Privacy Act of 1974; Report of New System of Records, 73095-73101 [2010-29952]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 75, Number 228 (Monday, November 29, 2010)]
[Notices]
[Pages 73095-73101]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-29952]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Report of New System of Records

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS).

ACTION: Notice of a New System of Records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, CMS is establishing a new system of records (SOR) titled, 
``Medicare and Medicaid Electronic Health Record (EHR) Incentive 
Program National Level Repository'' System No. 09-70-0587. The final 
rule for the Medicare and Medicaid EHR Incentive Program implements the 
provisions of the American Recovery and Reinvestment Act of 2009 (the 
Recovery Act) (Pub. L. 111-5). Specifically, Title IV of Division B of 
the Recovery Act amends Titles XVIII and XIX of the Social Security Act 
(the Act) by establishing incentive payments to eligible professionals 
(EPs), eligible hospitals and critical access hospitals (CAHs) and 
Medicare Advantage (MA) Organizations participating in Medicare and 
Medicaid programs that adopt and successfully demonstrate meaningful 
use of certified electronic health record (EHR) technology. These 
Recovery Act provisions, together with Title XIII of Division A of the 
Recovery Act, may be cited as the ``Health Information Technology for 
Economic and Clinical Health Act,'' or the ``HITECH Act.''
    The final rule specified the initial criteria EPs, eligible 
hospitals and CAHs, and MA Organizations must meet in order to qualify 
for an incentive payment; calculation of the incentive payment amounts; 
payment adjustments under Medicare for covered professional services 
and inpatient hospital services provided by EPs, eligible hospitals and 
CAHs failing to demonstrate meaningful use of certified EHR technology 
beginning in 2015; and other program participation requirements. Also, 
the Office of the National Coordinator for Health Information 
Technology (ONC) issued a closely related final rule that specified the 
initial set of standards, implementation specifications, and 
certification criteria for certified EHR technology. ONC has also 
issued a separate final rule on the establishment of certification 
programs for health information technology (HIT).
    To register for the Medicare and Medicaid EHR Incentive Program, 
EPs,

[[Page 73096]]

eligible hospitals and CAHs, and MA Organizations will be required to 
provide the following information: Name, National Provider Identifier 
(NPI), business address and business phone for each EP, eligible 
hospital or CAH; Taxpayer Identification Number (TIN) to which the EP, 
eligible hospital or CAH wants the incentive payment to be made; For 
EPs, whether they choose to participate in the Medicare EHR Incentive 
Program or the Medicaid EHR Incentive Program; For eligible hospitals 
and CAHs, their CMS Certification Number (CCN); and other information 
as specified by CMS. EPs, eligible hospitals and CAHs will also have 
the option to provide their e-mail address at the time of registration. 
MA Organizations will be required to provide their contract number on 
behalf of their MA-affiliated EPs and hospitals. At this time, 
participation in the Medicare and Medicaid EHR Incentive Programs is 
voluntary for EPs, eligible hospitals and CAHs.
    Per section 1886(n)(4)(B) of the Act, as added by section 4102(c) 
of the HITECH Act, the Secretary will post on the Internet Web site of 
the Centers for Medicare & Medicaid Services, in an easily 
understandable format, a list of the names, business addresses, and 
business phone numbers of the Medicare EPs, eligible hospitals and CAHs 
who are meaningful EHR users in the Medicare EHR Incentive Program. 
Sections 1853(m)(5) and 1853(l)(7) of the Act, as added by sections 
4101(c) and 4102(c) of the HITECH Recovery Act, require the Secretary 
to post the same information for EPs and eligible hospitals 
participating in the MA program as would be required if they were in 
the Medicare FFS program. Additionally, the Secretary must post the 
names of the qualifying MA Organizations receiving the incentive 
payment or payments. The routine uses established with this system 
contain a proper explanation as to the need for the disclosure 
provisions and provide clarity to CMS' intention to disclose provider-
specific information contained in this system.
    The primary purpose of this system, called the National Level 
Repository or NLR, is to collect, maintain, and process information 
that is required for the Medicare and Medicaid EHR Incentive Program. 
Information in this system will also be disclosed to: (1) Support 
regulatory, incentive payments and policy functions such as evaluation 
and reporting, whether performed by the Agency or by an Agency 
contractor or consultant; (2) assist another Federal and/or state 
agency, agency of a state government, or an agency established by state 
law; (3) assist in making the individual physician-level participation 
data available through an Agency website and by various other means of 
data dissemination; (4) assist the Department's Office of the National 
Coordinator of Health Information Technology's (ONC's) grantees for the 
purpose of supporting ``eligible professional'' (EP) adoption and 
meaningful use of certified EHR technology; (5) support litigation 
involving the Agency; (6) combat fraud, waste, and abuse in certain 
health benefits programs, and (7) assist in a response to a suspected 
or confirmed breach of the security or confidentiality of information. 
We have provided background information about this new system in the 
``Supplementary Information'' section below. Although the Privacy Act 
requires only that CMS provide an opportunity for interested persons to 
comment on the proposed routine uses, CMS invites comments on all 
portions of this notice. See ``Effective Dates'' section for 
information about the comment period.

DATES: Effective Dates: CMS filed a new system report with the Chair of 
the House Committee on Government Reform and Oversight, the Chair of 
the Senate Committee on Homeland Security & Governmental Affairs, and 
the Administrator, Office of Information and Regulatory Affairs, Office 
of Management and Budget (OMB) on November 29, 2010. To ensure that all 
parties have adequate time in which to comment, the new system, 
including routine uses, will become effective 30 days from the 
publication of the notice, or 40 days from the date it was submitted to 
OMB and Congress, whichever is later, unless CMS receives comments that 
require alterations to this notice.

ADDRESSES: The public should address comments to: CMS Privacy Officer, 
Division of Information Security and Privacy Management, Enterprise 
Architecture and Strategy Group, Office of Information Services, CMS, 
Room N1-24-08, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. 
Comments received will be available for review at this location, by 
appointment, during regular business hours, Monday through Friday from 
9 a.m.--3 p.m., eastern time zone.

FOR FURTHER INFORMATION CONTACT: Rachel Maisler, Health Insurance 
Specialist, Office of E-Health Standards and Services, CMS, 7500 
Security Boulevard, Mail-stop: S2-26-17, Baltimore, MD 21244-1850. 
Office: 410-786-5754, Facsimile: 410-786-1347, E-mail address: 
rachel.maisler@cms.gov.

SUPPLEMENTARY INFORMATION: Sections 4101(a), 4102(a) and 4102(a)(2) of 
the HITECH Act respectively add sections 1848(o), 1886(n) and 
1814(l)(A)(3) to the Act to limit incentive payments in the Medicare 
Fee-for-service (FSS) EHR incentive program to an EP, eligible hospital 
or CAH that is a ``meaningful EHR user.'' Sections 4101(c) and 4102(c) 
of the HITECH Act respectively adds sections 1853(l) and 1853(m) which 
outline the application of incentive payments for certain MA-affiliated 
EPs and MA-affiliated hospitals. Section 4201(a)(2) of the HITECH Act 
added section 1903(t) to the Act to limit incentive payments in the 
Medicaid context to EPs, as defined at section 1903(t)(2)(A), who meet 
the requirements of 1903(t). As described in our final rule discussed 
below, these eligible professionals can receive an incentive payment 
for adoption or utilization of, or upgrade to, certified EHR technology 
in 2011, and can receive incentive payments in certain subsequent years 
if they demonstrate meaningful use of certified EHR technology.
    In sections 1848(o)(2)(A) and 1886(n)(3) of the Act, the Congress 
specified three types of requirements for meaningful use in the 
Medicare context: (1) Use of certified EHR technology in a meaningful 
manner; (2) that the certified EHR technology is connected in a manner 
that provides for the electronic exchange of health information to 
improve the quality of care; and (3) that, in using certified EHR 
technology, the provider submits to the Secretary information on 
clinical quality measures and such other measures selected by the 
Secretary.
    In our final rule on the EHR incentive program, we stated that we 
are not limited to collecting only information pertaining to Medicare 
and Medicaid beneficiaries. Therefore, in our final rule, we require 
that, in order to demonstrate meaningful use, an EP, eligible hospital 
or CAH, or MA Organization must report aggregate information on 
clinical quality measures for all patients to whom clinical quality 
measures apply. As explained in the final rule for EHR incentive 
payments, for the 2011 payment year, we use an attestation methodology 
for the submission of summary information on clinical quality measures 
as a condition of demonstrating meaningful use of certified EHR 
technology.
    For the Medicaid incentive program, as stated in our final rule, 
for their first year of payment, providers are not required to 
demonstrate meaningful use, and may receive an incentive payment by 
demonstrating adoption,

[[Page 73097]]

implementation, or upgrade to certified EHR technology. We expect that, 
for 2011, the majority of Medicaid providers will receive an incentive 
payment through this pathway. In their second, third, fourth, fifth and 
sixth payment year, Medicaid EPs and hospitals will be required to 
demonstrate meaningful use of certified EHR technology to qualify for 
an incentive payment.
    As stated in our final rule, we will use a phased approach for 
meaningful use criteria, based on currently available technology 
capabilities and provider practice experience. We refer to the initial 
meaningful use criteria as ``Stage 1.'' In the final rule, we require 
that EPs, eligible hospitals and CAHs, including MA-affiliated EPs and 
hospitals, demonstrate that they satisfy all the required meaningful 
use objectives and associated measures of the Stage 1 criteria during 
the reporting period for 2011 through attestation in order to receive 
incentive payments. In addition, we require that EPs, eligible 
hospitals and CAHs, and MA Organizations attest to the accuracy and 
completeness of the numerators and denominators for each of the 
applicable measures, and that the information submitted includes 
information on all patients to whom the measure applies.
    To qualify as a meaningful EHR user for 2011, we require that EPs, 
eligible hospitals, or CAHs demonstrate that they meet all of the 
required meaningful use objectives and the associated measures using 
certified EHR technology. In order to receive an incentive payment, all 
EPs, eligible hospitals and CAHs must register for the program in the 
NLR and then attest that they have successfully demonstrated meaningful 
use of certified EHR technology after the completion of their EHR 
reporting period, which is defined at 75 FR 44566.
    Section 1848(o)(3)(D) of the Act requires the Secretary to list, in 
an easily understandable format, the names, business addresses, and 
business phone numbers of the Medicare EPs for being meaningful EHR 
users under the Medicare FFS program on the Internet web site of CMS. 
Section 1886(n)(4)(B) of the Act requires the Secretary to list, in an 
easily understandable format, the names and other relevant data as 
determined appropriate, of eligible hospitals and CAHs who are 
meaningful EHR users under the Medicare FFS program, on the CMS 
Internet web site. Sections 1853(m)(5) and 1853(I)(7) of the Act 
require the Secretary to post the same information for EPs and eligible 
hospitals in the MA program as would be required if they were in the 
Medicare FFS program. Therefore, we collect the information necessary 
to post the name, business address and business phone numbers of all 
EPs, eligible hospitals and CAHs participating in the Medicare FFS and 
MA EHR Incentive Program,, and post this information on our Internet 
web site. The routine uses established with this system contain a 
proper explanation as to the need for the disclosure provisions and 
provide clarity to CMS' intention to disclose provider-specific 
information contained in this system.

I. Description of the Proposed System of Records

A. Statutory and Regulatory Basis for System

    Authority for the collection, maintenance, and disclosures from 
this system is provided under Sec. Sec.  1848(o), 1886(m), 1848(l), and 
1853(m) of the Social Security Act which were added by the HITECH Act, 
respectively authorize incentive payments for EPs, eligible hospitals, 
CAHs and MA Organizations that successfully demonstrate meaningful use 
of certified EHR technology. Sections 1903(a)(3) and 1903(t) of the 
Social Security Act provides authority for the Medicaid EHR Incentive 
Program. These provisions are implemented by 75 FR 44314 and 42 CFR 
parts 412, 413, 422, collectively known as the Medicare and Medicaid 
Programs; Electronic Health Record Incentive Program; Final Rule.

B. Collection and Maintenance of Data in the System

    The National Level Repository (NLR) contains information on 
eligible professionals who receive Medicare incentives as meaningful 
users of certified EHR technology. Information in the NLR will be 
populated from other CMS systems, including the Provider Enrollment, 
Chain, and Ownership System (PECOS) and the National Plan & Provider 
Enumeration System (NPPES). The NLR will contain provider name, 
National Provider Identifier (NPI), business address and phone number, 
Taxpayer Identification Number (TIN) to which the EP, eligible hospital 
or CAH, or MA Organization wants the incentive payment to be made, and, 
for EPs, whether they choose to participate in the Medicare EHR 
Incentive Program or the Medicaid EHR Incentive Program. For eligible 
hospitals and CAHs, their CCN will also be included. For MA 
Organizations, their CMS contract number will be included. For 
providers participating in the Medicaid EHR Incentive Program, it will 
include the State in which they choose to participate. Additionally, 
EPs, eligible hospitals and CAHs will have the option to provide an e-
mail address for inclusion in the system. At this time, participation 
in the Medicare and Medicaid EHR Incentive Program is voluntary for 
EPs, eligible hospitals and CAHs.

II. Agency Policies, Procedures, and Restrictions On Routine Uses

    A. The Privacy Act permits us to disclose information without an 
individual's consent if the information is to be used for a purpose 
that is compatible with the purpose(s) for which the information was 
collected. Any such disclosure of data is known as a ``routine use.'' 
The government will only release information collected in the NLR that 
can be associated with an individual EP as provided for under ``Section 
III. Proposed Routine Use Disclosures of Data in the System.'' 
Identifiable data may be disclosed under a routine use.
    We will only disclose the minimum provider-level data necessary to 
achieve the purpose of the Medicare and Medicaid EHR Incentive Program. 
CMS has the following policies and procedures concerning disclosures of 
information that will be maintained in the system. These policies do 
not apply to Routine Use No. 3 for this system. In general, disclosure 
of information from the system will be approved only for the minimum 
information necessary to accomplish the purpose of the disclosure and 
only after CMS:
    1. Determines that the use or disclosure is consistent with the 
reason that the data is being collected, e.g., to collect, maintain, 
and process information promoting the nationwide health information 
technology infrastructure that allows for the electronic use and 
exchange of information.
    2. Determines that:
    a. The purpose of the disclosure can only be accomplished if the 
record is provided in an individually identifiable form;
    b. The purpose for which the disclosure is to be made is of 
sufficient importance to warrant the effect and/or risk on the privacy 
of the individual provider that additional exposure of the record might 
bring; and
    c. There is a strong probability that the proposed use of the data 
would in fact accomplish the stated purpose(s).
    3. Requires the information recipient to:
    a. Establish administrative, technical, and physical safeguards to 
prevent unauthorized use of disclosure of the record;

[[Page 73098]]

    b. Remove or destroy at the earliest time all individually-
identifiable information; and
    c. Agree to not use or disclose the information for any purpose 
other than the stated purpose under which the information was 
disclosed.
    4. Determines that the data are valid and reliable.

III. Proposed Routine Use Disclosures of Data In the System

A. Entities Who May Receive Disclosures under Routine Use

    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the Medicare and Medicaid EHR Incentive 
Program without the consent of the individual to whom such information 
pertains. Each proposed disclosure of information under these routine 
uses will be evaluated to ensure that the disclosure is legally 
permissible, including but not limited to ensuring that the purpose of 
the disclosure is compatible with the purpose for which the information 
was collected. We propose to establish the following routine use 
disclosures of information maintained in the system:
    1. To support Agency contractors or consultants who have been 
engaged by the Agency to assist in accomplishment of a CMS function 
relating to the purposes for this SOR and who need to have access to 
the records in order to assist CMS.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contractual or similar 
agreement with a third party to assist in accomplishing a CMS function 
relating to purposes for this SOR.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor or consultant whatever information is 
necessary for the contractor or consultant to fulfill its duties. In 
these situations, safeguards are provided in the contract prohibiting 
the contractor or consultant from using or disclosing the information 
for any purpose other than that described in the contract and requires 
the contractor or consultant to return or destroy all information at 
the completion of the contract.
    2. To assist another Federal or state agency, agency of a state 
government, or an agency established by state law pursuant to 
agreements with CMS to:
    a. Contribute to the accuracy of CMS's proper incentive payment to 
Medicare and Medicaid EHR Incentive Program participants, and
    b. Assist Federal/state Medicaid programs which may require 
Medicare and Medicaid EHR Incentive Program information for purposes 
related to this system.
    c. Assist other Federal agencies that have the authority to perform 
collection of debts owed to the Federal government.
    Other Federal or state agencies in their administration of a 
Federal health program may require EHR Incentive Program information in 
order to support evaluations and monitoring of various aspects of the 
Medicare and Medicaid EHR Incentive payments.
    2. To assist in making the information for EPs, eligible hospitals 
and CAHs, and MA Organizations that receive Medicare EHR incentive 
payments through the new payment contractor, available through a public 
web site. If local websites are used by a local or regional 
collaborative, CMS would have links to these Web sites on its main Web 
site.
    This information would be posted for the purpose of, and in a 
manner that would promote the use of EHRs by EPs, eligible hospitals 
and CAHs, and MA Organizations to Medicare and Medicaid beneficiaries.
    3. To assist the Department's Office of the National Coordinator of 
Health Information Technology's (ONC's) grantees for the purpose of 
supporting ``eligible professional'' (EP) adoption and meaningful use 
of certified EHR technology.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may be asked to provide necessary 
information to ONC grantees, also referred to as Health Information 
Technology Regional Extension Centers (RECs) to assist in accomplishing 
an ONC function relating to support for ``eligible professional'' (EP) 
adoption of, meaningful use of certified EHR technology, and provider 
support.
    4. To support the Department of Justice (DOJ), court, or 
adjudicatory body when:
    a. The Agency or any component thereof, or
    b. Any employee of the Agency in his or her official capacity, or
    c. Any employee of the Agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    d. The United States Government, is a party to litigation or has an 
interest in such litigation, and by careful review, CMS determines that 
the records are both relevant and necessary to the litigation and that 
the use of such records by the DOJ, court or adjudicatory body is 
compatible with the purpose for which the agency collected the records.
    Whenever CMS is involved in litigation, or occasionally when 
another party is involved in litigation and CMS's policies or 
operations could be affected by the outcome of the litigation, CMS 
would be able to disclose information to the DOJ, court, or 
adjudicatory body involved.
    5. To assist a CMS contractor (including, but not limited to 
Medicare Administrative Contractors, fiscal intermediaries, and 
carriers) that assists in the administration of a CMS-administered 
health benefits program, or to a grantee of a CMS-administered grant 
program, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud, waste or abuse in such program.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contract or grant with a 
third party to assist in accomplishing CMS functions relating to the 
purpose of combating fraud, waste or abuse.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor or grantee whatever information is necessary 
for the contractor or grantee to fulfill its duties. In these 
situations, safeguards are provided in the contract prohibiting the 
contractor or grantee from using or disclosing the information for any 
purpose other than that described in the contract or grant and 
requiring the contractor or grantee to return or destroy all 
information.
    6. To assist another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that 
administers, or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    Other agencies may require Medicare and Medicaid EHR Incentive 
Program information for the purpose of

[[Page 73099]]

combating fraud, waste or abuse in such Federally-funded programs.
    7. To assist appropriate Federal agencies and Department 
contractors that have a need to know the information for the purpose of 
assisting the Department's efforts to respond to a suspected or 
confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and unnecessary for the assistance.
    Other Federal agencies and contractors may require EHR Incentive 
Program information for the purpose of assisting in a respond to a 
suspected or confirmed breach of the security or confidentiality of 
information.

IV. Safeguards

    CMS has safeguards in place for authorized users and monitors such 
users to ensure against unauthorized use. Personnel having access to 
the system have been trained in the Privacy Act and information 
security requirements. Employees who maintain records in this system 
are instructed not to release data until the intended recipient agrees 
to implement appropriate management, operational and technical 
safeguards sufficient to protect the confidentiality, integrity and 
availability of the information and information systems and to prevent 
unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: The Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also applies. Federal, HHS, and CMS policies and 
standards include but are not limited to: All pertinent National 
Institute of Standards and Technology publications; the HHS Information 
Systems Program Handbook and the CMS Information Security Handbook.

V. Effects of the New System On the Rights of Individuals

    CMS proposes to establish this system in accordance with the 
principles and requirements of the Privacy Act and will collect, use, 
and disseminate information only as prescribed therein. We will only 
disclose the minimum personal data necessary to achieve the purpose of 
the data collection and the routine uses contained in this notice. 
Disclosure of information from the system will be approved only to the 
extent necessary to accomplish the purpose of the disclosure. CMS has 
assigned a higher level of security clearance for the information 
maintained in this system in an effort to provide added security and 
protection of data in this system.
    CMS will take precautionary measures to minimize the risks of 
unauthorized access to the records and the potential harm to individual 
privacy or other personal or property rights. CMS will collect only 
that information necessary to perform the system's functions. In 
addition, CMS will make disclosure from the proposed system only with 
consent of the subject individual, or his/her legal representative, or 
in accordance with an applicable exception provision of the Privacy 
Act. CMS, therefore, does not anticipate an unfavorable effect on 
individual privacy as a result of the disclosure of information 
relating to individuals.

    Dated: November 16, 2010.
Michelle Snyder,
Deputy Chief Operating Officer, Centers for Medicare & Medicaid 
Services.
SYSTEM No. 09-70-0587

SYSTEM NAME:
    ``Medicare and Medicaid Electronic Health Record (EHR) Incentive 
Program National Level Repository'' HHS/CMS/OESS.

SECURITY CLASSIFICATION:
    Level Three Privacy Act Sensitive.

SYSTEM LOCATION:
    CMS Data Center, 7500 Security Boulevard, North Building, First 
Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The National Level Repository (NLR) contains information on 
eligible professionals who receive Medicare incentives as meaningful 
users of certified EHR technology.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The NLR will contain provider name, National Provider Identifier 
(NPI), business address and phone number, Taxpayer Identification 
Number (TIN) to which the EP, eligible hospital or CAH, or MA 
Organization wants the incentive payment to be made, and, for EPs, 
whether they choose to participate in the Medicare EHR Incentive 
Program or the Medicaid EHR Incentive Program. For eligible hospitals 
and CAHs, their CCN will also be included. For MA Organizations, their 
CMS contract number will be included. For providers participating in 
the Medicaid EHR Incentive Program, it will include the State in which 
they choose to participate. Additionally, EPs, eligible hospitals and 
CAHs will have the option to provide an e-mail address for inclusion in 
the system. At this time, participation in the Medicare and Medicaid 
EHR Incentive Program is voluntary for EPs, eligible hospitals and 
CAHs.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for the collection, maintenance, and disclosures from 
this system is provided under Sec. Sec.  1848(o), 1886(m), 1848(l), and 
1853(m) of the Social Security Act which were added by the HITECH Act, 
respectively authorize incentive payments for EPs, eligible hospitals, 
CAHs and MA Organizations that successfully demonstrate meaningful use 
of certified EHR technology. Sections 1903(a)(3) and 1903(t) of the 
Social Security Act provides authority for the Medicaid EHR Incentive 
Program. These provisions are implemented by 75 FR 44314 and 42 CFR 
parts 412, 413, 422, collectively known as the Medicare and Medicaid 
Programs; Electronic Health Record Incentive Program; Final Rule.

PURPOSE(S) OF THE SYSTEM:
    The primary purpose of this system, called the National Level 
Repository or NLR, is to collect, maintain, and process information 
that is required for the Medicare and Medicaid EHR Incentive Program. 
Information in this system will also be disclosed to: (1) Support 
regulatory, incentive payments and policy functions such as evaluation 
and reporting, whether performed by the Agency or by an Agency 
contractor or consultant; (2) assist another Federal and/or state 
agency, agency of a state government, or an agency established by state 
law; (3) assist in making the individual physician-level participation 
data available through an Agency website and by various other means of 
data dissemination; (4) assist the Department's Office of the National 
Coordinator of Health Information Technology's (ONC's) grantees for the 
purpose of supporting ``eligible professional'' (EP) adoption and 
meaningful use of certified EHR technology; (5) support litigation 
involving the Agency; (6) combat fraud, waste, and abuse in certain 
health

[[Page 73100]]

benefits programs, and (7) assist in a response to a suspected or 
confirmed breach of the security or confidentiality of information.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OR USERS AND THE PURPOSES OF SUCH USES:
A. Entities Who May Receive Disclosures under Routine Use
    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the EHRI without the consent of the individual 
to whom such information pertains. Each proposed disclosure of 
information under these routine uses will be evaluated to ensure that 
the disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected. We propose to 
establish the following routine use disclosures of information 
maintained in the system:
    1. To support Agency contractors, consultants, or CMS grantees who 
have been engaged by the Agency to assist in accomplishment of a CMS 
function relating to the purposes for this SOR and who need to have 
access to the records in order to assist CMS.
    2. To assist another Federal or state agency, agency of a state 
government, or an agency established by state law pursuant to 
agreements with CMS to:
    a. Contribute to the accuracy of CMS's proper incentive payment to 
Medicare and Medicaid EHR Incentive Program participants, and
    b. Assist Federal/state Medicaid programs which may require 
Medicare and Medicaid EHR Incentive Program information for purposes 
related to this system.
    c. Assist other Federal agencies that have the authority to perform 
collection of debts owed to the Federal government.
    3. To assist in making the information for EPs, eligible hospitals 
and critical access hospitals (CAHs), who receive EHR incentive 
payments through the new payment contractor, available through a public 
website. If local Web sites are used by a local or regional 
collaborative, CMS would have links to these websites on its main 
website.
    4. To assist the Department's Office of the National Coordinator of 
Health Information Technology's (ONC's) grantees for the purpose of 
supporting ``eligible professional'' (EP) adoption and meaningful use 
of certified EHR technology.
    5. To support the Department of Justice (DOJ), court, or 
adjudicatory body when:
    a. The Agency or any component thereof, or
    b. Any employee of the Agency in his or her official capacity, or
    c. Any employee of the Agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    d. The United States Government, is a party to litigation or has an 
interest in such litigation, and by careful review, CMS determines that 
the records are both relevant and necessary to the litigation and that 
the use of such records by the DOJ, court or adjudicatory body is 
compatible with the purpose for which the agency collected the records.
    6. To assist a CMS contractor (including, but not limited to fiscal 
intermediaries and carriers) that assists in the administration of a 
CMS-administered health benefits program, or to a grantee of a CMS-
administered grant program, when disclosure is deemed reasonably 
necessary by CMS to prevent, deter, discover, detect, investigate, 
examine, prosecute, sue with respect to, defend against, correct, 
remedy, or otherwise combat fraud, waste or abuse in such program.
    7. To assist another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that 
administers, or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    8. To assist appropriate Federal agencies and Department 
contractors that have a need to know the information for the purpose of 
assisting the Department's efforts to respond to a suspected or 
confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and necessary for the assistance.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are stored on both tape cartridges (magnetic storage media) 
and in a DB2 relational database management environment (DASD data 
storage media).

RETRIEVABILITY:
    Information is most frequently retrieved by provider number 
(facility, physician, IDs), service dates, and prescriber 
identification number.

SAFEGUARDS:
    CMS has safeguards in place for authorized users and monitors such 
users to ensure against unauthorized use. Personnel having access to 
the system have been trained in the Privacy Act and information 
security requirements. Employees who maintain records in this system 
are instructed not to release data until the intended recipient agrees 
to implement appropriate management, operational and technical 
safeguards sufficient to protect the confidentiality, integrity and 
availability of the information and information systems and to prevent 
unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: the Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also applies. Federal, HHS, and CMS policies and 
standards include but are not limited to: All pertinent National 
Institute of Standards and Technology publications; the HHS Information 
Systems Program Handbook and the CMS Information Security Handbook.

RETENTION AND DISPOSAL:
    Records are maintained with identifiers for all transactions after 
they are entered into the system for a period of 10 years. Records are 
housed in both active and archival files. All claims-related records 
are encompassed by the document preservation order and will be retained 
until notification is received from the Department of Justice.

SYSTEM MANAGER AND ADDRESS:
    Director, Office of E-Health Standards and Services, Centers for 
Medicare & Medicaid Services, 7500 Security Blvd, Mail-stop: S2-26-17, 
Baltimore, MD 21244-1850.

[[Page 73101]]

NOTIFICATION PROCEDURE:
    For purpose of notification, the subject individual should write to 
the system manager who will require the system name, and the retrieval 
selection criteria (e.g., Provider number, SSN, etc.).

RECORD ACCESS PROCEDURE:
    For purpose of access, use the same procedures outlined in 
Notification Procedures above. Requestors should also reasonably 
specify the record contents being sought. (These procedures are in 
accordance with Department regulation 45 CFR 5b.5(a)(2)).

CONTESTING RECORD PROCEDURES:
    The subject individual should contact the system manager named 
above, and reasonably identify the record and specify the information 
to be contested. State the corrective action sought and the reasons for 
the correction with supporting justification. (These procedures are in 
accordance with Department regulation 45 CFR 5b.7).

RECORD SOURCE CATEGORIES:
    Information in the National Level Repository will be populated from 
other CMS systems of records, including the Provider Enrollment, Chain, 
and Ownership System (PECOS) and the National Plan & Provider 
Enumeration System (NPPES).

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    None.
[FR Doc. 2010-29952 Filed 11-26-10; 8:45 am]
BILLING CODE 4120-01-P