Privacy Act of 1974; New OIG Privacy Act System of Records: Consolidated Data Repository, 66648-66651 [E8-26725]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of Inspector General
• Inspector General Office, Health and Human Services Department

[Federal Register Volume 73, Number 218 (Monday, November 10, 2008)]
[Notices]
[Pages 66648-66651]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-26725]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of Inspector General


Privacy Act of 1974; New OIG Privacy Act System of Records: 
Consolidated Data Repository

AGENCY: Office of Inspector General (OIG), HHS.

ACTION: Notice of proposed new Privacy Act System of Records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their system of records. Notice is hereby given that OIG 
is adding a new system of records entitled ``Consolidated Data 
Repository--HHS-OIG'' (09-90-1000).

DATES: Effective Date: This system of records will become effective 
without further notice on December 22, 2008, unless comments received 
on or before that date result in a contrary determination.
    Comment Date: Comments on this new system of records will be 
considered if we receive them at the addresses provided below no later 
than 5 p.m. Eastern Standard Time on December 10, 2008.

ADDRESSES: In commenting, please reference file code 09-90-1000. 
Because of staff and resource limitations, we cannot accept comments by 
facsimile (fax) transmission. However, you may submit comments using 
one of the following three ways (no duplicates, please):
    1. Electronically. You may submit electronically through the 
Federal eRulemaking Portal at https://www.regulations.gov. (Attachments 
should be in Microsoft Word, if possible.)
    2. By regular, express, or overnight mail. You may mail your 
printed or written submissions to the following address: Office of 
Inspector General, Department of Health and Human Services, Attention: 
Marco Villagrana, Room 5541, Cohen Building, 330 Independence Avenue, 
SW., Washington, DC 20201. Please allow sufficient time for mailed 
comments to be received before the close of the comment period.
    3. By hand or courier. You may deliver, by hand or courier, before 
the close of the comment period, your printed or written comments to 
the Office of Inspector General, Department of Health and Human 
Services, Cohen Building, 330 Independence Avenue, SW., Washington, DC 
20201. Because

[[Page 66649]]

access to the interior of the Cohen Building is not readily available 
to persons without Federal Government identification, commenters are 
encouraged to schedule their delivery with one of our staff members at 
(202) 619-1343.
    Inspection of Public Comments: All comments received before the end 
of the comment period will be posted on https://www.regulations.gov for 
public viewing. Hard copies will also be available for public 
inspection at the Office of Inspector General, Department of Health and 
Human Services, Cohen Building, 330 Independence Avenue, SW., 
Washington, DC 20201, Monday through Friday, from 8:30 a.m. to 4 p.m. 
To schedule an appointment to view public comments, phone (202) 401-
2206.

FOR FURTHER INFORMATION CONTACT: Marco Villagrana, Department of Health 
& Human Services, Office of Inspector General, Office of External 
Affairs, (202) 401-2206; or Stephen Conway, Department of Health & 
Human Services, Office of Inspector General, Office of Audit Services, 
(617) 565-2946.

SUPPLEMENTARY INFORMATION: Under Section 2 of the Inspector General Act 
of 1978, as amended, OIG is required to conduct audits and 
investigations relating to programs and operations of the Department. 
In performing these required functions, OIG must collect, collate, and 
analyze claims information relating to services rendered to Medicare 
beneficiaries and Medicaid recipients. For this reason, OIG is 
establishing a new system of records which combines information from 
several existing HHS systems of records with information from State 
sources. This combined system of records is necessary for OIG to 
perform timely and independent audits, evaluations and inspections, and 
investigations of the Medicare and Medicaid programs.
    In addition, in compliance with the ``Incident Reporting and 
Handling Requirements'' set forth in the Office of Management and 
Budget Memoranda 07-16, Safeguarding Against and Responding to the 
Breach of Personally Identifiable Information, OIG is incorporating the 
routine use language into this new system of records as part of our 
normal System of Records Notice (SORN) review development process.

Description of the Proposed System of Records

    Records from the Centers for Medicare & Medicaid Services and State 
Medicaid agencies will be incorporated into this new system of records. 
The new system of records will be created by including Medicare and 
Medicaid enrollment, eligibility, and claims data records on all 
beneficiaries and recipients. Data in the system of records will 
include names; Social Security numbers (SSNs); health insurance 
identification numbers; and claims information relating to inpatient, 
outpatient, physician/supplier, skilled nursing facilities, nursing 
home, hospice, home health, durable medical equipment, dental, 
prescription drug, and managed care.

Agency Policies, Procedures and Restrictions on the Routine Use

    The Privacy Act permits OIG to disclose information outside HHS 
without an individual's consent if the information is to be used for a 
purpose that is compatible with the purposes for which the information 
was collected. Any such disclosure of data is known as a routine use. 
Accordingly, we are proposing to establish the following routine use 
disclosures of records maintained in the system:
    1. Disclosure may be made to Federal, State, and local agencies for 
the purpose of better identifying the total current health care usage 
of the Medicare and Medicaid patient population.
    2. Disclosure may be made to Federal, State, and local government 
agencies and national health organizations to assist in the development 
of programs that will be beneficial to claimants and to protect their 
rights under law and assure that they are receiving all benefits to 
which they are entitled.
    3. Disclosure may be made to a Federal department or agency or to a 
contractor of a Federal department or agency in order to conduct 
Federal audits, evaluations and inspections, or investigations 
necessary to accomplish a statutory purpose of an agency. OIG must be 
able to disclose information for purposes needed to accomplish a 
statutory purpose of a Federal agency.
    4. Disclosure may be made to a congressional office from the record 
of an individual in response to an inquiry from the congressional 
office made at the request of that individual.
    5. In the event of litigation, information from the system of 
records may be disclosed to the Department of Justice, to a judicial or 
administrative tribunal, opposing counsel, and witnesses in the course 
of proceedings involving HHS, any HHS employee (where the matter 
pertains to the employee's official duties), or the United States, or 
any agency thereof where the litigation is likely to affect HHS, or HHS 
is a party or has an interest in the litigation and the use of the 
information is relevant and necessary to the litigation.
    6. In the event that a system of records maintained by OIG to carry 
out its functions indicates a violation or potential violation of law, 
whether civil, criminal, or regulatory in nature, and whether arising 
by general statute or particular program statute, or by regulation, 
rule, or order issued pursuant thereto, the relevant records in the 
system of records may be referred, as a routine use, to the appropriate 
agency, whether Federal, State, local, or foreign, charged with the 
responsibility of investigating or prosecuting such violation or 
charged with enforcing or implementing the statute, rule, regulation, 
or order issued pursuant thereto.
    7. In the event the that Department deems it desirable or necessary 
in determining whether particular records are required to be disclosed 
under the Freedom of Information Act, disclosure may be made to the 
Department of Justice for the purpose of obtaining its advice.
    8. A record from this system of records may be disclosed to a 
Federal agency in response to its request in connection with the hiring 
or retention of an employee, the issuance of a security clearance, the 
reporting of an investigation of an employee, the letting of a 
contract, or the issuance of a license, grant, or other benefit by the 
requesting agency, to the extent that the record is relevant and 
necessary to the requesting agency's decision on the matter.
    9. The system of records may be disclosed to student volunteers and 
other individuals performing functions for the Department but 
technically not having the status of agency employees, if they need 
access to the records to perform their assigned agency functions.
    10. A record may be disclosed to appropriate Federal agencies and 
Department contractors that have a need to know the information for the 
purpose of assisting the Department's efforts to respond to a suspected 
or confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and necessary for that assistance.

Safeguards

    OIG has safeguards in place for authorized users and monitors users 
to ensure against unauthorized use. The system will conform to all 
applicable Federal laws and regulations and Federal, HHS, and OIG 
policies and standards as they relate to information security and data 
privacy.

[[Page 66650]]

Effects of the Proposed System of Records on Individual Rights

    This system is established in accordance with the principles and 
requirements of the Privacy Act and will collect, use, and disseminate 
information only as prescribed therein. Data in this system will be 
subject to the authorized releases in accordance with the routine uses 
identified in this system of records notice.
    OIG will take precautionary measures to minimize the risks of 
unauthorized access to the records and the potential harm to individual 
privacy or other personal or property rights of beneficiaries and 
recipients whose data are maintained in the system. OIG will make 
disclosures from the proposed system in accordance with the Privacy 
Act. OIG does not anticipate an unfavorable effect on individual 
privacy as a result of the disclosure of information relating to 
individuals. This proposed change will not otherwise increase access to 
these records.

    Dated: October 28, 2008.
Daniel R. Levinson,
Inspector General.
09-90-1000

SYSTEM NAME:
    Consolidated Data Repository-HHS-OIG.

SYSTEM LOCATION(S):
    Records will be maintained at the following computer site 
locations:
     HHS-OIG, 330 Independence Avenue, SW., Washington, DC 
20201.
     HHS-OIG, N2-01-02, 7500 Security Boulevard, Baltimore, MD 
21244.
    And the following HHS-OIG Regional/Field Office locations:
     JFK Federal Building, Boston, MA 02203.
     J.K. Javits Federal Building, 26 Federal Plaza, New York, 
NY 10278.
     150 South Independence Mall West, Public Ledger Building, 
Philadelphia, PA 19106.
     Atlanta Federal Center, Forsyth Street South, Atlanta, GA 
30303.
     8659 Baypine Road, Suite 203 Jacksonville, FL 32256.
     233 North Michigan Avenue, Room 1360, Chicago, IL 60601.
     3815 West Street, Joseph Hwy, Lansing, MI 48917.
     Galtier Plaza, 380 Jackson Street, Suite 727, St. Paul, MN 
55101.
     1124 Rickard Road, Suite C, Springfield, IL 62704.
     1100 Commerce Street, Dallas, TX 75242.
     1201 Walnut Street, Kansas City, MO 64106.
     90 7th Street, San Francisco, CA 94103.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include information concerning Medicare beneficiaries 
and Medicaid recipients.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The categories of records in the system will include Medicare 
beneficiaries' names, addresses, dates of birth, Medicare HIC numbers, 
SSNs, enrollment information and eligibility information, and claims 
information relating to the following types of services: Inpatient, 
skilled nursing facility, outpatient, physician/supplier, home health, 
hospice, durable medical equipment, prescription drug, and Medicare 
Advantage. The records will also include names, addresses, dates of 
birth, and SSNs on Medicaid recipients from State enrollment and 
eligibility files and claims information relating to the following 
types of services: Inpatient, long-term care, professional, dental, 
pharmacy, and Medicare cross-over. The National Provider Identification 
database and the Unique Provider Identification Number (UPIN) directory 
will be stored in this system of records.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Inspector General Act of 1978 (5 U.S.C. App.).

PURPOSE(S):
    The purpose of this system of records is to conduct audits, 
evaluations and inspections, and investigations of the Medicare and 
Medicaid programs.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSE OF SUCH USES:
    The Privacy Act permits OIG to disclose information outside HHS 
without an individual's consent if the information is to be used for a 
purpose that is compatible with the purposes for which the information 
was collected. Any such disclosure of data is known as a routine use. 
Accordingly, we are proposing to establish the following routine use 
disclosures of records maintained in the system:
    a. Disclosure may be made to Federal, State, and local agencies for 
the purpose of better identifying the total current health care usage 
of the Medicare and Medicaid patient population.
    b. Disclosure may be made to Federal, State, and local government 
agencies and national health care organizations to assist in the 
development of programs that will be beneficial to claimants and to 
protect their rights under law and assure that they are receiving all 
benefits to which they are entitled.
    c. Disclosure may be made to a Federal department or agency or to a 
contractor of a Federal department or agency to permit it to conduct 
Federal audits, evaluations and inspections, or investigations 
necessary to accomplish a statutory purpose of an agency. OIG must be 
able to disclose information for purposes needed to accomplish a 
statutory purpose of a Federal agency.
    d. Disclosure may be made to a congressional office from the record 
of an individual in response to an inquiry from the congressional 
office made at the request of that individual.
    e. In the event of litigation, information from the system of 
records may be disclosed to the Department of Justice, to a judicial or 
administrative tribunal, opposing counsel, and witnesses, in the course 
of proceedings involving HHS, any HHS employee (where the matter 
pertains to the employee's official duties), or the United States, or 
any agency thereof where the litigation is likely to affect HHS, or HHS 
is a party or has an interest in the litigation and the use of the 
information is relevant and necessary to the litigation.
    f. In the event that a system of records maintained by OIG to carry 
out its functions indicates a violation or potential violation of law, 
whether civil, criminal, or regulatory in nature, and whether arising 
by general statute or particular program statute, or by regulation, 
rule or order issued pursuant thereto, the relevant records in the 
system of records may be referred, as a routine use, to the appropriate 
agency, whether Federal, State, local, or foreign, charged with the 
responsibility of investigating or prosecuting such violation or 
charged with enforcing or implementing the statute, or rule, regulation 
or order issued pursuant thereto.
    g. In the event that the Department deems it desirable or 
necessary, in determining whether particular records are required to be 
disclosed under the Freedom of Information Act, disclosure may be made 
to the Department of Justice for the purpose of obtaining its advice.
    h. A record from this system of records may be disclosed to a 
Federal agency, in response to its request, in connection with the 
hiring or retention of an employee, the issuance of a security 
clearance, the reporting of an investigation of an employee, the 
letting of a contract, or the issuance of a license, grant, or other 
benefit by the requesting agency, to the extent that the record is 
relevant and necessary to the requesting agency's decision on the 
matter.

[[Page 66651]]

    i. The system of records may be disclosed to student volunteers and 
other individuals performing functions for the Department but 
technically not having the status of agency employees, if they need 
access to the records to perform their assigned agency functions.
    j. A record may be disclosed to appropriate Federal agencies and 
Department contractors that have a need to know the information for the 
purpose of assisting the Department's efforts to respond to a suspected 
or confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and necessary for that assistance.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Data are maintained on magnetic tape, disk, or laser optical media.

RETRIEVABILITY:
    Records may be retrieved by name, name and one or more criteria 
(e.g., dates of birth, death, and service), SSN, Medicare HIC number, 
Medicaid Identification Number.

SAFEGUARDS:
    The computers that process these data are protected by technical, 
managerial, and operational controls that follow Federal policies and 
guidelines. The computers are protected by a combination of physical 
security by being located in Federal offices; access controls such as 
passwords and identification numbers; and technical protections such as 
encryption, firewalls, and anti-virus software. These controls allow 
only authorized users to access the data.
    Employees who maintain records in this system are instructed not to 
release data until the intended recipient agrees to implement 
appropriate management, operational, and technical safeguards 
sufficient to protect the confidentiality, integrity, and availability 
of the information and information systems and to prevent unauthorized 
access. This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and OIG policies and standards as they 
relate to information security and data privacy. These laws and 
regulations may apply but are not limited to: The Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the Health Insurance Portability and 
Accountability Act of 1996; the eGovernment Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Prescription Drug, Improvement, and 
Modernization Act of 2003, and the corresponding implementing 
regulations; and OMB Circular A-130, Management of Federal Resources, 
Appendix III, Security of Federal Automated Information Resources also 
applies. Federal, HHS, and OIG policies and standards include but are 
not limited to: All pertinent National Institute of Standards and 
Technology publications; the HHS Information Systems Program Handbook; 
and OIG Information Security Handbooks.

RETENTION AND DISPOSAL:
    These records may be maintained for an indefinite duration.

SYSTEM MANAGER AND ADDRESS:
    The agency official responsible for the system policies and 
practices outlined above is: The Chief Information Officer, Office of 
Management and Policy, Office of Inspector General, Department of 
Health and Human Services, Wilbur J. Cohen Building, Room 5230, 330 
Independence Avenue, SW., Washington, DC 20201.

NOTIFICATION PROCEDURE:
    Any inquiries regarding these systems of records should be 
addressed to the System Manager. An individual who requests 
notification of or access to a medical record shall, at the time the 
request is made, designate in writing a responsible representative who 
will be willing to review the record and inform the subject individual 
of its contents at the representative's discretion. (These notification 
and access procedures are in accordance with Department regulations (45 
CFR 5b.6).)

RECORDS ACCESS PROCEDURES:
    Same as notification procedures. Requesters should also reasonably 
specify the record contents being sought. (These access procedures are 
in accordance with Department regulations (45 CFR 5b.5(a)(2).)

CONTESTING RECORD PROCEDURES:
    Contact the official at the address in the System Manager and 
Address section above, and reasonably identify the record and specify 
the information to be contested and the corrective action sought with 
supporting justification. (These procedures are in accordance with 
Department Regulations (45 CFR 5b.7).)

RECORD SOURCE CATEGORIES:
    Information may be obtained from the Centers for Medicare & 
Medicaid Services National Claims History (inpatient, outpatient, 
physician supplier, nursing home, hospice, home care, and durable 
medical equipment), Drug Data Processing System, Medicare Advantage and 
Prescription Drug system and State Medicaid claims and enrollment 
databases.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

    None.
[FR Doc. E8-26725 Filed 11-7-08; 8:45 am]
BILLING CODE 4152-01-P