Privacy Act of 1974; Report of a New System of Records, 21373-21378 [2011-9105]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 76, Number 73 (Friday, April 15, 2011)]
[Notices]
[Pages 21373-21378]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-9105]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Report of a New System of Records

AGENCY: Center for Consumer Information and Insurance Oversight 
(CCIIO), Centers for Medicare and Medicaid Services (CMS), Department 
of Health and Human Services (HHS).

ACTION: Notice of a new Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, the Centers for Medicare and Medicaid Services (CMS), Center for 
Consumer Information and Insurance Oversight (CCIIO) is establishing a 
new system of records (SOR) titled the ``Health Insurance Assistance 
Database (HIAD),'' System No. 09-70-0586. This SOR is established under 
the authority of Sections 2719, 2723, and 2761 of the Public Health 
Service Act (PHS Act) (Public Law (Pub. L.) 97-35) and Sec.  1321(c) of 
the Patient Protection and Affordable Care Act (Affordable Care Act) 
(Pub. L. 111-148). Section 1321(c) of the Affordable Care Act 
authorizes HHS (1) to ensure that States with Exchanges are 
substantially enforcing the Federal standards to be set for the 
Exchanges and (2) to set up Exchanges in States that elect not to do so 
or are not substantially enforcing related provisions. Sections 2723 
and 2761 of the PHS Act authorize HHS to enforce provisions that apply 
to non-Federal governmental plans and to enforce PHS Act provisions 
that apply to other health insurance coverage in States that HHS has 
determined are not substantially enforcing those provisions. The HIAD 
database will be maintained by the Office of Consumer Support Health 
Insurance Assistance Team (the Team) to assist the Office of Oversight 
with its compliance activities. HIAD is the primary tool through which 
the Team will track information for the purposes of oversight.
    The primary purpose of this system is to collect and maintain 
information on consumer inquiries and complaints regarding insurance 
issuers that will permit CCIIO to exercise its direct enforcement 
authority over non-Federal governmental health plans, investigate any 
inquiries or complaints from enrollees of those plans, to determine 
which States may not be substantially enforcing the Affordable Care Act 
and PHS Act provisions and to determine whether complaints that 
indicate

[[Page 21374]]

possible noncompliance with Federal law are resolved by the plans. In 
addition, information maintained will enable CCIIO to develop aggregate 
reports that will inform CMS and HHS about compliance issues. 
Information in this system will also be disclosed to: (1) Support 
regulatory and programmatic activities such as investigations and 
reporting activities performed by an Agency contractor, consultants, 
CMS grantees, student volunteers, interns and other workers who do not 
have the status of Federal employees; (2) assist another Federal and/or 
State agency, agency of a State government, or an agency established by 
State law; (3) support litigation involving the Agency; (4) combat 
fraud, waste, and abuse in certain health benefits programs, and (5) 
assist in a response to a suspected or confirmed breach of the security 
or confidentiality of information. We have provided background 
information about this new system in the SUPPLEMENTARY INFORMATION 
section below. Although the Privacy Act requires only that CMS provide 
an opportunity for interested persons to comment on the proposed 
routine uses, CMS invites comments on all portions of this notice. See 
``Effective Dates'' section for information about the comment period.

DATES: Effective Dates: CMS filed a new system report with the Chair of 
the House Committee on Government Reform and Oversight, the Chair of 
the Senate Committee on Homeland Security & Governmental Affairs, and 
the Administrator, Office of Information and Regulatory Affairs, Office 
of Management and Budget (OMB) on April 11, 2011. To ensure that all 
parties have adequate time in which to comment, the new system, 
including routine uses, will become effective 30 days from the 
publication of the notice, or 40 days from the date it was submitted to 
OMB and Congress, whichever is later, unless CMS receives comments that 
require alterations to this notice.

ADDRESSES: The public should address comments to: CMS Privacy Officer, 
Division of Information Security and Privacy Management, Enterprise 
Architecture and Strategy Group, Office of Information Services, CMS, 
Room N1-24-08, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. 
Comments received will be available for review at this location, by 
appointment, during regular business hours, Monday through Friday from 
9 a.m.-3 p.m., eastern time zone.

FOR FURTHER INFORMATION CONTACT: Mr. Paul Tibbits, Team Leader, Health 
Insurance Assistance Team, Office of Consumer Support, Center for 
Consumer Information and Insurance Oversight, Centers for Medicare and 
Medicaid Services, 7500 Security Boulevard, Baltimore, Maryland 21244. 
His telephone number is 301-492-4229 or via e-mail at 
paul.tibbits@hhs.gov.

SUPPLEMENTARY INFORMATION: CCIIO has direct enforcement authority over 
non-Federal governmental health plans, and any inquiries or complaints 
from enrollees of those plans will be logged into this database for the 
purpose of following up to determine whether complaints that indicate 
possible noncompliance with Federal law are resolved by the plans. In 
addition, consumer inquiries and complaints regarding insurance issuers 
will be logged into the database in order to help CCIIO determine which 
States may not be substantially enforcing Affordable Care Act and PHS 
Act provisions, and, in the event Federal enforcement is necessary, in 
order to follow up to determine whether complaints that indicate 
possible noncompliance with Federal law are resolved by the issuers.
    Section 1321(c) of the Affordable Care Act authorizes HHS (1) to 
ensure that States with Exchanges are substantially enforcing the 
Federal standards to be set for the Exchanges and (2) to set up 
Exchanges in States that elect not to do so or are not substantially 
enforcing related provisions. Sections 2723 and 2761 of the PHS Act 
authorize HHS to enforce PHS Act provisions that apply to non-Federal 
governmental plans and to enforce PHS Act provisions that apply to 
other health insurance coverage in States that HHS has determined are 
not substantially enforcing those provisions.
    The database will be maintained by the Team to help CCIIO Office of 
Oversight with its compliance activities under the Affordable Care Act 
and PHS Act. Consumer inquiries and complaints addressed by the Team 
will help CCIIO conduct direct enforcement over non-Federal 
governmental health plans; the database will also help CCIIO determine 
which States are not substantially enforcing PHS Act provisions under 
HHS's Federal fallback authority in sections 2723 and 2761 of the PHS 
Act.
    In the course of its work, the Team will: (1) Receive consumer 
inquiries; (2) respond to consumer inquiries in order to obtain the 
necessary information to determine the best course of action; (3) refer 
consumers to appropriate entities; and (4) when appropriate, gather 
information about consumers in order to assist CCIIO oversight 
capacity.
    When responding to consumer contacts, the Team will pursue one of 
the following courses of action: (1) If it is determined that the 
consumer is covered by a non-Federal governmental plan, the Team will 
obtain enough information to determine whether the case merits referral 
to the Office of Oversight; (2) if it is determined that jurisdiction 
over a consumer's case lies with another entity, the Team will refer 
consumers to that entity, such as a State insurance department, the 
U.S. Department of Labor, or a State Consumer Assistance Program; or 
(3) if it is determined that the consumer seeks to file an appeal in a 
State or territory without an external appeals process in place, the 
Team will refer the consumer to the appropriate entity carrying out the 
Federal external appeals process.
    As mentioned, the system will be used to create reports regarding 
the types of consumer inquiries and Affordable Care Act and PHS Act 
compliance issues that are brought to the attention of CCIIO by 
consumers. These reports will assist the Office of Oversight in 
identifying areas where compliance concerns may arise, and will be 
stripped of any information in identifiable form (IIF) and personal 
health information when written and prepared.

I. Description of the Proposed System of Records

A. Statutory and Regulatory Basis for System

    Authority for the collection, maintenance, and disclosures from 
this system is provided under provisions of Sec. Sec.  2719, 2723, and 
2761 of the Public Health Service Act (PHS Act) (Pub. L. 97-35) and 
Sec.  1321(c) of the Patient Protection and Affordable Care Act 
(AFFORABLE CARE ACT) (Pub. L. 111--148).

B. Collection and Maintenance of Data in the System

    The Health Insurance Assistance Database (HIAD) contains 
information on individuals who contact CCIIO's Health Insurance 
Assistance Team, complainants or other individuals with health 
insurance issues. The HIAD contains the name, address, State of 
residence and zip code; contact information such as telephone numbers, 
e-mail address, demographic information such as age, gender, ethnicity, 
family status, employment status, income level and veteran's status; 
and health insurance identification number, health insurance status, 
background, recent history and available options.

[[Page 21375]]

II. Agency Policies, Procedures, and Restrictions on Routine Uses

    A. The Privacy Act permits us to disclose information without an 
individual's consent if the information is to be used for a purpose 
that is compatible with the purpose(s) for which the information was 
collected. Any such disclosure of data is known as a ``routine use.'' 
The government will only release information collected in the HIAD that 
can be associated with an individual as provided for under ``Section 
III. Proposed Routine Use Disclosures of Data in the System.'' 
Identifiable data may be disclosed under a routine use.
    CMS has the following policies and procedures concerning 
disclosures of information that will be maintained in the system. In 
general, disclosure of information from the system will be approved 
only for the minimum information necessary to accomplish the purpose of 
the disclosure and only after CMS:
    1. Determines that the use or disclosure is consistent with the 
reason that the data is being collected, e.g., to collect, maintain, 
and process information on consumer inquiries and complaints regarding 
insurance issuers that will permit CCIIO to exercise its direct 
enforcement authority over non-Federal governmental health plans, if 
CMS;
    2. Determines that:
    a. the purpose of the disclosure can only be accomplished if the 
record is provided in an individually identifiable form;
    b. the purpose for which the disclosure is to be made is of 
sufficient importance to warrant the effect and/or risk on the privacy 
of the individual provider that additional exposure of the record might 
bring; and
    c. there is a strong probability that the proposed use of the data 
would in fact accomplish the stated purpose(s).
    3. Requires the information recipient to:
    a. establish administrative, technical, and physical safeguards to 
prevent unauthorized use of disclosure of the record;
    b. remove or destroy at the earliest time all individually 
identifiable information; and
    c. agree to not use or disclose the information for any purpose 
other than the stated purpose under which the information was 
disclosed.
    4. Determines that the data are valid and reliable.

III. Proposed Routine Use Disclosures of Data in the System

A. Entities Who May Receive Disclosure Under Routine Use

    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the HIAD without the consent of the individual 
to whom such information pertains. Each proposed disclosure of 
information under these routine uses will be evaluated to ensure that 
the disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected. We propose to 
establish the following routine use disclosures of information 
maintained in the system:
    1. To support Agency contractors, consultants, CMS grantees, 
student volunteers, interns and other workers who do not have the 
status of Federal employees, and who have been engaged by the Agency to 
assist in accomplishment of a CMS function relating to the purposes for 
this SOR and who need to have access to the records in order to assist 
CMS.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contractual or similar 
agreement with a third party to assist in accomplishing a CMS function 
relating to purposes for this SOR.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor, consultant, CMS grantees, student 
volunteers, interns and other workers who do not have the status of 
Federal employees whatever information is necessary for the contractor 
or consultant to fulfill its duties. In these situations, safeguards 
are provided in the contract prohibiting the contractor, consultant, 
CMS grantees, student volunteers, interns and other workers who do not 
have the status of Federal employees from using or disclosing the 
information for any purpose other than that described in the contract 
and requires the contractor, consultant, CMS grantees, student 
volunteers, interns and other workers who do not have the status of 
Federal employees to return or destroy all information at the 
completion of the contract.
    2. To assist another Federal or State agency, agency of a State 
government, or an agency established by State law pursuant to 
agreements with CMS to:
    a. Increase consumer assistance and accessibility to health care 
coverage by identifying insurer noncompliance with Federal, State and 
other applicable law, and
    b. Assist Federally funded health insurance programs in 
administering functions tasked to them pursuant to the Affordable Care 
Act and other relevant Federal and State laws which may require CCIIO 
Program information related to this system.
    c. Assist other Federal/State agencies that have the authority to 
perform collection of debts owed to the Federal government.
    State Departments of Insurance can achieve greater regulation and 
oversight of the health insurance industry and strengthen enforcement 
in areas where problems arise by identifying trends and patterns in 
consumer inquiries and complaints.
    The Internal Revenue Service (IRS), Department of the Treasury, can 
use CCIIO information for the purpose of resolving difficulties with 
obtaining premium tax credits under 36B of the Internal Revenue Code 
(IRC) of 1986 and to understand the consumer needs leading to the State 
health insurance Exchanges starting in 2014.
    Federal, State, and local law enforcement agencies and private 
security contractors, may require CCIIO information to protect CCIIO 
employees and customers, provide security for CCIIO facilities or to 
assist investigations or prosecutions with respect to activities that 
affect such safety and security or activities that disrupts the 
operation of CCIIO operations and facilities.
    3. To support the Department of Justice (DOJ), court, or 
adjudicatory body when:
    a. the Agency or any component thereof, or
    b. any employee of the Agency in his or her official capacity, or
    c. any employee of the Agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    d. the United States Government,

is a party to litigation or has an interest in such litigation, and by 
careful review, HHS determines that the records are both relevant and 
necessary to the litigation and that the use of such records by the 
DOJ, court or adjudicatory body is compatible with the purpose for 
which the agency collected the records.
    Whenever HHS is involved in litigation, or occasionally when 
another party is involved in litigation and HHS's policies or 
operations could be affected

[[Page 21376]]

by the outcome of the litigation, HHS would be able to disclose 
information to the DOJ, court, or adjudicatory body involved.
    4. To assist a CMS contractor (including, but not limited to 
Medicare Administrative Contractors, fiscal intermediaries, and 
carriers) that assists in the administration of a CMS-administered 
health benefits program, or to a grantee of a CMS-administered grant 
program, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud, waste or abuse in such program.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contract or grant with a 
third party to assist in accomplishing CMS functions relating to the 
purpose of combating fraud, waste or abuse.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor or grantee whatever information is necessary 
for the contractor or grantee to fulfill its duties. In these 
situations, safeguards are provided in the contract prohibiting the 
contractor or grantee from using or disclosing the information for any 
purpose other than that described in the contract and requiring the 
contractor or grantee to return or destroy all information.
    5. To assist another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any State or local governmental agency), that 
administers, or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    Other agencies may require CCIIO Program information for the 
purpose of combating fraud, waste or abuse in such Federally-funded 
programs.
    6. To assist appropriate Federal agencies and Department 
contractors that have a need to know the information for the purpose of 
assisting the Department's efforts to respond to a suspected or 
confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and unnecessary for the assistance.
    Other Federal agencies and contractors may require CCIIO Program 
information for the purpose of assisting in a respond to a suspected or 
confirmed breach of the security or confidentiality of information.

IV. Safeguards

    CMS has safeguards in place for authorized users and monitors such 
users to ensure against unauthorized use. Personnel having access to 
the system have been trained in the Privacy Act and information 
security requirements. Employees who maintain records in this system 
are instructed not to release data until the intended recipient agrees 
to implement appropriate management, operational and technical 
safeguards sufficient to protect the confidentiality, integrity and 
availability of the information and information systems and to prevent 
unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: the Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the Health Insurance Portability and 
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also applies. Federal, HHS, and CMS policies and 
standards include but are not limited to: all pertinent National 
Institute of Standards and Technology publications; the HHS Information 
Systems Program Handbook and the CMS Information Security Handbook.

V. Effects of the New System on the Rights of Individuals

    CMS proposes to establish this system in accordance with the 
principles and requirements of the Privacy Act and will collect, use, 
and disseminate information only as prescribed therein. We will only 
disclose the minimum personal data necessary to achieve the purpose of 
the data collection and the routine uses contained in this notice. 
Disclosure of information from the system will be approved only to the 
extent necessary to accomplish the purpose of the disclosure. CMS has 
assigned a higher level of security clearance for the information 
maintained in this system in an effort to provide added security and 
protection of data in this system.
    CMS will take precautionary measures to minimize the risks of 
unauthorized access to the records and the potential harm to individual 
privacy or other personal or property rights. CMS will collect only 
that information necessary to perform the system's functions. In 
addition, CMS will make disclosure from the proposed system only with 
consent of the subject individual, or his/her legal representative, or 
in accordance with an applicable exception provision of the Privacy 
Act. CMS, therefore, does not anticipate an unfavorable effect on 
individual privacy as a result of the disclosure of information 
relating to individuals.

    Dated: March 18, 2011.
Steve Larsen,
Director, Center for Consumer Information and Insurance Oversight, 
Centers for Medicare & Medicaid Services.

SYSTEM NUMBER:
    09-70-0586.

SYSTEM NAME:
    ``Health Insurance Assistance Database'' (HIAD), HHS/CMS/CCIIO.

SECURITY CLASSIFICATION:
    Level Three Privacy Act Sensitive.

SYSTEM LOCATION:
    CMS Data Center, 7500 Security Boulevard, North Building, First 
Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.
    Center for Consumer Information and Insurance Oversight, Centers 
for Medicare and Medicaid Services, U.S. Department of Health & Human 
Services, Triple-I Core Site, 12100 Sunrise Valley Drive, Reston, 
Virginia 20191.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Information in this system is maintained on individuals who contact 
the CCIIO Health Insurance Assistance Team, complainants or other 
individuals with health insurance issues.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The HIAD contains the name, address, State of residence and zip 
code; contact information such as telephone numbers, e-mail address, 
demographic information such as age, gender, ethnicity, family status, 
employment status, income level and veteran's

[[Page 21377]]

status; and health insurance identification number, health insurance 
status, background, recent history and available options.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for the collection, maintenance, and disclosures from 
this system is provided under provisions of Sec. Sec.  2719, 2723, and 
2761 of the Public Health Service Act (PHS Act) (Public Law (Pub. L.) 
97-35) and Sec.  1321(c) of the Patient Protection and Affordable Care 
Act (Affordable Care Act) (Pub. L. 111-148).

PURPOSE(S) OF THE SYSTEM:
    The primary purposes of this system is to collect and maintain 
information on consumer inquiries and complaints regarding insurance 
issuers that will permit CCIIO to exercise its direct enforcement 
authority over non-Federal governmental health plans, investigate any 
inquiries or complaints from enrollees of those plans, to determine 
which States may not be substantially enforcing the Affordable Care Act 
and PHS Act provisions and to determine whether complaints that 
indicate possible noncompliance with Federal law are resolved by the 
plans. In addition, information maintained will enable CCIIO to develop 
aggregate reports that will inform CMS and HHS about compliance issues. 
Information in this system will also be disclosed to: (1) Support 
regulatory and programmatic activities such as investigations and 
reporting activities performed by an Agency contractor, consultants, 
CMS grantees, student volunteers, interns and other workers who do not 
have the status of Federal employees; (2) assist another Federal and/or 
State agency, agency of a State government, or an agency established by 
State law; (3) support litigation involving the Agency; (4) combat 
fraud, waste, and abuse in certain health benefits programs, and (5) 
assist in a response to a suspected or confirmed breach of the security 
or confidentiality of information.

I. PROPOSED ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING 
CATEGORIES OR USERS AND THE PURPOSES OF SUCH USES:
    B. Entities Who May Receive Disclosure Under Routine Use
    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the HIAD without the consent of the individual 
to whom such information pertains. Each proposed disclosure of 
information under these routine uses will be evaluated to ensure that 
the disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected. We propose to 
establish the following routine use disclosures of information 
maintained in the system:
    3. To support Agency contractors, consultants, CMS grantees, 
student, volunteers, interns and other workers who do not have the 
status of Federal employees, who have been engaged by the Agency to 
assist in accomplishment of a CMS function relating to the purposes for 
this SOR and who need to have access to the records in order to assist 
CMS.
    4. To assist another Federal or State agency, agency of a State 
government, or an agency established by State law pursuant to 
agreements with CMS to:
    a. Increase consumer assistance and accessibility to health care 
coverage by identifying insurer noncompliance with Federal, State and 
other applicable law, and
    b. Assist Federally funded health insurance programs in 
administering functions tasked to them pursuant to the Affordable Care 
Act and other relevant Federal and State laws which may require CCIIO 
Program information related to this system.
    c. Assist other Federal/State agencies that have the authority to 
perform collection of debts owed to the Federal government.
    5. To support the Department of Justice (DOJ), court, or 
adjudicatory body when:
    e. The Agency or any component thereof, or
    f. Any employee of the Agency in his or her official capacity, or
    g. Any employee of the Agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    h. The United States Government,
    is a party to litigation or has an interest in such litigation, and 
by careful review, CMS determines that the records are both relevant 
and necessary to the litigation and that the use of such records by the 
DOJ, court or adjudicatory body is compatible with the purpose for 
which the agency collected the records.
    6. To assist a CMS contractor (including, but not limited to 
Medicare Administrative Contractors, fiscal intermediaries, and 
carriers) that assists in the administration of a CMS-administered 
health benefits program, or to a grantee of a CMS-administered grant 
program, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud, waste or abuse in such program.
    7. To assist another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any State or local governmental agency), that 
administers, or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    8. To assist appropriate Federal agencies and Department 
contractors that have a need to know the information for the purpose of 
assisting the Department's efforts to respond to a suspected or 
confirmed breach of the security or confidentiality of information 
maintained in this system of records, and the information disclosed is 
relevant and unnecessary for the assistance.

II. SAFEGUARDS:
    CMS has safeguards in place for authorized users and monitors such 
users to ensure against unauthorized use. Personnel having access to 
the system have been trained in the Privacy Act and information 
security requirements. Employees who maintain records in this system 
are instructed not to release data until the intended recipient agrees 
to implement appropriate management, operational and technical 
safeguards sufficient to protect the confidentiality, integrity and 
availability of the information and information systems and to prevent 
unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: The Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the Health Insurance Portability and 
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also

[[Page 21378]]

applies. Federal, HHS, and CMS policies and standards include but are 
not limited to: all pertinent National Institute of Standards and 
Technology publications; the HHS Information Systems Program Handbook 
and the CMS Information Security Handbook.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are maintained electronically in the CCIIO developed 
database for collection, tracking and storage of casework information 
and for reporting purposes. Any manually maintained records will be 
kept in locked cabinets or otherwise secured areas.

RETRIEVABILITY:
    The records are retrieved electronically by a variety of fields, 
including but not limited to name, State, zip code, and health 
insurance identification number issued to the individual.

RETENTION AND DISPOSAL:
    Records are maintained with identifiers for all transactions after 
they are entered into the system for a period of 10 years. Records are 
housed in both active and archival files. All claims-related records 
are encompassed by the document preservation order and will be retained 
until notification is received from the Department of Justice.

SYSTEM MANAGER(S) AND ADDRESS:
    Team Lead, Health Insurance Assistance Team, Office of Consumer 
Support, Center for Consumer Information and Insurance Oversight, 
Centers for Medicare and Medicaid Services, 7500 Security Boulevard, 
Baltimore, Maryland 21244.

NOTIFICATION PROCEDURE:
    For purpose of notification, the subject individual should write to 
the system manager who will require the system name and the retrieval 
selection criteria (e.g., name, health insurance claim number, SSN, 
etc.).

RECORD ACCESS PROCEDURE:
    For purpose of access, use the same procedures outlined in 
Notification Procedures above. Requestors should also reasonably 
specify the record contents being sought. (These procedures are in 
accordance with Department regulation 45 CFR 5b.5(a)(2)).

CONTESTING RECORD PROCEDURES:
    The subject individual should contact the system manager named 
above, and reasonably identify the record and specify the information 
to be contested. State the corrective action sought and the reasons for 
the correction with supporting justification. (These procedures are in 
accordance with Department regulation 45 CFR 5b.7).

RECORD SOURCE CATEGORIES:
    The identifying information contained in these records is provided 
voluntarily by the individual consumers, confidential informants, or by 
reports received from other sources . Additional case-relevant 
information may also be provided by the individual's employer or 
insurer to assist in achieving resolution of the specific case.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    None.

[FR Doc. 2011-9105 Filed 4-14-11; 8:45 am]
BILLING CODE 4120-03-P