Privacy Act of 1974; System of Records for the Evaluation of the Supportive Services Demonstration, 10113-10117 [2019-05175]

Agencies

• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Federal Register Volume 84, Number 53 (Tuesday, March 19, 2019)]
[Notices]
[Pages 10113-10117]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-05175]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-6146-N-03]


Privacy Act of 1974; System of Records for the Evaluation of the 
Supportive Services Demonstration

AGENCY: Office of Policy Development and Research.

ACTION: Notice of a new System of Records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974, as amended, notice is 
hereby given that the Office of Policy Development and Research (PD&R), 
U.S. Department of Housing and Urban Development (HUD), provides public 
notice regarding its System of Records for the Evaluation of the 
Supportive Services Demonstration (SSD). The SSD is a three-year 
demonstration sponsored by HUD to test the impact of a new model of 
housing-based supportive services on the healthcare utilization and 
housing stability of low-income older adults. HUD's Office of Policy 
Development and Research contracted with Abt Associates Inc. (Abt) to 
evaluate the SSD. The evaluation entails matching administrative data 
already being collected on demonstration participants by HUD, the 
Centers for Medicare and Medicaid Services (CMS) in the Department of 
Health and Human Services (HHS), state Medicaid agencies in seven 
states, and The Lewin Group (the implementation contractor for the 
demonstration). The various administrative data sets will be matched to 
demonstration participants and linked using personally identifying 
information (PII) collected by HUD. The evaluation dataset that results 
from the administrative data matching will include PII and protected 
health information (PHI) and is the proposed system of records.

DATES: This notice will become effective April 18, 2019.
    Comments Due Dates: April 18, 2019.

ADDRESSES: You may submit comments, identified by docket number and 
title, by one of the following methods: Interested persons are invited 
to submit comments regarding this notice to the Rules Docket Clerk, 
Office of General Counsel, Department of Housing and Urban Development, 
451 Seventh Street

[[Page 10114]]

SW, Room 10139, Washington, DC 20410. Comments may be filed 
electronically by accessing: www.regulations.gov. Regulations.gov 
provides clear instructions on how to submit a public comment on a 
rule. Communications should refer to the above docket number and title. 
Faxed comments are not accepted. A copy of each communication submitted 
will be available for public inspection and copying between 8 a.m. and 
5 p.m. weekdays at the above address.

FOR FURTHER INFORMATION CONTACT: John Bravacos, Senior Agency Official 
for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of 
Housing and Urban Development; Washington, DC 20410-0001; telephone 
number 202-708-3054 (this is not a toll-free number). Individuals who 
are hearing- or speech-impaired may access this telephone number via 
TTY by calling the Federal Relay Service at 800-877-8339 (this is a 
toll-free number).

SUPPLEMENTARY INFORMATION: The new System of Records will encompass 
administrative data assembled by HUD's contractor, Abt Associates Inc., 
for the Evaluation of the Supportive Services Demonstration, which is 
designed to assess the implementation and impact of a new approach to 
help low-income seniors in HUD-assisted multifamily developments 
successfully age in place. In January 2016, HUD solicited applications 
for the Supportive Services Demonstration for Elderly Households in 
HUD-Assisted Multifamily Housing. The Notice of Funding Availability 
(NOFA) offered grant funding to multifamily property owners to 
implement the Integrated Wellness in Supportive Housing (IWISH) model 
over a three-year period. A total of 124 HUD-assisted properties, 
housing approximately 13,000 elderly residents, are participating in 
the demonstration. These properties are located in seven states: 
California, Illinois, Maryland, Massachusetts, Michigan, New Jersey, 
and South Carolina.
    The evaluation will collect qualitative information through 
questionnaires, interviews, and focus groups to assess the 
implementation of the demonstration. The data will not be store and 
retrieved using PII, and therefore will not be records in the system. 
The evaluation will also measure the impacts of the demonstration by 
obtaining pre-existing administrative data for residents of the 124 
demonstration properties and matching those data to create a linked 
evaluation dataset. The data sources that will be part of the linked 
dataset and will be records in the system are:
     Data from HUD's Tenant Rental Assistance Certification 
System (TRACS) system. The TRACS data are available for all residents 
of the 124 properties and provides the PII used to retrieve information 
on demonstration participants from the other data sources.
     Medicare claims and enrollment data collected by CMS and 
made available for research through CMS's Research Data Assistance 
Center (ResDAC).
     Medicaid claims and enrollment data collected by the seven 
states in the study
     Self-reported demographic and health and social status 
information collected by The Lewin Group for demonstration participants 
who enroll in the Integrated Wellness in Supportive Housing (IWISH) 
pilot program. These data are collected via the Population Health 
Logistics (PHL) platform, which is covered by a separate SORN, ``HUD 
Supportive Services Demonstration/Integrated Wellness in Supportive 
Housing: Privacy Act of 1974; System of Records,'' published in the 
Federal Register on February 15, 2018 (83 FR 6875).
    The evaluation will use the PII contained in the TRACS data to link 
HUD administrative records for demonstration participants to Medicaid 
and Medicare claims data and select data from the PHL platform. The 
evaluation supports HUD's mission by fulfilling legislatively mandated 
requirements for evaluation and evaluating the effectiveness of the 
Supportive Services Demonstration. The demonstration and evaluation 
support HUD's mission of meeting the need for quality affordable rental 
homes and utilizing housing as a platform for improving quality of 
life.
    The new notice states the name and location of the record system, 
the authority for and manner of its operations, the categories of 
individuals that it covers, the type of records that it contains, the 
sources of the information for the records, the routine uses made of 
the records, and the types of exemptions in place for the records. The 
notice also includes the business address of the HUD officials who will 
inform interested persons of how they may gain access to and/or request 
amendments to records pertaining to themselves.
    Publication of this notice allows the Department to provide new 
information about its system of records notices in a clear and cohesive 
format. The new system of records will incorporate Federal privacy 
requirements and Department's policy requirements. The Privacy Act 
places on Federal agencies principal responsibility for compliance with 
its provisions, by requiring Federal agencies to safeguard an 
individual's records against an invasion of personal privacy; protect 
the records contained in an agency system of records from unauthorized 
disclosure; ensure that the records collected are relevant, necessary, 
current, and collected only for their intended use; and adequately 
safeguard the records to prevent misuse of such information. In 
addition, this notice demonstrates the Department's focus on industry 
best practices to protect the personal privacy of the individuals 
covered by this SORN.
    Pursuant to the Privacy Act and the Office of Management and Budget 
(OMB) guidelines, a report of the system of records was submitted to 
OMB, the Senate Committee on Homeland Security and Governmental 
Affairs, and the House Committee on Oversight and Government Reform, as 
instructed by paragraph 7a of OMB Circular No. A-108, ``Federal Agency 
Responsibilities for Review, Reporting, and Publication under the 
Privacy Act,'' December 23, 2016.

SYSTEM NAME AND NUMBER:
    Administrative Dataset for the Evaluation of HUD's Supportive 
Services Demonstration Evaluation.

SECURITY CLASSIFICATION:
    No information in the system is classified.

SYSTEM LOCATION:
    Abt Associates has headquarters at 6130 Executive Blvd., Rockville, 
MD 20852. Records are stored in Abt's Analytic Computing Environment 
(ACE 3), which meets NIST SP 800-53 Revision 4 FISMA Moderate 
Standards, and utilizes FedRAMP Moderate accredited services from 
Amazon as infrastructure. Amazon is located at 410 Terry Ave. N, 
Seattle, WA 98109. HUD's Office of Policy Development and Research, 
Program Evaluation Division, is located at 471 Seventh Street SW, Room 
8120, Washington, DC 20410.

SYSTEM MANAGER(S):
    Carol S. Star, Program Evaluation Division, Office of Policy 
Development and Research, U.S. Department of Housing and Urban 
Development, 451 7th Street SW, Washington, DC 20410; telephone number 
202-402-6139 (this is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Sec. 501 and 502 of the Housing and Urban Development Act of 1970 
(Pub. L. 91-609), 12 U.S.C. 1701z-1, 1701z-2.

[[Page 10115]]

PURPOSE(S) OF THE SYSTEM:
    The purpose of the system is to allow the Department to study 
information gathered on Supportive Services Demonstration IWISH pilot 
program participants in comparison to other participants receiving HUD-
assisted elderly housing. The system will be used to link, store, and 
analyze the administrative data collected through the SSD evaluation 
(HUD data, Medicare data, Medicaid data, and PHL data). Use of this 
system is essential to the successful implementation of the evaluation 
because analyzing person-level linked health and housing data is the 
main way the evaluation will measure the impacts of the demonstration 
on participating residents. Matching existing data from different 
federal and state government agencies is an innovative and cost-
effective evaluation method that minimizes data collection burden on 
the public.
    HUD and policy makers will use the information collected through 
the evaluation to understand the effectiveness and outcomes of the 
IWISH model. The evaluation will provide insight to Congress, HUD, 
grantee states, and other interested parties on issues to consider in 
providing housing-based supportive services. It will also provide 
rigorous, quantitative data on the impact of housing-based supportive 
services on healthcare utilization and housing stability among older 
adults in HUD-assisted housing.
    The goal of the IWISH pilot being evaluated is to help low-income 
seniors to age in their own homes and delay or avoid the need for 
nursing home care. IWISH features a full-time Resident Wellness 
Director (RWD) with a part-time Wellness Nurse (WN) at each property. 
The RWD and WN work together to implement a formal strategy for 
coordinating services to help residents meet their needs. This strategy 
includes six key components:
     Resident engagement and a program rollout process to 
maximize participation.
     Standardized assessment with all participants after 
program enrollment and periodically throughout demonstration.
     A healthy aging plan for each participant and each 
property to address identified needs and interests, and a wellness and 
service coordination process to implement plans and address other 
resident needs.
     A centralized, web-based platform for tracking and 
monitoring resident and program data.
     Partnerships with appropriate local social service and 
health providers.
     Use of appropriate evidence-based health and wellness 
programs.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Residents of 124 HUD-assisted multifamily housing properties in 
California, Illinois, Maryland, Massachusetts, Michigan, New Jersey and 
South Carolina. Most individuals will be low-income seniors aged 62 or 
older.

CATEGORIES OF RECORDS IN THE SYSTEM:
     HUD-Tenant Rental Assistance Certificate System (TRACS): 
Tenant-level data on HUD-assisted residents. Data include age, race, 
ethnicity, household size, income, housing cost, and length of tenure, 
as well as PII (name, DOB, SSN) for purposes of data matching to 
Medicare, Medicaid, and PHL data.
     CMS/ResDAC Data (Medicare): Medicare fee-for-service (FFS) 
claims, Master Beneficiary Summary File (Enrollment Database), and 
Minimum Data Set 3.0 (MDS) from ResDAC. The data in these files 
include: inpatient, outpatient, skilled nursing facility, hospice, home 
health, carrier and Durable Medical Equipment Center (DMERC) claims, 
Part D event files, and nursing home assessment data. Data include PII 
and PHI. We will obtain the data through a Data Use Agreement with 
ResDAC, the contractor that manages external data requests on behalf of 
CMS.
     State Medicaid Data: Medicaid enrollment, fee-for-service 
(FFS) claims, and managed care encounter data. Data include PII and 
PHI. We will obtain data through separate Data Use Agreements with each 
of the seven states featured in the study.
     PHL Data: Self-reported demographic and health and social 
status information data on demonstration participants enrolled in IWISH 
collected by The Lewin Group. The main data items are (for each 
participant) an assessment of health and wellness, individual healthy 
aging plan, and data on the services and programs used. Includes PII 
and PHI. Data will be obtained through a Data Use Agreement with The 
Lewin Group, which is covered by a separate SORN, ``HUD Supportive 
Services Demonstration/Integrated Wellness in Supportive Housing: 
Privacy Act of 1974; System of Records,'' published in the Federal 
Register on February 15, 2018 (83 FR 6875).

RECORD SOURCE CATEGORIES:
    HUD will obtain the records from one federal agency (HHS/CMS); 
state Medicaid agencies in seven states (California, Illinois, 
Maryland, Massachusetts, Michigan, New Jersey and South Carolina); and 
one private entity, HUD's contractor for the implementation of the 
demonstration, The Lewin Group. The focus groups and interviews 
conducted for the evaluation are not a source of records for the 
purposes of the SORN.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
Section 552a(b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside HUD as a 
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
    1. To contractors, experts, consultants with whom HUD has a 
contract, service agreement, or other assignments of the Department, 
when necessary to utilize relevant data for purposes of testing new 
technology and systems designed to enhance program operations and 
performance.
    2. To appropriate agencies, entities, and persons when (1) HUD 
suspects or has confirmed that there has been a breach of the system of 
records; (2) HUD has determined that as a result of the suspected or 
confirmed breach there is a risk of harm to individuals, HUD (including 
its information systems, programs, and operations), the Federal 
Government, or national security; and (3) the disclosure made to such 
agencies, entities, and persons is reasonably necessary to assist in 
connection with HUD's efforts to respond to the suspected or confirmed 
breach or to prevent, minimize, or remedy such harm.
    3. To another Federal agency or Federal entity, when HUD determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Abt provides all project staff with HIPAA Rules of the Road--
Practical Information for Ensuring Compliance; IRB 101 Training; 
General Security Awareness Training; and CITI Human

[[Page 10116]]

Subjects Training. All study team members also undergo project specific 
training on maintaining privacy and safe data storage and handling 
procedures.
    All study team members will be made aware of the project-specific 
data regulations and best practices associated with handling data for 
the study. These practices are incorporated in the study protocol and 
will be detailed in training plans for interviewers, support staff, and 
data analytic staff. Abt will receive PII information from HUD TRACS 
data, including full name, date of birth, gender, SSN, address, for all 
residents of the 124 HUD-assisted multifamily properties in the 
demonstration.
    HUD will transmit the data to Abt through either Huddle, Abt's 
FedRAMP Moderate accredited file transfer service for moving data in 
and out of the system, or another secure file transfer system (SFTP) of 
HUD's choice. Abt will access the data through its Analytic Computing 
Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA 
Moderate Standards, and utilizes FedRAMP Moderate accredited services 
from Amazon as infrastructure. Only authorized Abt staff will have 
access to the data on ACE 3 and to the project-specific folder on 
Huddle.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Once records are stored in Abt's database, records will be 
retrieved by Abt staff that are listed in data agreements as the 
individuals that can handle the data when PII or PHI is included in 
that data. Sessions are marked inactive when users log out of the 
system or stop working in the system for more than fifteen minutes. 
Records with PII will primarily be retrieved to obtain data from ResDAC 
and the State Medicaid agencies and to merge the four types of data: 
HUD TRACS, Medicare, Medicaid, and PHL into one evaluation data set. 
The personal identifiers used for these additional data sources are 
SSN, first and last name, and date of birth. Identifiers will only be 
retained where necessary for analysis. Any identifiers not needed for 
analysis (such as SSN) will be removed from the evaluation data set 
before analysis begins.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    The system of records will be retained by the contractor for no 
later than three years after the completion of the contract. After this 
time, no copies of or extracts from the person-level administrative 
data files, including names, address information, social security 
numbers, birthdates, or other identifiers shall be retained by the 
contractor. No later than three years after the completion of the 
contract, and pursuant to the terms of the individual data use 
agreements, the contractor will destroy the person-level administrative 
data obtained for the study from entities other than HUD. This 
includes:
     Medicare claims data provided by CMS/ResDAC
     Medicaid claims data provided by the seven states in the 
study
     PHL data (provided by The Lewin Group)
    The contractor will return to HUD the person-level administrative 
database file obtained from HUD's TRACS system, with appended 
information on whether an individual was enrolled at any time in the 
IWISH program, the date of the resident's enrollment, and the date (if 
applicable) of the residents dis-enrollment from the program. (The 
information on enrollment will be obtained from the PHL data and will 
be included in the data use agreement with The Lewin Group.)
    The contractor will also provide to HUD the programming code used 
to merge the database files and to conduct the analysis for the final 
reports, as part of the replication protocol described below. Published 
reports will be posted on HUDUser.gov. The replication protocol will be 
archived in perpetuity.
    The retention and disposal procedures are in keeping with HUD's 
records management policies as described in 44 U.S.C. 3101 and 44 
U.S.C. 3303 and with HUD's Records Disposition Schedule 67 for PD&R, 
Item 6. (https://portal.hud.gov/hudportal/documents/huddoc?id=22256x67ADMH.pdf).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    The study's approved data security plan describes the safeguarding 
of any hardcopy, recorded, and electronic information on human subjects 
that will be a part of the study. All study team members are aware of 
the project-specific data regulations and best practices associated 
with handling data for the study. These practices are incorporated in 
the study protocol and will be detailed in training plans for 
interviewers, support staff, and data analytic staff. All staff who 
will have access to the data containing PII or PHI information sign a 
confidentiality agreement per the requirements of all data use 
agreements.
    Abt will guarantee this level of restricted access by only using 
secure transfer mechanisms, such as Huddle, Abt's FedRAMP Moderate 
accredited file transfer service for moving data in and out of the 
system, or another secure file transfer system (SFTP) of the 
transferring agency's choice. Abt will also only access the data 
through its restricted access folder on the Analytic Computing 
Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA 
Moderate Standards, and utilizes FedRAMP Moderate accredited services 
from Amazon as infrastructure.

RECORD ACCESS PROCEDURES:
    For information, assistance, or inquiry about records, contact John 
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, 
Room 10226; U.S. Department of Housing and Urban Development; 
Washington, DC 20410-0001, telephone number 202-6064 (this is not a 
toll-free number). When seeking records about yourself from this system 
of records or any other Housing and Urban Development (HUD) system of 
records, your request must conform with the Privacy Act regulations set 
forth in 24 CFR part 16. You must first verify your identity, meaning 
that you must provide your full name, address, and date and place of 
birth. You must sign your request, and your signature must either be 
notarized or submitted under 28 U.S.C. 1746, a law that permits 
statements to be made, under penalty of perjury, as a substitute for 
notarization. If your request is seeking records pertaining to another 
living individual, you must include a statement from that individual 
certifying their agreement for you to access their records. Without the 
above information, the HUD FOIA Office may not conduct an effective 
search, and your request may be denied due to lack of specificity or 
lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:
    The Department's rules for contesting contents of records and 
appealing initial denials appear in 24 CFR part 16, Procedures for 
Inquiries. Additional assistance may be obtained by contacting John 
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, 
Room 10139; U.S. Department of Housing and Urban Development; 
Washington, DC 20410-0001, or the HUD Departmental Privacy Appeals 
Officers; Office of General Counsel; U.S. Department of Housing and 
Urban Development; 451 7th Street SW, Washington, DC 20410-0001.

NOTIFICATION PROCEDURES:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the component's FOIA Officer, whose 
contact

[[Page 10117]]

information can be found at https://www.hud.gov/foia under ``contact.'' 
if an individual believes more than one component maintains Privacy Act 
records concerning him or her the individual may submit the request to 
the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139, 
Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    None.

    Dated: March 13, 2019.
John Bravacos,
Senior Agency Official for Privacy.
[FR Doc. 2019-05175 Filed 3-18-19; 8:45 am]
BILLING CODE 4210-67-P