existing Clinical
Laboratory Fee Schedule. The MMA
requires laboratories to comply with the
regulations under the Clinical
Laboratory Improvement Amendments
as mandated under section 353 of the
Public Health Service Act. Beneficiary
access to laboratory services and
laboratory quality will be monitored
throughout the demonstration.
I. Description of the Proposed System of
Records
A. Statutory and Regulatory Basis for
SOR
The statutory authority for this system
is given under the provisions of section
302(b) of the Medicare Prescription
Drug Improvement, and Modernization
Act of 2003 (Pub. L. 108–173).
B. Collection and Maintenance of Data
in the System
This system will collect and maintain
individually identifiable and other data
collected on Medicare beneficiaries who
reside in the demonstration area and
providers and/or suppliers that are
potential participants in the
demonstration who provide Medicare
Part B clinical laboratory services to
such beneficiaries. Data will be
collected from Medicare administrative
and claims records, patient medical
charts, and physician records. The
PO 00000
Frm 00029
Fmt 4703
Sfmt 4703
collected information will include, but
is not limited to: Medicare claims and
eligibility data, name, address,
telephone number, health insurance
claims number, race/ethnicity, gender,
date of birth, provider name, unique
provider identification number, medical
record number, as well as clinical,
demographic, background information
relating to Medicare issues, and research
information needed to evaluate the
program and develop research reports
on findings.
II. Agency Policies, Procedures, and
Restrictions on the Routine Use
A. The Privacy Act permits us to
disclose information without an
individual’s consent if the information
is to be used for a purpose that is
compatible with the purpose(s) for
which the information was collected.
Any such disclosure of data is known as
a ‘‘routine use.’’ The Government will
only release CBCLS information that can
be associated with an individual as
provided for under ‘‘Section III.
Proposed Routine Use Disclosures of
Data in the System.’’ Both identifiable
and non-identifiable data may be
disclosed under a routine use. We will
only collect the minimum personal data
necessary to achieve the purpose of
CBCLS.
CMS has the following policies and
procedures concerning disclosures of
information that will be maintained in
the system. Disclosure of information
from the system will be approved only
to the extent necessary to accomplish
the purpose of the disclosure and only
after CMS:
1. Determines that the use or
disclosure is consistent with the reason
that the data is being collected; e.g., to
collect and maintain demographic and
health related data on the target
population of Medicare beneficiaries
who are potential participants in the
CBCLS program. We will also collect
certain identifying information on
Medicare providers who provide
services to such beneficiaries.
2. Determines that:
a. The purpose for which the
disclosure is to be made can only be
accomplished if the record is provided
in individually identifiable form;
b. The purpose for which the
disclosure is to be made is of sufficient
importance to warrant the effect and/or
risk on the privacy of the individual that
additional exposure of the record might
bring; and
c. There is a strong probability that
the proposed use of the data would in
fact accomplish the stated purpose(s).
3. Requires the information recipient
to:
E:\FR\FM\16OCN1.SGM
16OCN1
Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
a. Establish administrative, technical,
and physical safeguards to prevent
unauthorized use of disclosure of the
record;
b. Remove or destroy, at the earliest
time, all patient-identifiable
information; and
c. Agree to not use or disclose the
information for any purpose other than
the stated purpose under which the
information was disclosed.
4. Determines that the data are valid
and reliable.
jlentini on PROD1PC65 with NOTICES
III. Proposed Routine Use Disclosures
of Data in the System
A. The Privacy Act allows us to
disclose information without an
individual’s consent if the information
is to be used for a purpose that is
compatible with the purpose(s) for
which the information was collected.
Any such compatible use of data is
known as a ‘‘routine use.’’ The proposed
routine uses in this system meet the
compatibility requirement of the Privacy
Act. We are proposing to establish the
following routine use disclosures of
information maintained in the system:
1. To agency contractors, consultants
or grantees, who have been engaged by
the agency to assist in the performance
of a service related to this collection and
who need to have access to the records
in order to perform the activity.
We contemplate disclosing
information under this routine use only
in situations in which CMS may enter
into a contractual or similar agreement
with a third party to assist in
accomplishing CMS function relating to
purposes for this system.
CMS occasionally contracts out
certain of its functions when doing so
would contribute to effective and
efficient operations. CMS must be able
to give a contractor, consultant or
grantee whatever information is
necessary for the contractor, consultant,
or grantee to fulfill its duties. In these
situations, safeguards are provided in
the contract prohibiting the contractor,
consultant or grantee from using or
disclosing the information for any
purpose other than that described in the
contract and requires the contractor,
consultant or grantee to return or
destroy all information at the
completion of the contract.
2. To another Federal or state agency
to:
a. Contribute to the accuracy of CMS’s
proper payment of Medicare benefits;
b. Enable such agency to administer a
Federal health benefits program, or, as
necessary, to enable such agency to
fulfill a requirement of a Federal statute
or regulation that implements a health
VerDate Aug<31>2005
16:16 Oct 13, 2006
Jkt 211001
benefits program funded in whole or in
part with Federal funds; and/or
c. Assist Federal/state Medicaid
programs within the state.
Other Federal or state agencies, in
their administration of a Federal health
program, may require CBCLS
information in order to support
evaluations and monitoring of Medicare
claims information of beneficiaries,
including proper reimbursement for
services provided.
3. To an individual or organization for
a research project or in support of an
evaluation project related to the
prevention of disease or disability, the
restoration or maintenance of health, or
payment related projects.
The CBCLS data will provide for
research or support of evaluation
projects and a broader, longitudinal,
national perspective of the status of
Medicare beneficiaries. CMS anticipates
that many researchers will have
legitimate requests to use these data in
projects that could ultimately improve
the care provided to Medicare
beneficiaries and the policies that
govern their care.
4. To the Department of Justice (DOJ),
court or adjudicatory body when:
a. The agency or any component
thereof, or
b. Any employee of the agency in his
or her official capacity, or
c. Any employee of the agency in his
or her individual capacity where the
DOJ has agreed to represent the
employee, or
d. The United States Government, is
a party to litigation or has an interest in
such litigation, and, by careful review,
CMS determines that the records are
both relevant and necessary to the
litigation and that the use of such
records by the DOJ, court or
adjudicatory body is compatible with
the purpose for which the agency
collected the records.
Whenever CMS is involved in
litigation, and occasionally when
another party is involved in litigation
and CMS policies or operations could be
affected by the outcome of the litigation,
CMS would be able to disclose
information to the DOJ, court or
adjudicatory body involved.
5. To a CMS contractor (including, but
not necessarily limited to, fiscal
intermediaries and carriers) that assists
in the administration of a CMSadministered health benefits program,
or to a grantee of a CMS-administered
grant program, when disclosure is
deemed reasonably necessary by CMS to
prevent, deter, discover, detect,
investigate, examine, prosecute, sue
with respect to, defend against, correct,
PO 00000
Frm 00030
Fmt 4703
Sfmt 4703
60715
remedy, or otherwise combat fraud,
waste, or abuse in such program.
We contemplate disclosing
information under this routine use only
in situations in which CMS may enter
into a contractual, grantee, cooperative
agreement or consultant relationship
with a third party to assist in
accomplishing CMS functions relating
to the purpose of combating fraud,
waste, and abuse. CMS occasionally
contracts out certain of its functions or
makes grants or cooperative agreements
when doing so would contribute to
effective and efficient operations. CMS
must be able to give a contractor,
grantee, consultant or other legal agent
whatever information is necessary for
the agent to fulfill its duties. In these
situations, safeguards are provided in
the contract prohibiting the agent from
using or disclosing the information for
any purpose other than that described in
the contract and requiring the agent to
return or destroy all information.
6. To another Federal agency or to an
instrumentality of any governmental
jurisdiction within or under the control
of the United States (including any State
or local governmental agency), that
administers, or that has the authority to
investigate potential fraud or abuse in,
a health benefits program funded in
whole or in part by Federal funds, when
disclosure is deemed reasonably
necessary by CMS to prevent, deter,
discover, detect, investigate, examine,
prosecute, sue with respect to, defend
against, correct, remedy, or otherwise
combat fraud, waste, or abuse in such
programs.
Other agencies may require CBCLS
information for the purpose of
combating fraud, waste, and abuse in
such Federally-funded programs.
B. Additional Provisions Affecting
Routine Use Disclosures
To the extent this system contains
Protected Health Information (PHI) as
defined by HHS regulation ‘‘Standards
for Privacy of Individually Identifiable
Health Information’’ (45 CFR parts 160
and 164, subparts A and E) 65 FR 82462
(12–28–00). Disclosures of such PHI that
are otherwise authorized by these
routine uses may only be made if, and
as, permitted or required by the
‘‘Standards for Privacy of Individually
Identifiable Health Information.’’ (See
45 CFR 164.512(a)(1)).
In addition, our policy will be to
prohibit release even of data not directly
identifiable, except pursuant to one of
the routine uses or if required by law,
if we determine there is a possibility
that an individual can be identified
through implicit deduction based on
small cell sizes (instances where the
E:\FR\FM\16OCN1.SGM
16OCN1
60716
Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
patient population is so small that an
individual could, because of the small
size, use this information to deduce the
identity of the beneficiary).
jlentini on PROD1PC65 with NOTICES
IV. Safeguards
CMS has safeguards in place for
authorized users and monitors such
users to ensure against excessive or
unauthorized use. Personnel having
access to the system have been trained
in the Privacy Act and information
security requirements. Employees who
maintain records in this system are
instructed not to release data until the
intended recipient agrees to implement
appropriate management, operational
and technical safeguards sufficient to
protect the confidentiality, integrity and
availability of the information and
information systems and to prevent
unauthorized access.
This system will conform to all
applicable Federal laws and regulations
and Federal, HHS, and CMS policies
and standards as they relate to
information security and data privacy.
These laws and regulations may apply
but are not limited to: The Privacy Act
of 1974; the Federal Information
Security Management Act of 2002; the
Computer Fraud and Abuse Act of 1986;
the Health Insurance Portability and
Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare
Prescription Drug Improvement, and
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,
Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS, and CMS
policies and standards include but are
not limited to: all pertinent National
Institute of Standards and Technology
publications; the HHS Information
Systems Program Handbook and the
CMS Information Security Handbook.
V. Effects of the Proposed System of
Records on Individual Rights
CMS proposes to establish this system
in accordance with the principles and
requirements of the Privacy Act and will
collect, use, and disseminate
information only as prescribed therein.
Data in this system will be subject to the
authorized releases in accordance with
the routine uses identified in this
system of records.
CMS will take precautionary
measures to minimize the risks of
unauthorized access to the records and
the potential harm to individual privacy
or other personal or property rights of
patients whose data are maintained in
this system. CMS will collect only that
VerDate Aug<31>2005
16:16 Oct 13, 2006
Jkt 211001
information necessary to perform the
system’s functions. In addition, CMS
will make disclosure from the proposed
system only with consent of the subject
individual, or his/her legal
representative, or in accordance with an
applicable exception provision of the
Privacy Act. CMS, therefore, does not
anticipate an unfavorable effect on
individual privacy as a result of
information relating to individuals.
Dated: October 4, 2006.
Charlene Frizzera,
Acting Chief Operating Officer, Centers for
Medicare & Medicaid Services.
SYSTEM NO. 09–70–0589
SYSTEM NAME
‘‘Competitive Bidding for Clinical
Laboratory Services (CBCLS),’’ HHS/
CMS/ORDI.
SECURITY CLASSIFICATION
Level Three Privacy Act Sensitive
Data.
SYSTEM LOCATION
CMS Data Center, 7500 Security
Boulevard, North Building, First Floor,
Baltimore, Maryland 21244–1850 and at
various co-locations of CMS agents.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM
This system will collect and maintain
individually identifiable and other data
collected on Medicare beneficiaries who
reside in the demonstration area and
providers and/or suppliers that are
potential participants in the
demonstration who provide Medicare
Part B clinical laboratory services to
such beneficiaries.
CATEGORIES OF RECORDS IN THE SYSTEM:
The collected information will
include, but is not limited to: Medicare
claims and eligibility data, name,
address, telephone number, health
insurance claims number (HICN), race/
ethnicity, gender, date of birth, provider
name, unique provider identification
number, medical record number, as well
as clinical, demographic, background
information relating to Medicare issues,
and research information needed to
evaluate the program and develop
research reports on findings.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The statutory authority for this system
is given under the provisions of section
302(b) of the Medicare Prescription
Drug Improvement, and Modernization
Act of 2003 (Pub. L. 108–173).
PURPOSE(S) OF THE SYSTEM:
The purpose of this system is to
collect and maintain demographic and
PO 00000
Frm 00031
Fmt 4703
Sfmt 4703
health related data on the target
population of Medicare beneficiaries
who reside in the demonstration area
and providers and/or suppliers that are
potential participants in the
demonstration who provide Medicare
Part B clinical laboratory services to
such beneficiaries. Information retrieved
from this system may be disclosed to:
(1) Support regulatory, reimbursement,
and policy functions performed within
the agency or by a contractor, grantee,
or consultant; (2) assist another Federal
or state agency with information to
contribute to the accuracy of CMS’s
proper payment of Medicare benefits,
enable such agency to administer a
Federal health benefits program, or to
enable such agency to fulfill a
requirement of Federal statute or
regulation that implements a health
benefits program funded in whole or in
part with Federal funds; (3) support an
individual or organization for a research
project or in support of an evaluation
project related to the prevention of
disease or disability, the restoration or
maintenance of health, or payment
related projects; (4) support litigation
involving the agency; and (5) combat
fraud, waste, and abuse in certain
Federally-funded health benefits
programs.
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OR USERS AND
THE PURPOSES OF SUCH USES:
A. The Privacy Act allows us to
disclose information without an
individual’s consent if the information
is to be used for a purpose that is
compatible with the purpose(s) for
which the information was collected.
Any such compatible use of data is
known as a ‘‘routine use.’’ The proposed
routine uses in this system meet the
compatibility requirement of the Privacy
Act. We are proposing to establish the
following routine use disclosures of
information maintained in the system:
1. To agency contractors, consultants
or grantees, who have been engaged by
the agency to assist in the performance
of a service related to this collection and
who need to have access to the records
in order to perform the activity.
2. To another Federal or state agency
to:
a. Contribute to the accuracy of CMS’s
proper payment of Medicare benefits;
b. Enable such agency to administer a
Federal health benefits program, or, as
necessary, to enable such agency to
fulfill a requirement of a Federal statute
or regulation that implements a health
benefits program funded in whole or in
part with Federal funds; and/or
c. Assist Federal/state Medicaid
programs within the state.
E:\FR\FM\16OCN1.SGM
16OCN1
Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
3. To an individual or organization for
a research project or in support of an
evaluation project related to the
prevention of disease or disability, the
restoration or maintenance of health, or
payment related projects.
4. To the Department of Justice (DOJ),
court or adjudicatory body when:
a. The agency or any component
thereof, or
b. Any employee of the agency in his
or her official capacity, or
c. Any employee of the agency in his
or her individual capacity where the
DOJ has agreed to represent the
employee, or
d. The United States Government, is
a party to litigation or has an interest in
such litigation, and, by careful review,
CMS determines that the records are
both relevant and necessary to the
litigation and that the use of such
records by the DOJ, court or
adjudicatory body is compatible with
the purpose for which the agency
collected the records.
5. To a CMS contractor (including, but
not necessarily limited to, fiscal
intermediaries and carriers) that assists
in the administration of a CMSadministered health benefits program,
or to a grantee of a CMS-administered
grant program, when disclosure is
deemed reasonably necessary by CMS to
prevent, deter, discover, detect,
investigate, examine, prosecute, sue
with respect to, defend against, correct,
remedy, or otherwise combat fraud,
waste, or abuse in such program.
6. To another Federal agency or to an
instrumentality of any governmental
jurisdiction within or under the control
of the United States (including any State
or local governmental agency), that
administers, or that has the authority to
investigate potential fraud or abuse in,
a health benefits program funded in
whole or in part by Federal funds, when
disclosure is deemed reasonably
necessary by CMS to prevent, deter,
discover, detect, investigate, examine,
prosecute, sue with respect to, defend
against, correct, remedy, or otherwise
combat fraud, waste, or abuse in such
programs.
jlentini on PROD1PC65 with NOTICES
B. ADDITIONAL PROVISIONS AFFECTING ROUTINE
USE DISCLOSURES:
To the extent this system contains
Protected Health Information (PHI) as
defined by HHS regulation ‘‘Standards
for Privacy of Individually Identifiable
Health Information’’ (45 CFR parts 160
and 164, subparts A and E) 65 FR 82462
(12–28–00). Disclosures of such PHI that
are otherwise authorized by these
routine uses may only be made if, and
as, permitted or required by the
‘‘Standards for Privacy of Individually
VerDate Aug<31>2005
16:16 Oct 13, 2006
Jkt 211001
Identifiable Health Information.’’ (See
45 CFR 164.512(a) (1)).
In addition, our policy will be to
prohibit release even of data not directly
identifiable, except pursuant to one of
the routine uses or if required by law,
if we determine there is a possibility
that an individual can be identified
through implicit deduction based on
small cell sizes (instances where the
patient population is so small that an
individual could, because of the small
size, use this information to deduce the
identity of the beneficiary).
POLICIES AND PRACTICES FOR STORING,
RETRIEVING, ACCESSING, RETAINING, AND
DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
All records are stored on electronic
media.
The collected data are retrieved by an
individual identifier; e.g., beneficiary
name or HICN.
SAFEGUARDS:
CMS has safeguards in place for
authorized users and monitors such
users to ensure against excessive or
unauthorized use. Personnel having
access to the system have been trained
in the Privacy Act and information
security requirements. Employees who
maintain records in this system are
instructed not to release data until the
intended recipient agrees to implement
appropriate management, operational
and technical safeguards sufficient to
protect the confidentiality, integrity and
availability of the information and
information systems and to prevent
unauthorized access.
This system will conform to all
applicable Federal laws and regulations
and Federal, HHS, and CMS policies
and standards as they relate to
information security and data privacy.
These laws and regulations may apply
but are not limited to: The Privacy Act
of 1974; the Federal Information
Security Management Act of 2002; the
Computer Fraud and Abuse Act of 1986;
the Health Insurance Portability and
Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,
Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS, and CMS
policies and standards include but are
not limited to: All pertinent National
Institute of Standards and Technology
publications; the HHS Information
Frm 00032
Fmt 4703
Systems Program Handbook and the
CMS Information Security Handbook.
RETENTION AND DISPOSAL:
CMS will retain information for a total
period not to exceed 10 years. All
claims-related records are encompassed
by the document preservation order and
will be retained until notification is
received from DOJ.
SYSTEM MANAGER AND ADDRESS:
Division Payment Policy
Demonstrations, Medicare
Demonstrations Program Group, Office
of Research, Development &
Information, Mail Stop C4–17–27,
Centers for Medicare & Medicaid
Services, 7500 Security Boulevard,
Baltimore, MD 21244–1849.
NOTIFICATION PROCEDURE:
RETRIEVABILITY:
PO 00000
60717
Sfmt 4703
For purpose of access, the subject
individual should write to the system
manager who will require the system
name, employee identification number,
tax identification number, national
provider number, and for verification
purposes, the subject individual’s name
(woman’s maiden name, if applicable),
HICN, and/or SSN (furnishing the SSN
is voluntary, but it may make searching
for a record easier and prevent delay).
RECORD ACCESS PROCEDURE:
For purpose of access, use the same
procedures outlined in Notification
Procedures above. Requestors should
also reasonably specify the record
contents being sought. (These
procedures are in accordance with
Department regulation 45 CFR
5b.5(a)(2)).
CONTESTING RECORD PROCEDURES:
The subject individual should contact
the system manager named above, and
reasonably identify the record and
specify the information to be contested.
State the corrective action sought and
the reasons for the correction with
supporting justification. (These
procedures are in accordance with
Department regulation 45 CFR 5b.7).
RECORDS SOURCE CATEGORIES:
Data will be collected from Medicare
administrative and claims records
(Common Working File, Carrier
Medicare Claims Record, Intermediary
Medicare Claims Records), patient
medical charts, and physician records.
SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
OF THE ACT:
None.
[FR Doc. E6–17052 Filed 10–13–06; 8:45 am]
BILLING CODE 4120–03–P
E:\FR\FM\16OCN1.SGM
16OCN1
Agencies
[Federal Register Volume 71, Number 199 (Monday, October 16, 2006)]
[Notices]
[Pages 60713-60717]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E6-17052]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
Privacy Act of 1974; Report of a New System of Records
AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of
Health and Human Services (HHS).
ACTION: Notice of a New System of Records (SOR).
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of
1974, we are proposing to establish a new system titled, ``Competitive
Bidding for Clinical Laboratory Services (CBCLS), System No. 09-70-
0589.'' The demonstration project is mandated by section 302(b) of the
Medicare Prescription Drug Improvement, and Modernization Act of 2003
(MMA) (Public Law (Pub. L.) 108-173), which was enacted into law on
December 8, 2003, and amended Title XVIII of the Social Security Act
(the Act). The CBCLS demonstration and evaluation seek to determine
whether competitive bidding can be used to provide quality laboratory
services at prices below current Medicare reimbursement rates.
Independent, hospital, and physician office laboratories providing non-
patient Medicare Part B laboratory services will be required to
participate in the demonstration.
The purpose of this system is to collect and maintain demographic
and health related data on the target population of Medicare
beneficiaries who reside in the demonstration area and providers and/or
suppliers that are potential participants in the demonstration who
provide Medicare Part B clinical laboratory services to such
beneficiaries. Information retrieved from this system may be disclosed
to: (1) Support regulatory, reimbursement, and policy functions
performed within
[[Page 60714]]
the agency or by a contractor, grantee, or consultant; (2) assist
another Federal or state agency with information to contribute to the
accuracy of CMS's proper payment of Medicare benefits, enable such
agency to administer a Federal health benefits program, or to enable
such agency to fulfill a requirement of Federal statute or regulation
that implements a health benefits program funded in whole or in part
with Federal funds; (3) support an individual or organization for a
research project or in support of an evaluation project related to the
prevention of disease or disability, the restoration or maintenance of
health, or payment related projects; (4) support litigation involving
the agency; and (5) combat fraud, waste, and abuse in certain
Federally-funded health benefits programs. We have provided background
information about the new system in the SUPPLEMENTARY INFORMATION
section below. Although the Privacy Act requires only that CMS provide
an opportunity for interested persons to comment on the proposed
routine uses, CMS invites comments on all portions of this notice. See
EFFECTIVE DATES section for comment period.
DATES: Effective Date: CMS filed a new SOR report with the Chair of the
House Committee on Government Reform and Oversight, the Chair of the
Senate Committee on Homeland Security & Governmental Affairs, and the
Administrator, Office of Information and Regulatory Affairs, Office of
Management and Budget (OMB) on October 6, 2006. To ensure that all
parties have adequate time in which to comment, the new system will
become effective 30 days from the publication of the notice, or 40 days
from the date it was submitted to OMB and the Congress, whichever is
later. We may defer implementation of this system or one or more of the
routine use statements listed below if we receive comments that
persuade us to defer implementation.
ADDRESSES: The public should address comments to the CMS Privacy
Officer, Division of Privacy Compliance, Enterprise Architecture and
Strategy Group, Mail-stop N2-04-27, 7500 Security Boulevard, Baltimore,
Maryland 21244-1850. Comments received will be available for review at
this location by appointment during regular business hours, Monday
through Friday from 9 a.m.-3 p.m., eastern time.
FOR FURTHER INFORMATION CONTACT: Linda Lebovic, Division Payment Policy
Demonstrations, Medicare Demonstrations Program Group, Office of
Research, Development & Information, Mail Stop C4-17-27, Centers for
Medicare & Medicaid Services, 7500 Security Boulevard, Baltimore, MD
21244-1849. She can be reached by telephone at 410-786-3402, or via e-
mail at Linda.Lebovic@cms.hhs.gov.
SUPPLEMENTARY INFORMATION: The demonstration is mandated by section
302(b) of the MMA (Pub. L. 108-173), which was enacted into law on
December 8, 2003, and amended Title XVIII of the Act. The CBCLS
demonstration and evaluation seek to determine whether competitive
bidding can be used to provide quality laboratory services at prices
below current Medicare reimbursement rates. Independent, hospital, and
physician office laboratories providing Medicare Part B clinical
laboratory services to non-patient beneficiaries will be required to
participate.
The demonstration and its evaluation include all clinical
laboratory services paid under the Clinical Laboratory Fee Schedule
(except pap smears and colorectal cancer screening tests) for Medicare
Part B fee-for-service beneficiaries who live in the demonstration
area. The payment basis determined for each competitive acquisition
area will be substituted for payment under the existing Clinical
Laboratory Fee Schedule. The MMA requires laboratories to comply with
the regulations under the Clinical Laboratory Improvement Amendments as
mandated under section 353 of the Public Health Service Act.
Beneficiary access to laboratory services and laboratory quality will
be monitored throughout the demonstration.
I. Description of the Proposed System of Records
A. Statutory and Regulatory Basis for SOR
The statutory authority for this system is given under the
provisions of section 302(b) of the Medicare Prescription Drug
Improvement, and Modernization Act of 2003 (Pub. L. 108-173).
B. Collection and Maintenance of Data in the System
This system will collect and maintain individually identifiable and
other data collected on Medicare beneficiaries who reside in the
demonstration area and providers and/or suppliers that are potential
participants in the demonstration who provide Medicare Part B clinical
laboratory services to such beneficiaries. Data will be collected from
Medicare administrative and claims records, patient medical charts, and
physician records. The collected information will include, but is not
limited to: Medicare claims and eligibility data, name, address,
telephone number, health insurance claims number, race/ethnicity,
gender, date of birth, provider name, unique provider identification
number, medical record number, as well as clinical, demographic,
background information relating to Medicare issues, and research
information needed to evaluate the program and develop research reports
on findings.
II. Agency Policies, Procedures, and Restrictions on the Routine Use
A. The Privacy Act permits us to disclose information without an
individual's consent if the information is to be used for a purpose
that is compatible with the purpose(s) for which the information was
collected. Any such disclosure of data is known as a ``routine use.''
The Government will only release CBCLS information that can be
associated with an individual as provided for under ``Section III.
Proposed Routine Use Disclosures of Data in the System.'' Both
identifiable and non-identifiable data may be disclosed under a routine
use. We will only collect the minimum personal data necessary to
achieve the purpose of CBCLS.
CMS has the following policies and procedures concerning
disclosures of information that will be maintained in the system.
Disclosure of information from the system will be approved only to the
extent necessary to accomplish the purpose of the disclosure and only
after CMS:
1. Determines that the use or disclosure is consistent with the
reason that the data is being collected; e.g., to collect and maintain
demographic and health related data on the target population of
Medicare beneficiaries who are potential participants in the CBCLS
program. We will also collect certain identifying information on
Medicare providers who provide services to such beneficiaries.
2. Determines that:
a. The purpose for which the disclosure is to be made can only be
accomplished if the record is provided in individually identifiable
form;
b. The purpose for which the disclosure is to be made is of
sufficient importance to warrant the effect and/or risk on the privacy
of the individual that additional exposure of the record might bring;
and
c. There is a strong probability that the proposed use of the data
would in fact accomplish the stated purpose(s).
3. Requires the information recipient to:
[[Page 60715]]
a. Establish administrative, technical, and physical safeguards to
prevent unauthorized use of disclosure of the record;
b. Remove or destroy, at the earliest time, all patient-
identifiable information; and
c. Agree to not use or disclose the information for any purpose
other than the stated purpose under which the information was
disclosed.
4. Determines that the data are valid and reliable.
III. Proposed Routine Use Disclosures of Data in the System
A. The Privacy Act allows us to disclose information without an
individual's consent if the information is to be used for a purpose
that is compatible with the purpose(s) for which the information was
collected. Any such compatible use of data is known as a ``routine
use.'' The proposed routine uses in this system meet the compatibility
requirement of the Privacy Act. We are proposing to establish the
following routine use disclosures of information maintained in the
system:
1. To agency contractors, consultants or grantees, who have been
engaged by the agency to assist in the performance of a service related
to this collection and who need to have access to the records in order
to perform the activity.
We contemplate disclosing information under this routine use only
in situations in which CMS may enter into a contractual or similar
agreement with a third party to assist in accomplishing CMS function
relating to purposes for this system.
CMS occasionally contracts out certain of its functions when doing
so would contribute to effective and efficient operations. CMS must be
able to give a contractor, consultant or grantee whatever information
is necessary for the contractor, consultant, or grantee to fulfill its
duties. In these situations, safeguards are provided in the contract
prohibiting the contractor, consultant or grantee from using or
disclosing the information for any purpose other than that described in
the contract and requires the contractor, consultant or grantee to
return or destroy all information at the completion of the contract.
2. To another Federal or state agency to:
a. Contribute to the accuracy of CMS's proper payment of Medicare
benefits;
b. Enable such agency to administer a Federal health benefits
program, or, as necessary, to enable such agency to fulfill a
requirement of a Federal statute or regulation that implements a health
benefits program funded in whole or in part with Federal funds; and/or
c. Assist Federal/state Medicaid programs within the state.
Other Federal or state agencies, in their administration of a
Federal health program, may require CBCLS information in order to
support evaluations and monitoring of Medicare claims information of
beneficiaries, including proper reimbursement for services provided.
3. To an individual or organization for a research project or in
support of an evaluation project related to the prevention of disease
or disability, the restoration or maintenance of health, or payment
related projects.
The CBCLS data will provide for research or support of evaluation
projects and a broader, longitudinal, national perspective of the
status of Medicare beneficiaries. CMS anticipates that many researchers
will have legitimate requests to use these data in projects that could
ultimately improve the care provided to Medicare beneficiaries and the
policies that govern their care.
4. To the Department of Justice (DOJ), court or adjudicatory body
when:
a. The agency or any component thereof, or
b. Any employee of the agency in his or her official capacity, or
c. Any employee of the agency in his or her individual capacity
where the DOJ has agreed to represent the employee, or
d. The United States Government, is a party to litigation or has an
interest in such litigation, and, by careful review, CMS determines
that the records are both relevant and necessary to the litigation and
that the use of such records by the DOJ, court or adjudicatory body is
compatible with the purpose for which the agency collected the records.
Whenever CMS is involved in litigation, and occasionally when
another party is involved in litigation and CMS policies or operations
could be affected by the outcome of the litigation, CMS would be able
to disclose information to the DOJ, court or adjudicatory body
involved.
5. To a CMS contractor (including, but not necessarily limited to,
fiscal intermediaries and carriers) that assists in the administration
of a CMS-administered health benefits program, or to a grantee of a
CMS-administered grant program, when disclosure is deemed reasonably
necessary by CMS to prevent, deter, discover, detect, investigate,
examine, prosecute, sue with respect to, defend against, correct,
remedy, or otherwise combat fraud, waste, or abuse in such program.
We contemplate disclosing information under this routine use only
in situations in which CMS may enter into a contractual, grantee,
cooperative agreement or consultant relationship with a third party to
assist in accomplishing CMS functions relating to the purpose of
combating fraud, waste, and abuse. CMS occasionally contracts out
certain of its functions or makes grants or cooperative agreements when
doing so would contribute to effective and efficient operations. CMS
must be able to give a contractor, grantee, consultant or other legal
agent whatever information is necessary for the agent to fulfill its
duties. In these situations, safeguards are provided in the contract
prohibiting the agent from using or disclosing the information for any
purpose other than that described in the contract and requiring the
agent to return or destroy all information.
6. To another Federal agency or to an instrumentality of any
governmental jurisdiction within or under the control of the United
States (including any State or local governmental agency), that
administers, or that has the authority to investigate potential fraud
or abuse in, a health benefits program funded in whole or in part by
Federal funds, when disclosure is deemed reasonably necessary by CMS to
prevent, deter, discover, detect, investigate, examine, prosecute, sue
with respect to, defend against, correct, remedy, or otherwise combat
fraud, waste, or abuse in such programs.
Other agencies may require CBCLS information for the purpose of
combating fraud, waste, and abuse in such Federally-funded programs.
B. Additional Provisions Affecting Routine Use Disclosures
To the extent this system contains Protected Health Information
(PHI) as defined by HHS regulation ``Standards for Privacy of
Individually Identifiable Health Information'' (45 CFR parts 160 and
164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI
that are otherwise authorized by these routine uses may only be made
if, and as, permitted or required by the ``Standards for Privacy of
Individually Identifiable Health Information.'' (See 45 CFR
164.512(a)(1)).
In addition, our policy will be to prohibit release even of data
not directly identifiable, except pursuant to one of the routine uses
or if required by law, if we determine there is a possibility that an
individual can be identified through implicit deduction based on small
cell sizes (instances where the
[[Page 60716]]
patient population is so small that an individual could, because of the
small size, use this information to deduce the identity of the
beneficiary).
IV. Safeguards
CMS has safeguards in place for authorized users and monitors such
users to ensure against excessive or unauthorized use. Personnel having
access to the system have been trained in the Privacy Act and
information security requirements. Employees who maintain records in
this system are instructed not to release data until the intended
recipient agrees to implement appropriate management, operational and
technical safeguards sufficient to protect the confidentiality,
integrity and availability of the information and information systems
and to prevent unauthorized access.
This system will conform to all applicable Federal laws and
regulations and Federal, HHS, and CMS policies and standards as they
relate to information security and data privacy. These laws and
regulations may apply but are not limited to: The Privacy Act of 1974;
the Federal Information Security Management Act of 2002; the Computer
Fraud and Abuse Act of 1986; the Health Insurance Portability and
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Prescription Drug Improvement, and
Modernization Act of 2003, and the corresponding implementing
regulations. OMB Circular A-130, Management of Federal Resources,
Appendix III, Security of Federal Automated Information Resources also
applies. Federal, HHS, and CMS policies and standards include but are
not limited to: all pertinent National Institute of Standards and
Technology publications; the HHS Information Systems Program Handbook
and the CMS Information Security Handbook.
V. Effects of the Proposed System of Records on Individual Rights
CMS proposes to establish this system in accordance with the
principles and requirements of the Privacy Act and will collect, use,
and disseminate information only as prescribed therein. Data in this
system will be subject to the authorized releases in accordance with
the routine uses identified in this system of records.
CMS will take precautionary measures to minimize the risks of
unauthorized access to the records and the potential harm to individual
privacy or other personal or property rights of patients whose data are
maintained in this system. CMS will collect only that information
necessary to perform the system's functions. In addition, CMS will make
disclosure from the proposed system only with consent of the subject
individual, or his/her legal representative, or in accordance with an
applicable exception provision of the Privacy Act. CMS, therefore, does
not anticipate an unfavorable effect on individual privacy as a result
of information relating to individuals.
Dated: October 4, 2006.
Charlene Frizzera,
Acting Chief Operating Officer, Centers for Medicare & Medicaid
Services.
SYSTEM NO. 09-70-0589
System Name
``Competitive Bidding for Clinical Laboratory Services (CBCLS),''
HHS/CMS/ORDI.
Security Classification
Level Three Privacy Act Sensitive Data.
System Location
CMS Data Center, 7500 Security Boulevard, North Building, First
Floor, Baltimore, Maryland 21244-1850 and at various co-locations of
CMS agents.
Categories of Individuals Covered by the System
This system will collect and maintain individually identifiable and
other data collected on Medicare beneficiaries who reside in the
demonstration area and providers and/or suppliers that are potential
participants in the demonstration who provide Medicare Part B clinical
laboratory services to such beneficiaries.
Categories of Records in the System:
The collected information will include, but is not limited to:
Medicare claims and eligibility data, name, address, telephone number,
health insurance claims number (HICN), race/ethnicity, gender, date of
birth, provider name, unique provider identification number, medical
record number, as well as clinical, demographic, background information
relating to Medicare issues, and research information needed to
evaluate the program and develop research reports on findings.
Authority for Maintenance of the System:
The statutory authority for this system is given under the
provisions of section 302(b) of the Medicare Prescription Drug
Improvement, and Modernization Act of 2003 (Pub. L. 108-173).
Purpose(s) of the System:
The purpose of this system is to collect and maintain demographic
and health related data on the target population of Medicare
beneficiaries who reside in the demonstration area and providers and/or
suppliers that are potential participants in the demonstration who
provide Medicare Part B clinical laboratory services to such
beneficiaries. Information retrieved from this system may be disclosed
to: (1) Support regulatory, reimbursement, and policy functions
performed within the agency or by a contractor, grantee, or consultant;
(2) assist another Federal or state agency with information to
contribute to the accuracy of CMS's proper payment of Medicare
benefits, enable such agency to administer a Federal health benefits
program, or to enable such agency to fulfill a requirement of Federal
statute or regulation that implements a health benefits program funded
in whole or in part with Federal funds; (3) support an individual or
organization for a research project or in support of an evaluation
project related to the prevention of disease or disability, the
restoration or maintenance of health, or payment related projects; (4)
support litigation involving the agency; and (5) combat fraud, waste,
and abuse in certain Federally-funded health benefits programs.
Routine Uses of Records Maintained in the System, Including Categories
or Users and the Purposes of Such Uses:
A. The Privacy Act allows us to disclose information without an
individual's consent if the information is to be used for a purpose
that is compatible with the purpose(s) for which the information was
collected. Any such compatible use of data is known as a ``routine
use.'' The proposed routine uses in this system meet the compatibility
requirement of the Privacy Act. We are proposing to establish the
following routine use disclosures of information maintained in the
system:
1. To agency contractors, consultants or grantees, who have been
engaged by the agency to assist in the performance of a service related
to this collection and who need to have access to the records in order
to perform the activity.
2. To another Federal or state agency to:
a. Contribute to the accuracy of CMS's proper payment of Medicare
benefits;
b. Enable such agency to administer a Federal health benefits
program, or, as necessary, to enable such agency to fulfill a
requirement of a Federal statute or regulation that implements a health
benefits program funded in whole or in part with Federal funds; and/or
c. Assist Federal/state Medicaid programs within the state.
[[Page 60717]]
3. To an individual or organization for a research project or in
support of an evaluation project related to the prevention of disease
or disability, the restoration or maintenance of health, or payment
related projects.
4. To the Department of Justice (DOJ), court or adjudicatory body
when:
a. The agency or any component thereof, or
b. Any employee of the agency in his or her official capacity, or
c. Any employee of the agency in his or her individual capacity
where the DOJ has agreed to represent the employee, or
d. The United States Government, is a party to litigation or has an
interest in such litigation, and, by careful review, CMS determines
that the records are both relevant and necessary to the litigation and
that the use of such records by the DOJ, court or adjudicatory body is
compatible with the purpose for which the agency collected the records.
5. To a CMS contractor (including, but not necessarily limited to,
fiscal intermediaries and carriers) that assists in the administration
of a CMS-administered health benefits program, or to a grantee of a
CMS-administered grant program, when disclosure is deemed reasonably
necessary by CMS to prevent, deter, discover, detect, investigate,
examine, prosecute, sue with respect to, defend against, correct,
remedy, or otherwise combat fraud, waste, or abuse in such program.
6. To another Federal agency or to an instrumentality of any
governmental jurisdiction within or under the control of the United
States (including any State or local governmental agency), that
administers, or that has the authority to investigate potential fraud
or abuse in, a health benefits program funded in whole or in part by
Federal funds, when disclosure is deemed reasonably necessary by CMS to
prevent, deter, discover, detect, investigate, examine, prosecute, sue
with respect to, defend against, correct, remedy, or otherwise combat
fraud, waste, or abuse in such programs.
B. Additional Provisions Affecting Routine Use Disclosures:
To the extent this system contains Protected Health Information
(PHI) as defined by HHS regulation ``Standards for Privacy of
Individually Identifiable Health Information'' (45 CFR parts 160 and
164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI
that are otherwise authorized by these routine uses may only be made
if, and as, permitted or required by the ``Standards for Privacy of
Individually Identifiable Health Information.'' (See 45 CFR 164.512(a)
(1)).
In addition, our policy will be to prohibit release even of data
not directly identifiable, except pursuant to one of the routine uses
or if required by law, if we determine there is a possibility that an
individual can be identified through implicit deduction based on small
cell sizes (instances where the patient population is so small that an
individual could, because of the small size, use this information to
deduce the identity of the beneficiary).
Policies and Practices for Storing, Retrieving, Accessing, Retaining,
and Disposing of Records in the System:
Storage:
All records are stored on electronic media.
Retrievability:
The collected data are retrieved by an individual identifier; e.g.,
beneficiary name or HICN.
Safeguards:
CMS has safeguards in place for authorized users and monitors such
users to ensure against excessive or unauthorized use. Personnel having
access to the system have been trained in the Privacy Act and
information security requirements. Employees who maintain records in
this system are instructed not to release data until the intended
recipient agrees to implement appropriate management, operational and
technical safeguards sufficient to protect the confidentiality,
integrity and availability of the information and information systems
and to prevent unauthorized access.
This system will conform to all applicable Federal laws and
regulations and Federal, HHS, and CMS policies and standards as they
relate to information security and data privacy. These laws and
regulations may apply but are not limited to: The Privacy Act of 1974;
the Federal Information Security Management Act of 2002; the Computer
Fraud and Abuse Act of 1986; the Health Insurance Portability and
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the
corresponding implementing regulations. OMB Circular A-130, Management
of Federal Resources, Appendix III, Security of Federal Automated
Information Resources also applies. Federal, HHS, and CMS policies and
standards include but are not limited to: All pertinent National
Institute of Standards and Technology publications; the HHS Information
Systems Program Handbook and the CMS Information Security Handbook.
Retention and Disposal:
CMS will retain information for a total period not to exceed 10
years. All claims-related records are encompassed by the document
preservation order and will be retained until notification is received
from DOJ.
System Manager and Address:
Division Payment Policy Demonstrations, Medicare Demonstrations
Program Group, Office of Research, Development & Information, Mail Stop
C4-17-27, Centers for Medicare & Medicaid Services, 7500 Security
Boulevard, Baltimore, MD 21244-1849.
Notification Procedure:
For purpose of access, the subject individual should write to the
system manager who will require the system name, employee
identification number, tax identification number, national provider
number, and for verification purposes, the subject individual's name
(woman's maiden name, if applicable), HICN, and/or SSN (furnishing the
SSN is voluntary, but it may make searching for a record easier and
prevent delay).
Record Access Procedure:
For purpose of access, use the same procedures outlined in
Notification Procedures above. Requestors should also reasonably
specify the record contents being sought. (These procedures are in
accordance with Department regulation 45 CFR 5b.5(a)(2)).
Contesting Record Procedures:
The subject individual should contact the system manager named
above, and reasonably identify the record and specify the information
to be contested. State the corrective action sought and the reasons for
the correction with supporting justification. (These procedures are in
accordance with Department regulation 45 CFR 5b.7).
Records Source Categories:
Data will be collected from Medicare administrative and claims
records (Common Working File, Carrier Medicare Claims Record,
Intermediary Medicare Claims Records), patient medical charts, and
physician records.
Systems Exempted from Certain Provisions of the Act:
None.
[FR Doc. E6-17052 Filed 10-13-06; 8:45 am]
BILLING CODE 4120-03-P