Department of Health and Human Services November 20, 2006 – Federal Register Recent Federal Regulation Documents

In accordance with the Privacy Act of 1974, we are proposing to modify or alter an existing SOR, ``Inpatient Rehabilitation Facilities (IRF) Patient Assessment Instrument (IRF-PAI),'' System No. 09-70-1518, last published at 66 Federal Register 56681 (November 9, 2001). Information maintained in this system will continue to contain clinical assessment information for all Medicare Part A fee-for-service patients receiving the services of a Medicare approved IRF. This information will be useful in developing core measures that provide meaningful information on patient characteristics and outcomes across post-acute care settings and will be used by CMS to fulfill its responsibility for validating surveys conducted by accrediting agencies. We propose to assign a new CMS identification number to this system to simplify the obsolete and confusing numbering system originally designed to identify the Bureau, Office, or Center that maintained information in the Health Care Financing Administration systems of records. The new assigned identifying number for this system should read: System No. 09-70-0521. We propose to modify existing routine use number 1 that permits disclosure to agency contractors and consultants to include disclosure to CMS grantees who perform a task for the agency. CMS grantees, charged with completing projects or activities that require CMS data to carry out that activity, are classified separate from CMS contractors and/or consultants. The modified routine use will remain as routine use number 1. We will modify existing routine use number 2 that permits disclosure to Peer Review Organizations (PRO). Organizations previously referred to as PROs will be renamed to read: Quality Improvement Organizations (QIO). Information will be disclosed to QIOs relating to assessing and improving IRF quality of care. The modified routine use will be renumbered as routine use number 4. We will delete routine use number 5 authorizing disclosure to support constituent requests made to a congressional representative. If an authorization for the disclosure has been obtained from the data subject, then no routine use is needed. The Privacy Act allows for disclosures with the ``prior written consent'' of the data subject. We will broaden the scope of published routine uses number 7 and 8, authorizing disclosures to combat fraud and abuse in the Medicare and Medicaid programs to include combating ``waste'' which refers increasingly more to specific beneficiary or recipient practices that result in unnecessary cost to federally-funded health benefit programs. CMS proposes to broaden the scope of the disclosure requirement for routine use number 5, authorizing disclosure to national accrediting organizations that have been approved by CMS for deeming authority for Medicare requirements for home health services. Information will be released to these organizations for only those facilities that they accredit and that participate in the Medicare program and if they meet the following requirements: (1) Provide identifying information for IRFs that have an accreditation status with the requesting accrediting organization that has been granted deeming authority by CMS, (2) submission of a finder file identifying beneficiaries/patients receiving IRF services, (3) safeguard the confidentiality of the data and prevent unauthorized access, and (4) upon completion of a signed data exchange agreement or a CMS data use agreement. We are modifying the language in the remaining routine uses to provide a proper explanation as to the need for the routine use and to provide clarity to CMS's intention to disclose individual-specific information contained in this system. The routine uses will then be prioritized and reordered according to their usage. We will also take the opportunity to update any sections of the system that were affected by the recent reorganization or because of the impact of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) provisions and to update language in the administrative sections to correspond with language used in other CMS SORs. The primary purpose of this modified system is to support the IRF prospective payment system (PPS) for payment of the IRF Medicare Part A fee-for-services furnished by the IRF to Medicare beneficiaries. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent, for evaluating and monitoring the quality of IRF health care and contribute to the accuracy of health insurance operations; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; (4) support the functions of Quality Improvement Organizations; (5) assist other insurers; (6) support the functions of national accrediting organizations; (7) support litigation involving the Agency; and (8) combat fraud, waste, and abuse in certain health care programs. We have provided background information about the modified system in the SUPPLEMENTARY INFORMATION section below. Although the Privacy Act requires only that CMS provide an opportunity for interested persons to comment on the modified or altered routine uses, CMS invites comments on all portions of this notice. See Effective Dates section for comment period.

In accordance with the requirements of the Privacy Act, we are proposing to modify or alter an existing SOR titled, ``Medicare-Cancer Registry Record System (MCR), System No. 09-70-0042,'' established at 53 FR 38082 (September 29, 1988), and most recently modified at 65 FR 37792 (June 16, 2000). We propose to assign a new CMS identification number to this system to simplify the obsolete and confusing numbering system originally designed to identify the Bureau, Office, or Center that maintained information in the Health Care Financing Administration systems of records. The new assigned identifying number for this system should read: System No. 09-70-0509. We propose to modify existing routine use number 2 that permits disclosure to agency contractors and consultants to include disclosure to CMS grantees who perform a task for the agency. CMS grantees, charged with completing projects or activities that require CMS data to carry out that activity, are classified separately from CMS contractors and/or consultants. The modified routine use will be renumbered as routine use number 1. We will delete routine use number 3 authorizing disclosure to support constituent requests made to a congressional representative. If an authorization for the disclosure has been obtained from the data subject, then no routine use is needed. The Privacy Act allows for disclosures with the ``prior written consent'' of the data subject. We propose to broaden the scope of the disclosure provisions of this system by adding a routine use to permit the release of information to another Federal or state agency to contribute to the accuracy of CMS' proper payment of Medicare benefits, to enable such agency to administer a Federal health benefits program, and/or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, to evaluate and to monitor the amount and kinds of services received by Medicare beneficiaries contracting cancer. The added routine use will be numbered as routine use number 2. We will further broaden the scope of this system by including the section titled ``Additional Circumstances Affecting Routine Use Disclosures,'' that addresses ``Protected Health Information (PHI)'' and ``small cell size.'' The requirement for compliance with HHS regulation ``Standards for Privacy of Individually Identifiable Health Information'' applies whenever the system collects or maintains PHI. This system may contain PHI. In addition, our policy to prohibit release if there is a possibility that an individual can be identified through ``small cell size'' will apply to the data disclosed from this system. We are modifying the language in the remaining routine uses to provide a proper explanation as to the need for the routine use and to provide clarity to CMS's intention to disclose individual-specific information contained in this system. The routine uses will then be prioritized and reordered according to their usage. We will also take the opportunity to update any sections of the system that were affected by the recent reorganization or because of the impact of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) provisions and to update language in the administrative sections to correspond with language used in other CMS SORs. The primary purpose of the system of records is to link individual- level data from the Surveillance, Epidemiology, and End Results (SEER) tumor registry system, operated by the National Cancer Institute (NCI), with Medicare enrollment and claims data. This linked file will greatly enhance CMS's and NCI's ability to understand and evaluate the amount and kinds of services received by Medicare beneficiaries contracting cancer. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency to conduct activities related to this system; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; and (4) support litigation involving the agency. We have provided background information about the modified system in the SUPPLEMENTARY INFORMATION section below. Although the Privacy Act requires only that CMS provide an opportunity for interested persons to comment on the routine uses, CMS invites comments on all portions of this notice. See ``Effective Dates'' section for comment period.

This notice announces the third meeting of the American Health Information Community Quality Workgroup in accordance with the Federal Advisory Committee Act (Pub. L. No. 92-463, 5 U.S.C., App.)