Privacy Act of 1974; System of Records, 66854-66857 [E8-26751]

Agencies

• Office of the Secretary
• DEPARTMENT OF DEFENSE

[Federal Register Volume 73, Number 219 (Wednesday, November 12, 2008)]
[Notices]
[Pages 66854-66857]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-26751]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

Office of the Secretary

[Docket ID DoD-2008-OS-0136]


Privacy Act of 1974; System of Records

AGENCY: Office of the Secretary, DoD.

ACTION: Notice to Alter a System of Records.

-----------------------------------------------------------------------

SUMMARY: The Office of the Secretary of Defense is altering a system of 
records notice in its existing inventory of record systems subject to 
the Privacy Act of 1974 (5 U.S.C. 552a), as amended.

DATES: This proposed action will be effective without further notice on 
December 12, 2008 unless comments are received which result in a 
contrary determination.

ADDRESSES: Send comments to the Office of the Secretary of Defense, 
Privacy Act Coordinator, Records Management Section, Washington 
Headquarters Services, 1155 Defense Pentagon, Washington, DC 20301-
1155.

FOR FURTHER INFORMATION CONTACT: Ms. Cindy Allard at (703) 588-2386.

SUPPLEMENTARY INFORMATION: The Office of the Secretary of Defense 
systems of records notices subject to the Privacy Act of 1974 (5 U.S.C. 
552a), as amended, have been published in the Federal Register and are 
available from the address above.
    The proposed system report, as required by 5 U.S.C. 552a(r), of the 
Privacy Act of 1974, as amended, was submitted on October 24, 2008, to 
the House Committee on Oversight and Government Reform, the Senate 
Committee on Homeland Security and Governmental Affairs, and the Office 
of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I 
to OMB Circular No. A-130, `Federal Agency Responsibilities for 
Maintaining Records About Individuals,' dated February 8, 1996 
(February 20, 1996, 61 FR 6427).

    Dated: November 3, 2008.
Morgan E. Frazier,
Alternate OSD Federal Register Liaison Officer, Department of Defense.
DHA 06

System name:
    USTF Managed Care System (August 23, 1995, 60 FR 43775).
    Changes:
* * * * *

System name:
    Delete entry and replace with ``Designated Provider Managed Care 
System Records.''

System location:
    Delete entry and replace with ``Primary location: Office of the 
Assistant Secretary of Defense (Health Affairs), Deputy Director 
(TRICARE Management Activity), Chief, Health Plan Operations, Deputy 
Chief TRICARE Operations, Director Program Operations, Designated 
Provider Program Manager, Skyline Five, Suite 810, 5111 Leesburg Pike, 
Falls Church, VA 22041-3201.

[[Page 66855]]

Secondary locations:
    Designated Provider Data Contract Site: Apptis, Inc., 5201 Leesburg 
Pike Skyline Three, Suite 600, Falls Church, VA 22741-3206.
    Subcontractors: Ingenix, 12125 Technology Drive, Eden Prairie, MN 
55344-7302; DefenseWeb Technologies, 4150 Mission Blvd., Suite 220, San 
Diego, CA 92109-5054.
    Designated Provider Management Office Sites: Martin's Point Health 
Care, 331 Veranda Street, Portland, ME 04103-5040; Brighton Marine 
Health Center, 77 Warren Street, Boston, MA 02135-9862; St. Vincent 
Catholic Medical Centers of New York, 450 West 33rd Street, New York, 
NY 10001-2603; Johns Hopkins Medical Services Corporation, 6704 Curtis 
Court, Glen Burnie, MD 21060-6406; CHRISTUS Health, 2600 North Loop 
West, Houston, TX 77092-8914; Pacific Medical Clinics, 1200 12th Avenue 
South, Seattle, WA 98144-2790.''

Categories of individuals covered by the system:
    Delete entry and replace with ``Individuals eligible to participate 
in, and who have elected to enroll in the Uniformed Services Family 
Health Plan (USFHP) of the Department of Defense Military Health 
Services of Managed Care System.''

Categories of records in the system:
    Delete entry and replace with ``Enrollment Records: Electronic 
files containing beneficiary ID, name, Social Security Number (SSN), 
date of birth, gender, sponsor status (active duty or retired), 
relationship to sponsor, sponsor pay grade, sponsor name and Social 
Security Number (SSN), state/country, zip code, and program enrollment 
information (i.e., date of enrollment, expiration of enrollment, 
program enrolled in, etc.).
    Management Clinical Data Records: Electronic files containing 
Uniformed Services Family Health Plan of the Department of Defense 
Military Health Services of Managed Care System, System identifier, 
beneficiary ID, name, Social Security Number (SSN), other demographics 
(i.e., county, state, zip code, coverage area for Uniformed Services 
Family Health Plan, healthcare services, healthcare provider, and 
financial information (e.g., Diagnosis-Related Groups and uniformed 
service beneficiaries cost share).
    Medicare Claims Records: Electronic files containing claim 
identifiers, beneficiary ID, county, state, zip code, healthcare 
services, healthcare provider, and cost of healthcare and procedure 
retained for two years for analysis of cost trends.''

Authority for maintenance of the system:
    Delete entry and replace with ``DoD 6025.18-R, DoD Health 
Information Privacy Regulation; Public Law 104-201, Sec.  722-726; 
Health Insurance Portability and Accountability Act of 1996 (HIPAA); 10 
U.S.C. 1102, Confidentiality of Medical Quality Assurance Records: 
Qualified Immunity for Participants; and E.O. 9397 (SSN).''

Purpose(s):
    Delete entry and replace with ``The system is used to administer 
the Uniformed Services Family Health Plan of the Department of Defense 
Military Health Services of Managed Care System. It identifies eligible 
beneficiaries enrolled in Uniformed Services Family Health Plan managed 
care programs and records healthcare services provided and payments 
made on behalf of eligible uniformed services health beneficiaries. 
Additional management functions enable DoD Healthcare Officials to use 
information in the system at individual and aggregate levels to monitor 
quantity and type of healthcare provided and to analyze and study the 
cost effectiveness of the Uniformed Services Family Health Plan of the 
Department of Defense Military Health Services of Managed Care 
System.''

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    Delete entry and replace with ``Disclosures to Center for Medicare 
and Medicaid Services (CMS), to detect duplicate or overlapping 
payments made by Medicare.
    Disclosures to National Oceanic Service, United States Public 
Health Service, United States Coast Guard, and National Oceanic and 
Atmospheric Administration to track services provided to their 
uniformed service personnel and beneficiaries.
    The `Blanket Routine Uses' set forth at the beginning of OSD's 
compilation of systems of records notices also apply to this system.

    Note: This system of records contains individually identifiable 
health information. The DoD 6025.18-R, ``DoD Health Information 
Privacy Regulation'' issued pursuant to the Health Insurance 
Portability and Accountability Act of 1996, applies to most such 
health information and may place additional procedural requirements 
on the uses and disclosures of such information beyond those found 
in the Privacy Act of 1974 or mentioned in this system of records 
notice.''

Storage:
    Delete entry and replace with ``Electronic storage media and paper 
records in file folders.''

Retrievability:
    Delete entry and replace with ``Patient or sponsor's surname and/or 
Social Security Number (SSN).''

Safeguards:
    Delete entry and replace with ``Records are maintained in a 
controlled area accessible only to authorized personnel. Entry to this 
area is restricted to personnel with a valid requirement and 
authorization to enter. Physical entry is restricted by the use of a 
cipher lock on the entrance to the room. Personal data maintained at 
the back-up site is stored in a secure area. Access to personal data 
records is restricted to those individuals who require the records in 
the performance of official duties and to those records that are the 
subject of official duties. Access is restricted by passwords that are 
changed every ninety days.''

Retention and disposal:
    Delete entry and replace with ``Paper records are closed out at the 
end of the calendar year in which finalized and held six additional 
years and then destroyed. Where hard copy records have been converted 
to electronic, microfilm, imaging, or optical formats, the hard copy 
record is destroyed and the electronic, microfilm, imaging, or optical 
format is kept by the contractor for six years after claim is processed 
to completion and then destroyed. Storage media containing data with 
personal identifiers will be erased (degaussed) after the inactive 
record retention. Paper records are forwarded to the National Records 
Archives, and are maintained.''

System manager(s) and address:
    Delete entry and replace with ``Designated Program Manager, TRICARE 
Management Activity, Skyline 5, Suite 810, 5111 Leesburg Pike, Falls 
Church, VA 22041-3238.''

Notification procedure:
    Delete entry and replace with ``Individuals seeking to determine 
whether information about themselves is contained in this system should 
address written inquiries to the Deputy Chief, TRICARE Operations, 
Skyline 5, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3238.
    The request should contain the full name of the patient and 
sponsor, sponsor's Social Security Number (SSN), patient's date of 
birth, Defense Enrollment/Eligibility Reporting System dependent 
suffix, gender, treatment

[[Page 66856]]

facility(ies), and calendar year(s) of interest.''

Record access procedures:
    Delete entry and replace with ``Individuals seeking access to 
information about themselves contained in this system should address 
written inquiries to the OSD/JS FOIA Requester Service Center, 1155 
Defense Pentagon, Washington, DC 20301-1155.
    The request should contain the full names of the patient and 
sponsor, sponsor's Social Security Number (SSN), patient's date of 
birth, Defense Enrollment/Eligibility Reporting System dependent 
suffix, gender, treatment facility(ies), and calendar year(s) of 
interest.''
* * * * *
DHA 06

System name:
    Designated Provider Managed Care System Records.

System location:
    Primary location: Office of the Assistant Secretary of Defense 
(Health Affairs), Deputy Director (TRICARE Management Activity), Chief, 
Health Plan Operations, Deputy Chief TRICARE Operations, Director 
Program Operations, Designated Provider Program Manager, Skyline Five, 
Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3201.
    Secondary locations: Designated Provider Data Contract Site: 
Apptis, Inc., 5201 Leesburg Pike Skyline Three, Suite 600, Falls 
Church, VA 22741-3206.
    Subcontractors: Ingenix, 12125 Technology Drive, Eden Prairie, MN 
55344-7302; DefenseWeb Technologies, 4150 Mission Blvd, Suite 220, San 
Diego, CA 92109-5054.
    Designated Provider Management Office Sites: Martin's Point Health 
Care, 331 Veranda Street, Portland, ME 04103-5040; Brighton Marine 
Health Center, 77 Warren Street, Boston, MA 02135-9862; St. Vincent 
Catholic Medical Centers of New York, 450 West 33rd Street, New York, 
NY 10001-2603; Johns Hopkins Medical Services Corporation, 6704 Curtis 
Court, Glen Burnie, MD 21060-6406; CHRISTUS Health, 2600 North Loop 
West, Houston, TX 77092-8914; Pacific Medical Clinics, 1200 12th Avenue 
South, Seattle, WA 98144-2790.

Categories of individuals covered by the system:
    Individuals eligible to participate in, and who have elected to 
enroll in the Uniformed Services Family Health Plan (USFHP) of the 
Department of Defense Military Health Services of Manage Care System.

Categories of records in the system:
    Enrollment Records: Electronic files containing beneficiary ID, 
name, Social Security Number (SSN), date of birth, gender, sponsor 
status (active duty or retired), relationship to sponsor, sponsor pay 
grade, sponsor name and Social Security Number (SSN), state/country, 
zip code, and program enrollment information (i.e., date of enrollment, 
expiration of enrollment, program enrolled in, etc.).
    Management Clinical Data Records: Electronic files containing 
Uniformed Services Family Health Plan of the Department of Defense 
Military Health Services of Manage Care System, System identifier, 
beneficiary ID, name, Social Security Number (SSN), other demographics 
(i.e., county, state, zip code, coverage area for Uniformed Services 
Family Health Plan, healthcare services, healthcare provider, and 
financial information (e.g., Diagnosis-Related Groups and uniformed 
service beneficiaries cost share.)
    Medicare Claims Records: Electronic files containing claim 
identifiers, beneficiary ID, county, state, zip code, healthcare 
services, healthcare provider, and cost of healthcare and procedure 
retained for two years for analysis of cost trends.

Authority for maintenance of the system:
    DoD 6025.18-R, DoD Health Information Privacy Regulation; Public 
Law 104-201, Sec.  722-726; Health Insurance Portability and 
Accountability Act of 1996 (HIPAA); 10 U.S.C. 1102, Confidentiality of 
Medical Quality Assurance Records: Qualified Immunity for Participants; 
and E.O. 9397 (SSN).

Purpose(s):
    The system is used to administer the Uniformed Services Family 
Health Plan of the Department of Defense Military Health Services of 
Managed Care System. It identifies eligible beneficiaries enrolled in 
Uniformed Services Family Health Plan managed care programs and records 
healthcare services provided and payments made on behalf of eligible 
uniformed services health beneficiaries. Additional management 
functions enable DoD Healthcare Officials to use information in the 
system at individual and aggregate levels to monitor quantity and type 
of healthcare provided and to analyze and study the cost effectiveness 
of the Uniformed Services Family Health Plan of the Department of 
Defense Military Health Services of Managed Care System.

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    Disclosures to Center for Medicare and Medicaid Services (CMS), to 
detect duplicate or overlapping payments made by Medicare.
    Disclosures to National Oceanic Service, United States Public 
Health Service, United States Coast Guard, and National Oceanic and 
Atmospheric Administration to track services provided to their 
uniformed service personnel and beneficiaries.
    The ``Blanket Routine Uses'' set forth at the beginning of OSD's 
compilation of systems of records notices also apply to this system.

    Note: This system of records contains individually identifiable 
health information. The DoD 6025.18-R, ``DoD Health Information 
Privacy Regulation'' issued pursuant to the Health Insurance 
Portability and Accountability Act of 1996, applies to most such 
health information and may place additional procedural requirements 
on the uses and disclosures of such information beyond those found 
in the Privacy Act of 1974 or mentioned in this system of records 
notice.

Policies and practices for storing, retrieving, accessing, retaining 
and disposing of records in the system:
Storage:
    Electronic storage media and paper records in file folders.

Retrievability:
    Patient or sponsor's surname and/or Social Security Number (SSN).

Safeguards:
    Records are maintained in a controlled area accessible only to 
authorized personnel. Entry to this area is restricted to personnel 
with a valid requirement and authorization to enter. Physical entry is 
restricted by the use of a cipher lock on the entrance to the room. 
Personal data maintained at the back-up site is stored in a secure 
area. Access to personal data records is restricted to those 
individuals who require the records in the performance of official 
duties and to those records that are the subject of official duties. 
Access is restricted by passwords that are changed every ninety days.

Retention and disposal:
    Paper records are closed out at the end of the calendar year in 
which finalized and held six additional years and then destroyed. Where 
hard copy records have been converted to electronic, microfilm, 
imaging, or optical formats, the hard copy record is destroyed and the 
electronic, microfilm, imaging, or optical format is kept by the

[[Page 66857]]

contractor for six years after claim is processed to completion and 
then destroyed. Storage media containing data with personal identifiers 
will be erased (degaussed) after the inactive record retention. Paper 
records are forwarded to the National Records Archives, and are 
maintained.

System manager(s) and address:
    Designated Program Manager, TRICARE Management Activity, Skyline 5, 
Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3238.

Notification procedure:
    Individuals seeking to determine whether information about 
themselves is contained in this system should address written inquiries 
to the Deputy Chief, TRICARE Operations, Skyline 5, Suite 810, 5111 
Leesburg Pike, Falls Church, VA 22041-3238.
    The request should contain the full name of the patient and 
sponsor, sponsor's Social Security Number (SSN), patient's date of 
birth, Defense Enrollment/Eligibility Reporting System dependent 
suffix, gender, treatment facility(ies), and calendar year(s) of 
interest.

Record access procedures:
    Individuals seeking access to information about themselves 
contained in this system should address written inquiries to the OSD/JS 
FOIA Requester Service Center, 1155 Defense Pentagon, Washington, DC 
20301-1155.
    The request should contain the full names of the patient and 
sponsor, sponsor's Social Security Number (SSN), patient's date of 
birth, Defense Enrollment/Eligibility Reporting System dependent 
suffix, gender, treatment facility(ies), and calendar year(s) of 
interest.

Contesting record procedures:
    The OSD's rules for accessing records, for contesting contents and 
appealing initial agency determinations are published in OSD 
Administrative Instruction 81; 32 CFR part 311, Office of the Secretary 
of Defense, OSD Privacy Program; or may be obtained from the system 
manager.

Record source categories:
    Uniformed Services Family Health Plan enrollment records; medical/
hospital information systems, and/or billing systems; eligibility 
information from the Defense Enrollment/Eligibility Reporting System; 
claim information from the Center for Medicare and Medicaid; 
beneficiary information from National Oceanic and Atmospheric 
Administration; National Oceanic Service; U.S. Coast Guard; and U.S. 
Public Health Service.

Exemptions claimed for the system:
    None.

 [FR Doc. E8-26751 Filed 11-10-08; 8:45 am]
BILLING CODE 5001-06-P