Privacy Act of 1974: Report of New System of Records, 49237-49240 [2015-20224]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 80, Number 158 (Monday, August 17, 2015)]
[Notices]
[Pages 49237-49240]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-20224]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974: Report of New System of Records

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS)

ACTION: Notice of New System of Records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to establish a new SOR titled, ``CMS Risk 
Adjustment Suite of Systems (RASS),'' System No. 09-70-0508. Payments 
to Medicare Advantage (MA) organizations, Part D sponsors, and Program 
of All Inclusive Care for the Elderly (PACE) organizations 
(collectively referred to as ``MA organizations and other entities'') 
are adjusted based on the health status of enrolled Medicare 
beneficiaries (``enrollees''). RASS is established to receive, process, 
and store the data used

[[Page 49238]]

to risk-adjust payments based on enrollee health status. The data will 
be used specifically to develop risk adjustment models and to calculate 
the risk score for each enrollee.
    Each MA organization and other entity must submit data to CMS in 
accordance with CMS regulations and instructions. ``Risk adjustment 
data'' refers to data submitted in two separate formats: comprehensive 
data equivalent to Medicare fee-for-service data (often referred to as 
encounter data); and data in abbreviated formats (often referred to as 
RAPS data). The MA risk adjustment data addressed by this SOR includes 
RAPS data submitted by a MA organization in an abbreviated format, as 
referenced at Sec.  422.310(d)(1), and similar abbreviated risk 
adjustment data submitted by other MA organizations and other entities. 
Encounter data has a separate SOR (System No. 09-70-0506).

DATES: Effective 30 days after publication. Written comments should be 
submitted on or before the effective date. HHS/CMS/CM may publish an 
amended system of records notice (SORN) in light of any comments 
received.

ADDRESSES: The public should address comments to: CMS Privacy Officer, 
Division of Security, Privacy Policy & Governance, Information Security 
& Privacy Group, Office of Enterprise Information, CMS, 7500 Security 
Boulevard, Baltimore, MD 21244-1870, Mailstop: N1-24-08, Office: (410) 
786-5357, email: walter.stone@cms.hhs.gov. Comments received will be 
available for review at this location, by appointment, during regular 
business hours, Monday through Friday from 9 a.m.-3 p.m., Eastern Time 
zone.

FOR FURTHER INFORMATION CONTACT: Risk Adjustment Mailbox Coordinator, 
Division of Encounter Data and Risk Adjustment Operations, Medicare 
Plan Payment Group, Center for Medicare, CMS, Mail Stop C1-13-07, 7500 
Security Boulevard, Baltimore, Maryland 21244-1850. The email is 
Riskadjustment@cms.hhs.gov.

SUPPLEMENTARY INFORMATION: 

I. Background on the Risk Adjustment Suite of Systems (RASS)

    The new RASS system of records is being established to cover data 
used to create risk adjustment scores needed to risk-adjust payments to 
Medicare and Medicaid provider entities, based on beneficiary 
demographics and health status. Risk-adjusted payments will implement 
reformatory provisions of the Social Security Act at sections 1853(a), 
1860D-15(c), and 1894(d)(2) (42 U.S.C. 1395w-23, 1395w-115, and 
1395eee), intended to collect and accurately calculate scores based on 
a beneficiary's demographics and health status. RASS will cover data 
housed in two existing information systems: The Risk Adjustment 
Processing System (RAPS), and the Risk Adjustment System (RAS). RAS 
will contain data extracted from RAPS and from two other IT systems 
(CME and NMUD), as more fully explained below:
    [cir] RAPS will receive abbreviated current risk adjustment data, 
consisting of diagnosis data about each beneficiary and the 
beneficiary's health care provider type, submitted by the relevant 
payee entity through the Front-End Risk Adjustment System (FERAS); RAPS 
will use the data to create an enrollee diagnosis data file for each 
beneficiary (See Categories of Records for data elements).
    [cir] RAS will extract the enrollee diagnosis data files from RAPS 
and will receive current demographic, enrollment and diagnoses data and 
past medical history data for each enrollee from two other CMS systems 
(CME and NMUD); RAS will use the RAPS, CME, and NMUD data to calculate 
risk factors and create a Risk Adjustment Factor (RAF) file, containing 
the risk score of each beneficiary:
    [ssquf] Common Medicare Environment (CME): RAS will extract current 
individual demographic and enrollment data about each enrollee (See 
Categories of Records for data elements).
    [ssquf] National Claims History files housed in the National 
Medicare Utilization Database (NMUD): RAS will extract current Medicare 
Fee-for-service (FFS) diagnoses information submitted on Inpatient, 
Outpatient, and Physician claims for each enrollee (See Categories of 
Records for data elements).
    [cir] RAS will transmit the Risk Adjustment Factor (RAF) file 
created in RAS to CMS' payment processing system for purposes of 
calculating and adjusting payments to payee entities, as follows:
    [ssquf] CMS pays MA organizations on a monthly prospective amount 
for each beneficiary enrolled (enrollee) in a Part C plan.
    [ssquf] CMS pays Part D sponsors a monthly prospective amount that 
reflects the plan sponsor's estimate of the revenue needed to cover a 
plan's costs for the risk portion of basic prescription drug coverage. 
The direct subsidy is adjusted based on the beneficiary's risk score, 
which reflects expected prescription drug expenditures for the coverage 
year (relative to a national average of 1.0), based on demographic and 
health status information for that person.
    [ssquf] CMS pays PACE organizations a monthly capitation amount 
based on the Part A and Part B payment rates established for purposes 
of payment to Medicare Advantage organizations pursuant to 1894(d)(2). 
CMS will ensure that payments take into account the comparative frailty 
of PACE enrollees relative to the general Medicare population.
    In addition to providing the file used to calculate risk adjustment 
payments, the RASS also provides reports for CMS based on the analysis 
of RAF files and other criteria; these reports include MA plan file 
submission transactions (acceptance rates, rejection rates, error 
rates, etc.) on a daily, weekly, monthly, and quarterly basis.

II. The Privacy Act

    The Privacy Act governs the collection, maintenance, use, and 
dissemination of certain information about individuals by agencies of 
the Federal Government.
    A ``SOR'' is a group of any records under the control of a Federal 
agency from which information about individuals is retrieved by name or 
other personal identifier. The Privacy Act requires each agency to 
publish in the Federal Register notice of the existence and character 
of each SOR that the agency maintains. The System of Records Notice 
(SORN) identifies or describes the laws authorizing the system to be 
maintained; the types and sources of records in the system; the 
categories of individuals to whom the records pertain; the purposes for 
which the records are used within the agency; the routine uses for 
which a record maybe disclosed to parties outside the agency without 
the individual's prior, written consent; agency policies and procedures 
for safeguarding, storing, retrieving, accessing, retaining, and 
disposing of the records; the procedures for an individual to follow to 
make notification, access, and amendment requests to the System 
Manager; and whether the SOR is exempt from certain Privacy Act 
requirements.
System Number:
    09-70-0508

System Name:
    CMS Risk Adjustment Suite of Systems (RASS), HHS/CMS/CM.

Security Classification:
    Unclassified.

System Location:
    RASS (RAS/RAPS) Location: CMS Data Center, 7500 Security Boulevard, 
North Building, First Floor, Baltimore, Maryland 21244-1850.

[[Page 49239]]

Categories of Individuals Covered by the System:
    Information collected and maintained in this system pertains to: 
(1) Medicare beneficiaries enrolled in a Part C MA plan, MA-PD plan, 
PDP or PACE organization (``enrollees'') and (2) the health care 
provider(s), supplier(s), physician(s), or other practitioner(s) 
(``Providers'') who provide health care items and services to these 
enrollees.

Categories of Records in the System:
    The MA plans, MA-PDs, PDPs and PACE organizations (``MA 
organizations and other entities'') receive the data from the providers 
which is then submitted to RAPS via FERAS. The data received from the 
MA organizations and other entities are primarily diagnosis data 
extracted from claims information. Additional FFS and utilization data 
regarding those submissions are received from the CME and NCH data 
systems to complete the enrollee data requirements.
    Records will consist of the risk score for each enrollee and the 
data used to calculate the score, contained in Risk Adjustment Factor 
(RAF) files created in CMS' Risk Adjustment System (RAS), using data 
extracted from three other CMS IT systems:
     RAPS data: Diagnosis data files containing abbreviated 
current diagnosis data submitted by payee entities to CMS's Risk 
Adjustment Processing System (RAPS):
    [cir] Health Insurance Claim Number (HICN)
    [cir] Provider Type
    [cir] Service From Date
    [cir] Service Through Date
    [cir] Plan Number (MAO contract number)
    [cir] Diagnosis Code
    [cir] Diagnosis Delete Date
    [cir] RAS Diagnosis Indicator
    [cir] NCH Category Equitable BIC
    [cir] Accrete Data
    [cir] Delete Plan Number
    [cir] Submitter ID
    [cir] Daily File Code, and
    [cir] Delete File Code
     CME data: Current demographic and enrollment data from 
CMS's Common Medicare Environment (CME):
    [cir] Beneficiary Link Key Partition number
    [cir] Beneficiary Link Identifier
    [cir] Health Insurance Claim Number (HICN)
    [cir] Beneficiary Social Security Number
    [cir] Beneficiary Birth Date
    [cir] Beneficiary Death Date
    [cir] Beneficiary Sex Code
    [cir] Beneficiary Race Code
    [cir] Beneficiary First Name
    [cir] Beneficiary Middle Name
    [cir] Beneficiary Last Name
     NCH data: Current diagnosis data [and past medical history 
data] from National Claims History Files in CMS's National Medicare 
Utilization Database (NMUD):
    [cir] Health Insurance Claim Number (HICN)
    [cir] NCH Category Equitable BIC
    [cir] Diagnosis code
    [cir] Service Through Date
    [cir] Service From Date
    [cir] Beneficiary Link Identifier
    [cir] Provider Number

Authority for Maintenance of the System:
    This system was established pursuant to sections 1853(a), 1860D-
15(c), and 1894(d)(2)of the Social Security Act (42 U.S.C. 1395w-23, 
1395w-115, 1395eee).

Purpose(s) of the System:
    Records will be used within the agency to develop risk adjustment 
models and to calculate the risk score for each Medicare beneficiary 
enrolled in the Medicare health plan. The risk score will be reported 
to the system that CMS uses to process payments, and ultimately will be 
used to adjust payments to MA organizations, Part D sponsors, and PACE 
organizations, based on beneficiary health status. (Note that payment 
records are not covered under this system of records.)
    Information retrieved from this SOR will be used for the following 
purposes:
 To determine the risk adjustment factors used to adjust 
payments to MA organizations and other entities, as required under 42 
CFR 422.304(a) and (c), 423.329 and 460.180
 to update risk adjustment models
 to calculate Medicare Disproportionate Share Hospital (DSH) 
percentages
 to conduct quality review and improvement activities for 
Medicare coverage purposes
 to conduct evaluations and other analysis to support the 
Medicare program (including demonstrations)
 to support public health initiatives and other health care-
related research
 for activities to support the administration of the Medicare 
program
 for activities conducted to support program integrity
 for purposes authorized by applicable law

Routine Uses of Records Maintained in the System, Including Categories 
or Users and the Purposes of Such Uses:
    Records may be disclosed to parties outside HHS, without the 
individual record subject's prior, written consent, for the following 
purposes:
    1. To determine the risk adjustment factors used to adjust 
payments, as required under Sec. Sec.  422.304(a) and (c), 423.329, and 
460.180, to update risk adjustment models, to calculate Medicare DSH 
percentages, to conduct quality review and improvement activities, for 
Medicare coverage purposes, to conduct evaluations and other analysis 
to support the Medicare program (including demonstrations) and to 
support public health initiatives, for activities conducted to support 
program integrity, and for purposes authorized by applicable law.
    2. To support CMS contractors, consultants, or grantees that have 
been contracted by the Agency when necessary to assist in 
accomplishment of a CMS function relating to the purposes for this 
system or a purpose listed in paragraph 1.
    3. To support an individual or organization for research to support 
the Medicare program and public health initiatives, and otherwise 
related to health care, such as evaluation or epidemiological projects 
related to the prevention of disease or disability, the restoration or 
maintenance of health, or for understanding and improving payment 
projects.
    4. To provide information to the U.S. Department of Justice (DOJ), 
a court, or an adjudicatory body when (a) the Agency or any component 
thereof, or (b) any employee of the Agency in his or her official 
capacity, or (c) any employee of the Agency in his or her individual 
capacity where the DOJ has agreed to represent the employee, or (d) the 
United State Government, is a party to litigation or has an interest in 
such litigation, and by careful review, CMS determines that the records 
are both relevant and necessary to the litigation and that the use of 
such records by the DOJ, court, or adjudicatory body is compatible with 
the purpose for which the agency collected the records.
    5. To assist a CMS contractor (including, but not limited to 
Medicare Administrative Contractors, fiscal intermediaries, and 
carriers) that assists in the administration of a CMS-administered 
health benefits program, or to a grantee of a CMS-administered grant 
program, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud, waste or abuse in such program.
    6. To assist another Federal agency or an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that

[[Page 49240]]

administers or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    7. To assist Medicare Advantage organizations, Part D Sponsors and 
PACE organizations with improving the quality of required risk 
adjustment data obtained from the provider that furnished the item or 
service. CMS will be analyzing the data received and advising MA 
organizations, Part D Sponsors and PACE organizations of trends and 
data analysis results to help improve the accuracy and completeness of 
data received from the provider.
    8. To assist appropriate Federal agencies and CMS contractors and 
consultants that have a need to know the information for the purpose of 
assisting CMS' efforts to respond to a suspected or confirmed breach of 
the security or confidentiality of information maintained in this 
system of records, provided that the information disclosed is relevant 
and necessary for that assistance.

    Note:  CMS may disclose information from this system of records, 
without the individual record subject's consent, for any of the 
following purposes referenced directly in the Privacy Act: 5 U.S.C. 
552a(b)(1), (3)-(8), and (12). CMS must also disclose information 
from this system of records, without the individual record subject's 
consent, for any of the following purposes referenced directly in 
the Privacy Act: 5 U.S.C. 552a(b)(2), and (b)(9)-(11).

Additional Provisions Affecting Routine Use Disclosures:
    This system contains Protected Health Information (PHI) as defined 
by HHS regulation ``Standards for Privacy of Individually Identifiable 
Health Information'' (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), 
subparts A and E). Disclosures of PHI authorized by these routine uses 
may only be made if, and as, permitted or required by the ``Standards 
for Privacy of Individually Identifiable Health Information.''
    In addition, our policy will be to prohibit release even of data 
that is not directly identifiable, except if required by law, if we 
determine there is a possibility that an individual can be identified 
through implicit deduction based on small cell sizes (instances where 
the patient population is so small that individuals could, because of 
the small size, use this information to deduce the identity of the 
beneficiary).

    Note: Information collected or obtained under Sec.  1860D-15 
(i.e., risk adjustment data used to pay Part D plan sponsors) will 
be used and disclosed only in accordance with the statutory 
limitations under Sec.  1860D-15(f)(2).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEMStorage:
    Archived records will be stored on magnetic tapes. Data that is 
currently in use is stored in the RAPS database.

Retrievability:
    Records will be retrieved by National Provider Identifier (NPI), 
beneficiary provider name, or beneficiary Health Insurance Claim 
Number.

Safeguards:
    Personnel having access to the system have been trained in the 
Privacy Act and information security requirements. Employees who 
maintain records in this system are instructed not to release data 
until the intended recipient agrees to implement appropriate 
management, operational, and technical safeguards sufficient to protect 
the confidentiality, integrity and availability of the information and 
information systems; and to prevent unauthorized access. Access to 
records in the RASS will be limited to CMS personnel and contractors 
through password security, encryption, firewalls, and secured operating 
system(s).

Retention and Disposal:
    Records (i.e., enrollee diagnosis data files created in RAPS, and 
Risk Adjustment Factor (RAF) files created in RAS) will be maintained 
for a period of up to 10 years after date of creation. Any such records 
that are needed longer, such as to resolve claims and audit exceptions 
or to prosecute fraud, will be retained until such matters are 
resolved. Enrollee claims records are currently subject to a document 
preservation order and will be preserved indefinitely pending further 
notice from the U.S. Department of Justice (DOJ).

System Manager and Address:
    Director, Division of Encounter Data and Risk Adjustment 
Operations, Medicare Plan Payment Group, Center for Medicare, CMS, 7500 
Security Boulevard, Baltimore, Maryland 21244-1850.

Notification Procedure:
    Individuals (i.e., the beneficiary or provider) wishing to know if 
this system contains records about them should write to the system 
manager and include pertinent personally identifiable information 
(encrypted and properly transmitted) to be used for retrieval of their 
records (i.e., NPI or Health Insurance Claim Number).

Record Access Procedure:
    Individuals seeking access to records about them in this system 
should follow the same instructions indicated under ``Notification 
Procedure'' and reasonably specify the record content being sought. 
(These procedures are in accordance with Department regulation 45 CFR 
5b.5(a)(2)).

Contesting Record Procedures:
    Individuals seeking to contest the content of information about 
them in this system should follow the same instructions indicated under 
``Notification Procedure.'' The request should: reasonably identify the 
record and specify the information being contested; state the 
corrective action sought; and provide the reasons for the correction, 
with supporting justification. (These procedures are in accordance with 
Department regulation 45 CFR 5b.7.)

Record Source Categories:
    RASS processes data extracted from RAPS and RAS IT systems to 
calculate the risk scores used to adjust payments to Medicare Advantage 
organizations, Part D plan sponsors and PACE plans. RAS receives the 
most current data for each Medicare Part C and Part D beneficiary from 
the following sources: RAPS, Common Medicare Environment (CME) also 
known as Medicare Beneficiary Database (MBD/CME), and National Medicare 
Utilization Database (NMUD). RAPS receives risk adjustment data from MA 
organizations and other entities defined above.

Systems Exempted from Certain Provisions of the Act:
    None.

Celeste Dade-Vinson,
Health Insurance Specialist, Centers for Medicare & Medicaid Services.
[FR Doc. 2015-20224 Filed 8-14-15; 8:45 am]
 BILLING CODE 4120-03-P