Privacy Act of 1974; System of Records Notice, 63562-63564 [2015-26631]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 80, Number 202 (Tuesday, October 20, 2015)]
[Notices]
[Pages 63562-63564]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-26631]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary


Privacy Act of 1974; System of Records Notice

AGENCY: Office of the Secretary (OS), Department of Health and Human 
Services (HHS).

ACTION: Notice to establish a new Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, as amended (5 U.S.C. 552a), the Office of Medicare Hearings and 
Appeals (OMHA) within the Office of the Secretary of Health and Human 
Services (HHS) is establishing a new system of records, System No. 09-
90-1501, entitled ``Administrative Law Judge (ALJ) Working File, Office 
of Medicare Hearings and Appeals,'' to cover OMHA ALJ working files 
previously maintained as part of the Social Security Administration's 
(SSA) ALJ Working File system of records 60-0005 (last published at 74 
FR 19617). The working files covered under new System of Records Notice 
(SORN) 09-90-1501 are created and used by OMHA ALJs and members of 
their staffs for internal purposes, to document actions taken by OMHA 
at the hearing level in each Medicare appeal case that OMHA reviews. 
The working files are separate from the official case files, which are 
covered under other SORNs (i.e., HHS SORN 09-70-0566 covers case files 
on Medicare claims appeals, and SSA SORN 60-0089 covers case files on 
Medicare entitlement appeals).

DATES: This system notice is effective immediately, with the exception 
of the routine uses. The routine uses will be effective 30 days after 
publication, unless HHS receives comments that warrant a revision to 
this Notice.

ADDRESSES: Send public comments by mail or email to: Andrea Monson, 
Director, Division of Information Management and Systems, 1700 North 
Moore Street, Suite 1800, Arlington, VA 22209, 703-235-0635, 
andrea.monson@hhs.gov. Comments will be available for public inspection 
and copying at the above location.

FOR FURTHER INFORMATION CONTACT: Andrea Monson, Director, Division of 
Information Management and Systems, 1700 North Moore Street, Suite 
1800, Arlington, VA 22209, 703-235-0635, andrea.monson@hhs.gov.

SUPPLEMENTARY INFORMATION:

I. Background on New System of Records

    The Medicare claims appeals process consists of four levels of 
administrative review within HHS, and a fifth level of review with the 
federal district courts after administrative remedies within HHS have 
been exhausted. The first two levels of review are administered by the 
Centers for Medicare & Medicaid Services (CMS) and conducted by 
Medicare contractors. The third level of review is administered by OMHA 
and is conducted by ALJs. Subsequent reviews are conducted at the 
fourth level of appeal within the Departmental Appeals Board (DAB), and 
at the fifth level by the federal district courts.
    The Medicare entitlement and premium appeals process consists of 
three levels of administrative review, and a fourth level of review 
with the federal district courts after administrative remedies have 
been exhausted. The first level is the reconsideration level conducted 
by SSA. The second level of review is administered by OMHA and is 
conducted by ALJs. Subsequent reviews are conducted at the third level 
of appeal within the DAB and at the fourth level by the federal 
district courts.
    The Department established OMHA in June, 2005, pursuant to section 
931 of the Medicare Prescription Drug, Improvement, and Modernization 
Act of 2003 (Pub. L. 108-173) (MMA), which required the transfer of 
responsibility for the ALJ hearing function of the Medicare claims and 
entitlement appeals process from SSA to HHS. The MMA requires a unified 
case tracking system that facilitates the maintenance and transfer of 
case-specific data across both the fee-for-service and managed care 
components of the Medicare program. HHS' CMS operates the unified case 
tracking system required by MMA, which is covered by CMS System of 
Record Notice No. 09-70-0566, entitled ``Medicare Appeals System'' (MAS 
SORN).
    OMHA's adjudication process uses a ``case file'' comprising the 
official agency record, and an ALJ working file. The case file will 
continue to be covered by CMS' MAS SORN for Medicare claims appeals. 
The case file for Medicare entitlement and premium appeals will 
continue to be covered by the SSA Claims Folders System, Social 
Security Administration Claims Folders System, Social Security 
Administration, Office of the General Counsel, Office of Public 
Disclosure (60-0089). The case file is used throughout the 
administrative appeals process by the various levels of review.
    Only OMHA's ALJ working files will now be covered in the new system 
of records established by this Notice, to reflect that they are used 
only by OMHA.

II. The Privacy Act

    The Privacy Act (5 U.S.C. 552a) governs the means by which the U.S. 
Government collects, maintains, and uses information about individuals 
in a system of records. A ``system of records'' is a group of any 
records under the control of a federal agency from

[[Page 63563]]

which information about an individual is retrieved by the individual's 
name or other personal identifier. The Privacy Act requires each agency 
to publish in the Federal Register a system of records notice (SORN) 
identifying and describing each system of records the agency maintains, 
including the purposes for which the agency uses the information about 
individuals in the system, the routine uses for which the agency 
discloses such information outside the agency, and how individual 
record subjects can exercise their rights under the Privacy Act (for 
example, to seek access to their records in the system).

SYSTEM NUMBER: 09-90-1501
SYSTEM NAME:
    Administrative Law Judge (ALJ) Working File, Office of Medicare 
Hearings and Appeals (OMHA).

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    Records are maintained at OMHA headquarters and field offices. 
Address information is available by accessing the OMHA Web site: https://www.hhs.gov/omha/. Electronic records will be stored in a secured, 
FedRAMP-compliant, cloud service provider. Source documents will be 
destroyed once they are scanned and converted to electronic records.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Records pertain to individuals involved in Medicare appeals 
adjudicated by OMHA, including Medicare beneficiaries or enrollees; 
physicians; providers; practitioners; suppliers; State Medicaid 
agencies; other individuals involved in furnishing items and services 
to health insurance beneficiaries or enrollees; and authorized or 
appointed representatives of such individuals.

CATEGORIES OF RECORDS IN THE SYSTEM:
    OMHA administers nationwide ALJ hearings for appeals of Medicare 
Part A and Part B claim determinations, Part C organization 
determinations, Part D coverage determinations that are made by CMS 
contractors, and appeals of Medicare entitlement and monthly premium 
determinations made by SSA.
    OMHA establishes ALJ working files as a record of actions taken on 
each particular appeal. The file may contain copies of information from 
the administrative record, such as the request for hearing, hearing 
recording, notice of hearing, decision, and exhibit list, as well as 
copies of post-adjudicative material received and any responses made. 
Official copies of these materials are placed in the official agency 
record (case file). The ALJ working file also may contain deliberative 
working papers such as notes taken during the hearing by the ALJ; case 
analyses prepared by field office employees; attorney work product; 
working papers of field office staff; and other case developmental and 
decision-related notes and instructional sheets. Information in these 
records that could pertain to individuals includes protected health 
information; Health Insurance Claim Number (HICN); Social Security 
Number (SSN); Provider Number, name, address, and other contact 
information; and billing, tax, and other financial information.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for maintenance of the system is given under Sec.  205 of 
Title II, Sec. Sec.  1155 and 1156 of Title XI, Sec. Sec.  1812, 1814, 
1816, 1842, 1869, and 1872 of Title XVIII of the Social Security Act 
(the Act), as amended (42 United States Code (U.S.C.) sections 405, 
1320c-4, 1320c-5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 1395ii). 
Additional authority for this system is given under Title IX, Subtitle 
D of the Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003 (Public Law (Pub. L.) 108-173).

PURPOSE(S):
    OMHA uses the records in this system of records to reference the 
actions OMHA takes in a particular case at the hearing level. For 
example, during the course of adjudication at the ALJ hearing level, 
ALJs and members of their staff often construct documents for internal 
purposes only regarding the evidence, testimony, legal theories, merits 
of the case, and opinions and advice regarding other factors involved 
in the case.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM OF RECORDS, INCLUDING 
CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
    Relevant information about an individual may be disclosed from this 
system of records to parties outside HHS, without the individual's 
prior, written consent, pursuant to these routine uses.
    Note: Any information defined as ``return or return information'' 
under 26 U.S.C. 6103 of the Internal Revenue Code (IRC) will not be 
disclosed unless authorized by the IRC, the Internal Revenue Service 
(IRS), or IRS regulations.
    1. To a Member of Congress or to a Congressional staffer in 
response to a written inquiry of the Congressional office made at the 
written request of the constituent about whom the record is maintained. 
The Member of Congress does not have any greater authority to obtain 
records than the individual would have if requesting the records 
directly.
    2. To the Department of Justice (DOJ), a court or other tribunal, 
or another party before such tribunal, when:
    (a) HHS or any component thereof; or
    (b) any HHS employee in his or her official capacity; or
    (c) any HHS employee in his or her individual capacity where DOJ 
(or HHS where it is authorized to do so) has agreed to represent the 
employee; or
    (d) the United States Government,
    is a party to litigation or has an interest in such litigation and, 
by careful review, HHS determines that the records are both relevant 
and necessary to the litigation and that, therefore, the use of such 
records by DOJ, the court or other tribunal, or another party before 
such tribunal is deemed by HHS to be compatible with the purpose for 
which HHS collected the records.
    3. To IRS, as necessary, for the purpose of auditing HHS's 
compliance with safeguard provisions of the IRC, as amended.
    4. To contractors and other federal agencies that have been engaged 
by HHS to assist in accomplishment of an HHS function relating to the 
purposes of the system of records and that have a need to have access 
to the records in order to assist HHS in performing the activity. Any 
contractor will be required to comply with the requirements of the 
Privacy Act of 1974.
    5. To the National Archives and Records Administration (NARA) in 
records inspections conducted under the authority of 44 U.S.C. 2901 et 
seq.
    6. To student volunteers and other workers performing functions for 
HHS but technically not having the status of agency employees, if they 
need access to the records in order to perform their assigned 
functions.
    7. To federal, state, and local law enforcement agencies and 
private security contractors, as appropriate, if information is 
necessary
    (a) to enable them to protect the safety of HHS employees and 
customers, the security of the HHS workplace, and the operation of HHS 
facilities; or
    (b) to assist investigations or prosecutions with respect to 
activities that affect such safety and security or activities that 
disrupt the operation of HHS facilities.
    8. To appropriate federal agencies and Department contractors that 
have a need to know the information for the purpose

[[Page 63564]]

of assisting the Department's efforts to respond to a suspected or 
confirmed breach of the security or confidentiality of information 
maintained in this system of records, when the information disclosed is 
relevant and necessary for that assistance.
    Information about an individual may also be disclosed to parties 
outside HHS without the individual's prior, written consent for any of 
the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) 
and (b)(4)-(11).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM--
    STORAGE: Records are maintained in electronic and paper form. 
Currently, OMHA headquarters and field offices keep ALJ working files 
in paper form. New technology will allow OMHA to store information 
electronically in the Electronic Case Adjudication and Processing 
Environment (ECAPE). As a result, records in this system may be paper 
and electronic.
    RETRIEVABILITY: Information is retrieved by name, Social Security 
Number (SSN), Health Insurance Claim Number (HICN), and assigned 
provider number or appeal number.
    SAFEGUARDS: Only authorized OMHA personnel that have a need for the 
information in the performance of their official duties are permitted 
access to the information.
    Security measures for electronic access include a minimum of a two-
factor authentication solution (such as the use of a Personal Identity 
Verification (PIV) Card and Personal Identification Number (PIN)) to 
enter the computer system that will maintain the data, and storage of 
the computerized records in secured areas that are accessible only to 
employees who require the information in performing their official 
duties. Manually maintained records are kept in locked cabinets or in 
otherwise secure areas.
    Personnel allowed access to the records have been trained in the 
Privacy Act and information security requirements. Employees who 
maintain records in this system of records are instructed not to 
release data to an authorized recipient until the intended recipient 
agrees to implement appropriate management, operational and technical 
safeguards sufficient to protect the confidentiality, integrity and 
availability of the information and information systems and to prevent 
unauthorized access.
    This system will conform to all applicable federal laws and 
regulations and federal and HHS policies and standards as they relate 
to information security and data privacy. These laws and regulations 
may apply but are not limited to: The Privacy Act of 1974; the Federal 
Information Security Management Act of 2002; the Computer Fraud and 
Abuse Act of 1986; the Health Insurance Portability and Accountability 
Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 
1996; the Medicare Modernization Act of 2003, and the corresponding 
implementing regulations. OMB Circular A-130, Management of Federal 
Resources, Appendix III, Security of Federal Automated Information 
Resources also applies. Federal and HHS policies and standards include 
but are not limited to: All pertinent National Institute of Standards 
and Technology publications; the HHS Information Systems Program 
Handbook and the CMS Information Security Handbook.
    RETENTION AND DISPOSAL: OMHA will destroy electronic and paper 
records by deleting or shredding them 3 years after the final action is 
taken (see NARA-approved records schedule DAA-0468-2012-0003).

SYSTEM MANAGER AND ADDRESS:
    Andrea Monson, Director, Division of Information Management and 
Systems, 1700 North Moore Street, Suite 1800, Arlington, VA 22209.

NOTIFICATION PROCEDURE:
    An individual can determine if this system contains a record about 
him or her by making a written notification request to the System 
Manager, showing proof of identity, and providing the system name, the 
subject individual's name, HICN, address, date of birth, and gender. 
Furnishing the SSN is voluntary.

RECORD ACCESS PROCECURE:
    An individual can obtain access to a record about him or her by 
using the same procedures outlined in Notification Procedures above and 
specifying the record contents sought.

CONTESTING RECORD PROCEDURE:
    The requesting individual should contact the System Manager named 
above, and reasonably identify the records and specify the information 
contested. In addition, the individual should state the corrective 
action sought and the reasons for the correction and provide supporting 
justification.

RECORD SOURCE CATEGORIES:
    Information in this system of records is obtained from individuals 
who complete a form requesting a Medicare hearing or appeal, from CMS 
and its contractors, and from SSA.

SYSTEM EXEMPTED FROM CERTAIN PROVISIONS OF THE PRIVACY ACT:
    This system of records is not a type of system eligible to be 
exempted from certain Privacy Act requirements under subsections (j) 
and (k) of the Privacy Act (5 U.S.C. 552a(j)(k)); however, to the 
extent that records contained in the ALJ working files constitute 
material compiled in reasonable anticipation of a civil action or 
proceeding, they will be exempt from the Privacy Act's access 
requirement under 5 U.S.C. 552a(d)(5).

    Dated: October 13, 2015.
Eileen McDaniel,
Director of Programs, Office of Medicare Hearings and Appeals.
[FR Doc. 2015-26631 Filed 10-19-15; 8:45 am]
BILLING CODE 4152-01-P