Вы находитесь на странице: 1из 8

11420 Federal Register / Vol. 71, No.

44 / Tuesday, March 7, 2006 / Notices

Dated: February 27, 2006. we will change any reference to the on disclosure of privacy protected data
Joan F. Karr, program under Part C of Title XVIII elements maintained in this system. The
Acting Reports Clearance Officer, Centers for currently referred to as the modified routine use will remain as
Disease Control and Prevention. ‘‘Medicare+Choice Program’’ to read the routine use number 6.
[FR Doc. E6–3190 Filed 3–6–06; 8:45 am] ‘‘Medicare Advantage (MA) Program.’’ We will modify the language in the
BILLING CODE 4163–18–P The MA Program shall consist of the remaining routine uses to provide
program under Part C of Title XVIII of clarity to CMS’s intention to disclose
the Act, to include MA and MA–PD. individual-specific information
DEPARTMENT OF HEALTH AND Information maintained in this system contained in this system. The routine
HUMAN SERVICES related to the MA and MA–PD shall be uses will then be prioritized and
derived from the Medicare Advantage reordered according to their proposed
Centers for Medicare & Medicaid Prescription Drug System (MARx) usage. We will also take the opportunity
Services (formerly known as the ‘‘Medicare to update any sections of the system that
Managed Care System (MMCS)) System were affected by recent reorganizations
Privacy Act of 1974; Report of a No. 09–70–4001. and to update language in the
Modified or Altered System of Records Generally, coverage for the administrative sections to correspond
AGENCY: Department of Health and prescription drug benefit under Part D with language used in other CMS SORs.
Human Services (HHS), Centers for will be provided under PDPs, which The primary purpose of this modified
Medicare & Medicaid Services (CMS). will offer only prescription drug system is to provide CMS with a
ACTION: Notice of a Modified or Altered coverage. Under Part C, Medicare singular, authoritative, database of
System of Records (SOR). Managed Care Organizations will offer comprehensive data on individuals in
prescription drug coverage that is the Medicare program to support
SUMMARY: In accordance with the integrated with the health care coverage ongoing and expanded program
requirements of the Privacy Act of 1974, they provide to beneficiaries and will be administration, service delivery
we are proposing to modify or alter an referred to as Part C of the Medicare modalities, and payment coverage
existing SOR, ‘‘Medicare Beneficiary Program. options. This collection will contain a
Database (MBD),’’ System No. 09–70– The broadened scope of the Part D complete ‘‘beneficiary insurance
0536. This system was last published at benefit will include the following profile’’ that reflects the individual
66 FR 63392 (December 6, 2001). The activities; (1) determination of the status Medicare and Medicaid health
initial stage of development of the MBD of Medicare beneficiaries who are insurance coverage and Medicare health
contained data of interest to the eligible for the Low Income Subsidy plan and demonstration enrollment.
Medicare Managed Care program. Since Program (LIS) and are deemed to receive This system will also included data
publication of the notice in 2001, all certain drug benefits; and (2) auto- necessary to process certain activities
proposed phases of development for this assignment/auto-enrollment of associated with the new Medicare
system have been completed. We beneficiaries as required by the MMA, prescription drug benefit program.
propose to broaden the scope of this to include all LIS and deemed Information retrieved from this system
system to collect and maintain data individuals who are not voluntarily of records will also be disclosed to: (1)
elements necessary for the new enrolled in a drug plan, will Support regulatory, reimbursement, and
voluntary prescription drug benefit automatically be assigned to a policy functions performed within the
program required by Section 101 of the Prescription Drug Plan (PDP) or agency or by a contractor, consultant or
Medicare Prescription Drug, Medicare Advantage (MA) Prescription grantee; (2) assist another Federal or
Improvement, and Modernization Act of Drug Plan (MA–PD). Information will be state agency, agency of a state
2003 (MMA) (Pub. L. 108–173). This received from state organizations and government, an agency established by
new prescription drug benefit program from the Social Security Administration state law, or its fiscal agent; (3) support
was enacted into law on December 8, (SSA) and the MBD will make the final providers and suppliers of services for
2003, and amended Title XVIII of the determination as to the status of the administration of Title XVIII; (4) assist
Social Security Act (the Act). The beneficiary. third parties where the contact is
regulations establishing the new We propose to modify existing routine expected to have information relating to
Medicare ‘‘Part D’’ Prescription Drug use number 1 that permits disclosure to the individual’s capacity to manage his
Benefit program are codified at Title 42 agency contractors and consultants to or her own affairs; (5) support Quality
of the Code of Federal Regulations include grantees who perform a task for Improvement Organizations (QIO); (6)
(CFR), Parts 403, 411, 417 and 423. the agency. The modified routine use assist other insurers for processing
Although the database has always will remain as routine use number 1. individual insurance claims; (7)
contained the entire Medicare We will also modify existing routine use facilitate research on the quality and
beneficiary population, the broadened number 5 to change the name from Peer effectiveness of care provided, as well as
scope of this modification will Review Organizations to read Quality payment related projects; (8) support
document the completion of the Improvement Organizations (QIO) and constituent requests made to a
following phases: Phase II completed to reflect requirements established for congressional representative; (9) support
the development of data elements of QIOs related to the Medicare Part D litigation involving the agency; and (10)
interest to the Medicare Fee-For-Service Program. The modified routine use will combat fraud and abuse in certain
Program; Phase III incorporated data remain as routine use number 5. We health benefits programs. We have
elements necessary to implement the further propose to modify published provided background information about
Medicare prescription drug discount routine use number 6 that permits the modified system in the
card program; and Phase IV will disclosure to other insurers. We will SUPPLEMENTARY INFORMATION section
sroberts on PROD1PC70 with NOTICES

complete the development of the MBD expand the stated requirements related below. Although the Privacy Act
to include all provisions mandated by to coordination of benefits for the requires only that CMS provide an
the MMA. Medicare program, to implement the opportunity for interested persons to
To more accurately reflect the Medicare Secondary Payer (MSP) comment on the routine uses, CMS
information maintained in this system provisions, and to clarify CMS’’ policy invites comments on all portions of this

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00049 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices 11421

notice. See ‘‘Effective Dates’’ section for maintain accurate and complete data on II. Agency Policies, Procedures, and
comment period. Medicare enrollment and entitlement. Restrictions on the Routine Use
DATES: Effective Date: CMS filed a
I. Description of the Modified or A. Agency Policies, Procedures, and
modified or altered SOR report with the Restrictions on the Routine Use
Altered System of Records
Chair of the House Committee on
Government Reform and Oversight, the A. Statutory and Regulatory Basis for The Privacy Act permits us to disclose
Chair of the Senate Committee on SOR information without an individual’s
Homeland Security & Governmental consent if the information is to be used
Affairs, and the Administrator, Office of Authority for maintenance of the for a purpose that is compatible with the
Information and Regulatory Affairs, system is given under §§ 226, 226A, purpose(s) for which the information
Office of Management and Budget 1811, 1818, 1818A, 1831, 1833(a)(1)(A), was collected. Any such disclosure of
(OMB) on 03/01/2006 . To ensure that 1836, 1837, 1838, 1843, 1866, 1876, data is known as a ‘‘routine use.’’ The
all parties have adequate time in which 1881, and 1902(a)(6) of the Act and Title government will only release MBD
to comment, the new system will 42 United States Code (U.S.C.) 426, information that can be associated with
become effective 30 days from the 1395c, 1395cc, 1395i–2, 1395i–2a, an individual as provided for under
publication of the notice, or 40 days 1395j, 13951, 1395mm, 1395o, 1395p, ‘‘Section III. Proposed Routine Use
from the date it was submitted to OMB 1395q, 1395rr, 1395v, and Section 101 Disclosures of Data in the System.’’ Both
and the congress, whichever is later. We of the Medicare Prescription Drug, identifiable and non-identifiable data
may defer implementation of this Improvement, and Modernization Act of may be disclosed under a routine use.
system or one or more of the routine use 2003 (Pub. L. 108–173) (Regulations as We will only collect the minimum
statements listed below if we receive 42 CFR Parts 403, 411, 417 and 423). personal data necessary to achieve the
comments that persuade us to defer purpose of MBD. CMS has the following
implementation. B. Collection and Maintenance of Data policies and procedures concerning
in the System disclosures of information that will be
ADDRESSES: The public should address
comments to the CMS Privacy Officer, maintained in the system. Disclosure of
This system contains information on information from this system will be
Mail Stop N2–04–27, 7500 Security individuals age 65 or over who have
Boulevard, Baltimore, Maryland 21244– approved only to the extent necessary to
been, or currently are, entitled to health accomplish the purpose of the
1850. Comments received will be insurance (Medicare) benefits under
available for review at this location, by disclosure and only after CMS:
Title XVIII of the Social Security Act 1. Determines that the use or
appointment, during regular business (the Act) or under provisions of the
hours, Monday through Friday from 9 disclosure is consistent with the reason
Railroad Retirement Act; individuals that the data is being collected, e.g., to
a.m.–3 p.m., eastern daylight time. under age 65 who have been, or provide CMS with a singular,
FOR FURTHER INFORMATION CONTACT: currently are, entitled to such benefits authoritative, database of
Danielle Moon, Director, Division of on the basis of having been entitled for comprehensive data on individuals in
Enrollment and Eligibility Policy, not less that 24 months to disability the Medicare program to support
Medicare Enrollment and Appeals benefits under Title II of the Act or ongoing and expanded program
Group, Center for Beneficiary Choices, under the Railroad Retirement Act; administration, service delivery
CMS, Mail Stop S1–05–06, 7500 individuals who have been, or currently modalities, and payment coverage
Security Boulevard, Baltimore, are, entitled to such benefits because options.
Maryland 21244–1850. Her telephone they have End-Stage Renal Disease 2. Determines that:
number is 410–786–5724, and via e-mail (ESRD); individuals age 64 and 8 a. The purpose for which the
at Danielle.Moon@cms.hhs.gov. disclosure is to be made can only be
months or over who are likely to
SUPPLEMENTARY INFORMATION: On become entitled to health insurance accomplished if the record is provided
December 8, 2003, Congress passed the (Medicare) benefits upon attaining age in individually identifiable form;
Medicare Prescription Drug, 65, and individuals under age 65 who b. The purpose for which the
Improvement, and Modernization Act of have at least 21 months of disability disclosure is to be made is of sufficient
2003 (MMA) (Pub. L. 108–173). MMA benefits who are likely to become importance to warrant the effect and/or
amends the Social Security Act (the Act) entitled to Medicare upon the 25th risk on the privacy of the individual that
by adding the Medicare Part D Program month or entitlement to such benefits additional exposure of the record might
under Title XVIII and mandate that CMS and those populations that are dually bring; and
establish a voluntary Medicare eligible for both Medicare and Medicaid c. There is a strong probability that
prescription drug benefit program the proposed use of the data would in
(Title XIX of the Act).
effective January 1, 2006. Under the new fact accomplish the stated purpose(s).
Medicare Part D benefit, the Act allows Information maintained in the system 3. Requires the information recipient
Medicare payment to MA plans that include, but are not limited to: standard to:
contract with CMS to provide qualified data for identification such as health a. Establish administrative, technical,
Part D prescription drug coverage as insurance claim number, social security and physical safeguards to prevent
described in 42 CFR parts 417 and 422. number, gender, race/ethnicity, date of unauthorized use of disclosure of the
As CMS’ authoritative enterprise birth, geographic location, Medicare record;
beneficiary database, it provides new enrollment and entitlement information, b. Remove or destroy at the earliest
sets of data that is not currently MSP data necessary for appropriate time all patient-identifiable information;
available in the Enrollment Database Medicare claim payment, hospice and
(EDB), MARx or the Medicaid Statistical election, MA plan elections and c. Agree to not use or disclose the
sroberts on PROD1PC70 with NOTICES

Information System (MSIS). The MBD enrollment, End Stage Renal Disease information for any purpose other than
also maintains beneficiary data elements (ESRD) entitlement, historic and current the stated purpose under which the
extracted from existing CMS systems of listing of residences, and Medicare information was disclosed.
records: EDB, MARx and MSIS. The eligibility and Managed Care 4. Determines that the data are valid
renamed EDB was established in 1965 to institutional status. and reliable.

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00050 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
11422 Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices

III. Proposed Routine Use Disclosures The Internal Revenue Service may court of competent jurisdiction has
of Data in the System require MBD data for the application of declared the individual to be mentally
A. The Privacy Act allows us to tax penalties against employers and incompetent, or the individual’s
disclose information without an employee organizations that contribute attending physician has certified that
individual’s consent if the information to Employer Group Health Plan or Large the individual is not sufficiently
is to be used for a purpose that is Group Health Plans that are not in mentally competent to manage his or
compatible with the purpose(s) for compliance with 42 U.S.C. 1395y(b). her own affairs or to provide the
In addition, other state agencies in information being sought, the individual
which the information was collected.
their administration of a Federal health cannot read or write, cannot afford the
Any such compatible use of data is
program may require MBD information cost of obtaining the information, a
known as a ‘‘routine use.’’ The proposed
for the purpose of determining, language barrier exist, or the custodian
routine uses in this system meet the evaluating and/or assessing cost
compatibility requirement of the Privacy of the information will not, as a matter
effectiveness, and/or the quality of of policy, provide it to the individual),
Act. We are proposing to establish the health care services provided in the
following routine use disclosures of or
state. b. The data are needed to establish the
information maintained in the system: The Railroad Retirement Board
1. To agency contractors, consultants validity of evidence or to verify the
requires MBD information to administer accuracy of information presented by
or grantees who have been engaged by provisions of the Railroad Retirement
the agency to assist in the performance the individual, and it concerns one or
Act and Social Security Act relating to more of the following: the individual’s
of a service related to this system and railroad employment and/or the
who need to have access to the records entitlement to benefits under the
administration of the Medicare program. Medicare program, the amount of
in order to perform the activity. The Social Security Administration
We contemplate disclosing reimbursement, and in cases in which
requires MBD data to enable them to the evidence is being reviewed as a
information under this routine use only assist in the implementation and
in situations in which CMS may enter result of suspected fraud and abuse,
maintenance of the Medicare program. program integrity, quality appraisal, or
into a contractual or similar agreement Disclosure under this routine use
with a third party to assist in evaluation and measurement of
shall be used by state Medicaid agencies
accomplishing CMS function relating to activities.
pursuant to agreements with HHS for
purposes for this system. determining Medicaid and Medicare Third parties contacts require MBD
CMS occasionally contracts out eligibility, for quality control studies, information in order to provide support
certain of its functions when doing so for determining eligibility of recipients for the individual’s entitlement to
would contribute to effective and of assistance under Titles IV, XVIII, and benefits under the Medicare program; to
efficient operations. CMS must be able XIX of the Act, and for the establish the validity of evidence or to
to give a contractor, consultant or administration of the Medicaid program. verify the accuracy of information
grantee whatever information is Data will be released to the state only on presented by the individual, and assist
necessary for the contractors, those individuals who are patients in the monitoring of Medicare claims
consultants or grantees to fulfill its under the services of a Medicaid information of beneficiaries, including
duties. In these situations, safeguards program within the state who are proper reimbursement of services
are provided in the contract prohibiting residents of that state. provided.
the contractor, consultant or grantee 3. To providers and suppliers of 5. To Quality Improvement
from using or disclosing the information services directly or through fiscal Organizations (QIO) in connection with
for any purpose other than that intermediaries or carriers for the review of claims, or in connection with
described in the contract and requires administration of Title XVIII of the Act. studies or other review activities
the contractor, consultant or grantee to Providers and suppliers of services conducted pursuant to Part B of Title XI
return or destroy all information at the require MBD information in order to of the Act, and in performing affirmative
completion of the contract. establish the validity of evidence or to outreach activities to individuals for the
2. To another Federal or state agency, verify the accuracy of information purpose of establishing and maintaining
agency of a state government, an agency presented by the individual, as it their entitlement to Medicare benefits or
established by state law, or its fiscal concerns the individual’s entitlement to health insurance plans. As established
agent to: benefits under the Medicare program, by the Part D Program, QIOs will
a. Contribute to the accuracy of CMS’ including proper reimbursement for conduct reviews of prescription drug
proper payment of Medicare benefits, services provided. events data, or in connection with
b. Enable such agency to administer a 4. To third party contact in situations studies or other review activities
Federal health benefits program, or as where the party to be contacted has, or conducted pursuant to Part D of Title
necessary to enable such agency to is expected to have information relating XVIII of the Act.
fulfill a requirement of a Federal statute to the individual’s capacity to manage QIOs will work to implement quality
or regulation that implements a health his or her affairs or to his or her improvement programs, provide
benefits program funded in whole or in eligibility for, or an entitlement to, consultation to CMS, MA–PD, PDPs,
part with Federal funds, and/or benefits under the Medicare program and state agencies, to assist CMS in
c. Assist Federal/state Medicaid and; prescription drug event assessments,
programs within the state. a. The individual is unable to provide and prepare summary information for
Other Federal or state agencies in the information being sought (an release to CMS.
their administration of a Federal health individual is considered to be unable to QIOs will work to implement quality
program may require MBD information provide certain types of information improvement programs, provide
sroberts on PROD1PC70 with NOTICES

in order to support evaluations and when any of the following conditions consultation to CMS, its contractors,
monitoring of Medicare claims exists: the individual is confined to a and to state agencies. QIOs will assist
information of beneficiaries, including mental institution, a court of competent state agencies in related monitoring and
proper reimbursement for services jurisdiction has appointed a guardian to enforcement efforts, assist CMS and
provided. manage the affairs of that individual, a intermediaries in program integrity

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00051 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices 11423

assessment, and prepare summary • Insurer/Underwriter/TPA Group information from or to entities including
information for release to CMS. Number insurers, underwriters, TPAs, and self-
6. To other insurers, underwriters, • Insurer/Underwriter/Group Name insured plans, concerning potentially
third party administrators (TPAs), self- • Prescription Drug Coverage affected individuals:
insurers, group health plans, employers, • Policy Number • Subscriber HICN
health maintenance organizations, • Effective Date of Coverage • Dependent Name
health and welfare benefit funds, • Employer Name, Employer • Funding arrangements of employer
Federal agencies, a state or local Identification Number (EIN) and group health plans, for example,
government or political subdivision of Address contributory or non-contributory plan,
either (when the organization has • Employment Status self-insured, re-insured, HMO, TPA
assumed the role of an insurer, • Amounts of Payment insurance
underwriter, or third party To administer the MSP provision at • Claims payment information, for
administrator, or in the case of a state 42 U.S.C. 1395y(b)(1) more effectively example, the amount paid, the date of
that assumes the liabilities of an for entities such as Workers’ payment, the name of the insurers or
insolvent insurers pool or fund), Compensation carriers or boards, payer
multiple-employers trusts, no-fault liability insurers, no-fault and • Dates of employment including
medical, automobile insurers, workers’ automobile medical policies or plans, termination date, if appropriate
compensation carriers plans, liability CMS would receive (to the extent that • Number of full and/or part-time
insurers, and other groups providing it is available) and may disclose the employees in the current and preceding
protection against medical expenses following information: calendar years
who are primary payers to Medicare in • Beneficiary’s Name and Address • Employment status of subscriber,
accordance with 42 U.S.C. 1395y(b), or • Beneficiary’s Date of Birth
for example, full or part time or self-
any entity having knowledge of the • Beneficiary’s Social Security
employed
occurrence of any event affecting; number
Other insurers, HMO, and Health Care
a. An individual’s right to any such • Name of Insured
• Insurer Name and Address Prepayment Plans may require MBD
benefit or payment, or information in order to support
b. The initial or continued right to any • Type of coverage; automobile
medical, no-fault, liability payment, or evaluations and monitoring of Medicare
such benefit or payment (for example, a claims information of beneficiaries,
State Medicaid Agency, State Workers’ workers’ compensation settlement
• Insured’s Policy Number including proper reimbursement for
Compensation Board, or Department of services provided.
Motor Vehicles) for the purpose of • Effective Date of Coverage
• Date of accident, injury or illness 1860D–23 and 1860D–24 of the Act
coordination of benefits with the require that the Secretary establish
Medicare program and implementation • Amount of payment under liability,
no-fault, or automobile medical policies, requirements for prescription drug plans
of the MSP provisions at 42 U.S.C. (Part D plans) to ensure the effective
1395y(b). The information CMS may plans, and workers’ compensation
settlements coordination between a Part D plan and
disclose will be: a State Pharmaceutical Assistance
• Beneficiary Name • Employer Name and Address
(Workers’ Compensation Only) Program (SPAP), as well as other payers
• Beneficiary Address of prescription drug benefits, including
• Beneficiary Health Insurance Claim • Name of insured could be the driver
of the car, a business, the beneficiary enrollment file sharing. CMS, using its
Number coordination of benefits contractor,
• Beneficiary Social Security Number (i.e., the name of the individual or entity
which carries the insurance policy or allows this to happen by having payers
• Beneficiary Gender
plan) that will be secondary to Part D submit
• Beneficiary Date of Birth
In order to receive this information their enrollment data in exchange for
• Amount of Medicare Conditional
the entity must agree to the following Part D enrollment data. The data shared
Payment
• Provider Name and Number conditions: is mainly enrollment information (date
• Physician Name and Number c. To utilize the information solely for of enrollment into Part D, what Part D
• Supplier Name and Number the purpose of coordination of benefits plan they are enrolled with). SPAPs, but
• Dates of Service with the Medicare program and other not other payers, will also receive data
• Nature of Service third party payer in accordance with indicating whether the beneficiary
• Diagnosis Title 42 U.S.C. 1395y(b); qualifies for a low-income subsidy to
To administer the MSP provision at d. To safeguard the confidentiality of pay for drug costs.
42 U.S.C. 1395y(b)(2), (3), and (4) more the data and to prevent unauthorized 7. To an individual or organization for
effectively, CMS would receive (to the access to it; and a research project or in support of an
extent that it is available) and may e. To prohibit the use of beneficiary- evaluation project related to the
disclose the following types of specific data for purposes other than for prevention of disease or disability, the
information from insurers, underwriters, the coordination of benefits among third restoration or maintenance of health, or
third party administrator, self-insurers, party payers and the Medicare program. payment related projects.
etc.: This agreement would allow the The MBD data will provide for
• Subscriber Name and Address entities to use the information to research or in support of evaluation
• Subscriber Date of Birth determine cases where they or other projects, a broader, longitudinal,
• Subscriber Social Security number third party payers have primary national perspective of the status of
• Dependent Name responsibility for payment. Examples of Medicare beneficiaries. CMS anticipates
• Dependent Date of Birth prohibited uses would include but are that many researchers will have
sroberts on PROD1PC70 with NOTICES

• Dependent Social Security Number not limited to: Creation of a mailing list, legitimate requests to use this data in
• Dependent Relationship to sale or transfer of data. projects that could ultimately improve
Subscriber To administer the MSP provisions the care provided to Medicare
• Insurer/Underwriter/TPA Name more effectively, CMS may receive or beneficiaries and the policy that governs
and Address disclose the following types of the care.

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00052 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
11424 Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices

8. To a member of Congress or to a fulfill its duties. In these situations, and technical safeguards sufficient to
congressional staff member in response safeguards are provided in the contract protect the confidentiality, integrity and
to an inquiry of the congressional office prohibiting the contractor or grantee availability of the information and
made at the written request of the from using or disclosing the information information systems and to prevent
constituent about whom the record is for any purpose other than that unauthorized access.
maintained. described in the contract and requiring
Beneficiaries sometimes request the This system will conform to all
the contractor or grantee to return or
help of a member of Congress in destroy all information. applicable Federal laws and regulations
resolving an issue relating to a matter 11. To another Federal agency or to an and Federal, HHS, and CMS policies
before CMS. The member of Congress instrumentality of any governmental and standards as they relate to
then writes to CMS, and CMS must be jurisdiction within or under the control information security and data privacy.
able to give sufficient information to be of the United States (including any State These laws and regulations may apply
responsive to the inquiry. or local governmental agency), that but are not limited to: the Privacy Act
9. To the Department of Justice (DOJ), administers, or that has the authority to of 1974; the Federal Information
court or adjudicatory body when: investigate potential fraud or abuse in, Security Management Act of 2002; the
a. The agency or any component a health benefits program funded in Computer Fraud and Abuse Act of 1986;
thereof, or whole or in part by Federal funds, when the Health Insurance Portability and
b. Any employee of the agency in his disclosure is deemed reasonably Accountability Act of 1996; the E–
or her official capacity, or necessary by CMS to prevent, deter, Government Act of 2002, the Clinger-
c. Any employee of the agency in his discover, detect, investigate, examine, Cohen Act of 1996; the Medicare
or her individual capacity where the prosecute, sue with respect to, defend Modernization Act of 2003, and the
DOJ has agreed to represent the against, correct, remedy, or otherwise corresponding implementing
employee, or combat fraud or abuse in such programs.
d. The United States Government is a regulations. OMB Circular A–130,
Other agencies may require MBD
party to litigation or has an interest in Management of Federal Resources,
information for the purpose of
such litigation, and by careful review, Appendix III, Security of Federal
combating fraud and abuse in such
CMS determines that the records are Federally-funded programs. Automated Information Resources also
both relevant and necessary to the applies. Federal, HHS, and CMS
litigation and that the use of such B. Additional Provisions Affecting policies and standards include but are
records by the DOJ, court or Routine Use Disclosures not limited to: all pertinent National
adjudicatory body is compatible with To the extent this system contains Institute of Standards and Technology
the purpose for which the agency Protected Health Information (PHI) as publications; the HHS Information
collected the records. defined by HHS regulation ‘‘Standards Systems Program Handbook and the
Whenever CMS is involved in for Privacy of Individually Identifiable CMS Information Security Handbook.
litigation, and occasionally when Health Information’’ (45 CFR parts 160
another party is involved in litigation and 164, subparts A and E) 65 FR 82462 V. Effects of the System of Records on
and CMS’ policies or operations could (12–28–00). Disclosures of such PHI that Individual Rights
be affected by the outcome of the are otherwise authorized by these CMS proposes to modify this system
litigation, CMS would be able to routine uses may only be made if, and in accordance with the principles and
disclose information to the DOJ, court or as, permitted or required by the
requirements of the Privacy Act and will
adjudicatory body involved. ‘‘Standards for Privacy of Individually
10. To a CMS contractor (including, collect, use, and disseminate
Identifiable Health Information.’’ (See
but not necessarily limited to fiscal information only as prescribed therein.
45 CFR 164–512(a)(1)).
intermediaries and carriers) that assists In addition, our policy will be to Data in this system will be subject to the
in the administration of a CMS- prohibit release even of data not directly authorized releases in accordance with
administered health benefits program, identifiable, except pursuant to one of the routine uses identified in this
or to a grantee of a CMS-administered the routine uses or if required by law, system of records.
grant program, when disclosure is if we determine there is a possibility CMS will take precautionary
deemed reasonably necessary by CMS to that an individual can be identified measures to minimize the risks of
prevent, deter, discover, detect, through implicit deduction based on unauthorized access to the records and
investigate, examine, prosecute, sue small cell sizes (instances where the the potential harm to individual privacy
with respect to, defend against, correct, patient population is so small that or other personal or property rights of
remedy, or otherwise combat fraud or individuals who are familiar with the patients whose data are maintained in
abuse in such program. enrollees could, because of the small the system. CMS will collect only that
We contemplate disclosing size, use this information to deduce the information necessary to perform the
information under this routine use only identity of the beneficiary). system’s functions. In addition, CMS
in situations in which CMS may enter
into a contractual relationship or grant IV. Safeguards will make disclosure from the proposed
with a third party to assist in CMS has safeguards in place for system only with consent of the subject
accomplishing CMS functions relating authorized users and monitors such individual, or his/her legal
to the purpose of combating fraud and users to ensure against excessive or representative, or in accordance with an
abuse. unauthorized use. Personnel having applicable exception provision of the
CMS occasionally contracts out access to the system have been trained Privacy Act. CMS, therefore, does not
certain of its functions and makes grants in the Privacy Act and information anticipate an unfavorable effect on
sroberts on PROD1PC70 with NOTICES

when doing so would contribute to security requirements. Employees who individual privacy as a result of
effective and efficient operations. CMS maintain records in this system are information relating to individuals.
must be able to give a contractor or instructed not to release data until the
grantee whatever information is intended recipient agrees to implement
necessary for the contractor or grantee to appropriate management, operational

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00053 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices 11425

Dated: March 1, 2006. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: which the information was collected.
Charlene Frizzera, Authority for maintenance of the Any such compatible use of data is
Acting Chief Operating Officer, Centers for system is given under §§ 226, 226A, known as a ‘‘routine use.’’ The proposed
Medicare & Medicaid Services. 1811, 1818, 1818A, 1831, 1833(a)(1)(A), routine uses in this system meet the
1836, 1837, 1838, 1843, 1866, 1876, compatibility requirement of the Privacy
SYSTEM NO. 09–70–0536 Act. We are proposing to establish the
1881, and 1902(a)(6) of the Act and Title
SYSTEM NAME: 42 United States Code (U.S.C.) 426, following routine use disclosures of
1395c, 1395cc, 1395i–2, 1395i–2a, information maintained in the system:
‘‘Medicare Beneficiary Database 1395j, 13951, 1395mm, 1395o, 1395p, 1. To agency contractors, consultants
(MBD), HHS/CMS/CBC.’’ 1395q, 1395rr, 1395v, and Section 101 or grantees who have been engaged by
of the Medicare Prescription Drug, the agency to assist in the performance
SECURITY CLASSIFICATION: of a service related to this system and
Improvement, and Modernization Act of
Level Three Privacy Act Sensitive 2003 (Pub. L. 108–173) (Regulations as who need to have access to the records
Data. 42 CFR Parts 403, 411, 417 and 423). in order to perform the activity.
2. To another Federal or state agency,
SYSTEM LOCATION: PURPOSE(S) OF THE SYSTEM: agency of a state government, an agency
The Centers for Medicare & Medicaid The primary purpose of this modified established by state law, or its fiscal
Services (CMS) Data Center, 7500 system is to provide CMS with a agent to:
Security Boulevard, North Building, singular, authoritative, database of a. Contribute to the accuracy of CMS’
First Floor, Baltimore, Maryland 21244– comprehensive data on individuals in proper payment of Medicare benefits,
1850. the Medicare program to support b. Enable such agency to administer a
ongoing and expanded program Federal health benefits program, or as
CATEGORIES OF INDIVIDUALS COVERED BY THE administration, service delivery necessary to enable such agency to
SYSTEM: modalities, and payment coverage fulfill a requirement of a Federal statute
options. This collection will contain a or regulation that implements a health
Individuals age 65 or over who have
complete ‘‘beneficiary insurance benefits program funded in whole or in
been, or currently are, entitled to health
profile’’ that reflects the individual part with Federal funds, and/or
insurance (Medicare) benefits under
Medicare and Medicaid health c. Assist Federal/state Medicaid
Title XVIII of the Social Security Act
insurance coverage and Medicare health programs within the state.
(the Act) or under provisions of the 3. To providers and suppliers of
Railroad Retirement Act; individuals plan and demonstration enrollment.
This system will also include data services directly or through fiscal
under age 65 who have been, or intermediaries or carriers for the
currently are, entitled to such benefits necessary to process certain activities
associated with the new Medicare administration of Title XVIII of the Act.
on the basis of having been entitled for 4. To third party contact in situations
not less that 24 months to disability prescription drug benefit program.
Information retrieved from this system where the party to be contacted has, or
benefits under Title II of the Act or is expected to have information relating
under the Railroad Retirement Act; of records will also be disclosed to: (1)
Support regulatory, reimbursement, and to the individual’s capacity to manage
individuals who have been, or currently his or her affairs or to his or her
are, entitled to such benefits because policy functions performed within the
agency or by a contractor, consultant or eligibility for, or an entitlement to,
they have End-Stage Renal Disease benefits under the Medicare program;
(ESRD); individuals age 64 and 8 grantee; (2) assist another Federal or
state agency, agency of a state and
months or over who are likely to a. The individual is unable to provide
become entitled to health insurance government, an agency established by
state law, or its fiscal agent; (3) support the information being sought (an
(Medicare) benefits upon attaining age individual is considered to be unable to
65, and individuals under age 65 who providers and suppliers of services for
administration of Title XVIII; (4) assist provide certain types of information
have at least 21 months of disability when any of the following conditions
benefits who are likely to become third parties where the contact is
expected to have information relating to exists: the individual is confined to a
entitled to Medicare upon the 25th mental institution, a court of competent
month or entitlement to such benefits the individual’s capacity to manage his
or her own affairs; (5) support Quality jurisdiction has appointed a guardian to
and those populations that are dually manage the affairs of that individual, a
eligible for both Medicare and Medicaid Improvement Organizations (QIO); (6)
assist other insurers for processing court of competent jurisdiction has
(Title XIX of the Act). declared the individual to be mentally
individual insurance claims; (7)
facilitate research on the quality and incompetent, or the individual’s
CATEGORIES OF RECORDS IN THE SYSTEM:
effectiveness of care provided, as well as attending physician has certified that
Information maintained in the system the individual is not sufficiently
payment related projects; (8) support
include, but are not limited to: standard mentally competent to manage his or
constituent requests made to a
data for identification such as health her own affairs or to provide the
congressional representative; (9) support
insurance claim number, social security information being sought, the individual
litigation involving the agency; and (10)
number, gender, race/ethnicity, date of cannot read or write, cannot afford the
combat fraud and abuse in certain
birth, geographic location, Medicare cost of obtaining the information, a
health benefits programs.
enrollment and entitlement information, language barrier exists, or the custodian
MSP data necessary for appropriate ROUTINE USES OF RECORDS MAINTAINED IN THE of the information will not, as a matter
Medicare claim payment, hospice SYSTEM, INCLUDING CATEGORIES OR USERS AND of policy, provide it to the individual),
election, MA plan elections and THE PURPOSES OF SUCH USES: or
sroberts on PROD1PC70 with NOTICES

enrollment, End Stage Renal Disease A. The Privacy Act allows us to b. The data are needed to establish the
(ESRD) entitlement, historic and current disclose information without an validity of evidence or to verify the
listing of residences, and Medicare individual’s consent if the information accuracy of information presented by
eligibility and Managed Care is to be used for a purpose that is the individual, and it concerns one or
institutional status. compatible with the purpose(s) for more of the following: the individual’s

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00054 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
11426 Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices

entitlement to benefits under the • Supplier Name and Number with the Medicare program and other
Medicare program, the amount of • Dates of Service third party payer in accordance with
reimbursement, and in cases in which • Nature of Service Title 42 U.S.C. 1395y(b);
the evidence is being reviewed as a • Diagnosis d. To safeguard the confidentiality of
result of suspected fraud and abuse, To administer the MSP provision at the data and to prevent unauthorized
program integrity, quality appraisal, or 42 U.S.C. 1395y(b)(2), (3), and (4) more access to it; and
evaluation and measurement of effectively, CMS would receive (to the e. To prohibit the use of beneficiary-
activities. extent that it is available) and may specific data for purposes other than for
5. To Quality Improvement disclose the following types of the coordination of benefits among third
Organizations (QIO) in connection with information from insurers, underwriters, party payers and the Medicare program.
review of claims, or in connection with third party administrator, self-insurers, This agreement would allow the entities
studies or other review activities etc.: to use the information to determine
conducted pursuant to Part B of Title XI • Subscriber Name and Address cases where they or other third party
of the Act, and in performing affirmative • Subscriber Date of Birth payers have primary responsibility for
outreach activities to individuals for the • Subscriber Social Security Number payment. Examples of prohibited uses
purpose of establishing and maintaining • Dependent Name would include but are not limited to:
their entitlement to Medicare benefits or • Dependent Date of Birth Creation of a mailing list, sale or transfer
• Dependent Social Security Number
health insurance plans. As established of data.
• Dependent Relationship to
by the Part D Program, QIOs will To administer the MSP provisions
Subscriber
conduct reviews of prescription drug more effectively, CMS may receive or
• Insurer/Underwriter/TPA Name
events data, or in connection with disclose the following types of
and Address
studies or other review activities • Insurer/Underwriter/TPA Group information from or to entities including
conducted pursuant to Part D of Title Number insurers, underwriters, TPAs, and self-
XVIII of the Act. • Insurer/Underwriter/Group Name insured plans, concerning potentially
6. To other insurers, underwriters, • Prescription Drug Coverage affected individuals:
third party administrators (TPAs), self- • Policy Number • Subscriber HICN
insurers, group health plans, employers, • Effective Date of Coverage • Dependent Name
health maintenance organizations, • Employer Name, Employer • Funding arrangements of employer
health and welfare benefit funds, Identification Number (EIN) and group health plans, for example,
Federal agencies, a state or local Address contributory or non-contributory plan,
government or political subdivision of • Employment Status self-insured, re-insured, HMO, TPA
either (when the organization has • Amounts of Payment insurance
assumed the role of an insurer, To administer the MSP provision at • Claims payment information, for
underwriter, or third party 42 U.S.C. 1395y(b)(1) more effectively example, the amount paid, the date of
administrator, or in the case of a state for entities such as Workers’ payment, the name of the insurers or
that assumes the liabilities of an Compensation carriers or boards, payer
insolvent insurers pool or fund), liability insurers, no-fault and • Dates of employment including
multiple-employers trusts, no-fault automobile medical policies or plans, termination date, if appropriate
medical, automobile insurers, workers’ CMS would receive (to the extent that • Number of full and/or part-time
compensation carriers plans, liability it is available) and may disclose the employees in the current and preceding
insurers, and other groups providing following information: calendar years
protection against medical expenses • Beneficiary’s Name and Address • Employment status of subscriber,
who are primary payers to Medicare in • Beneficiary’s Date of Birth for example, full or part time or self-
accordance with 42 U.S.C. 1395y(b), or • Beneficiary’s Social Security employed
any entity having knowledge of the Number 7. To an individual or organization for
occurrence of any event affecting: • Name of Insured a research project or in support of an
a. An individual’s right to any such • Insurer Name and Address evaluation project related to the
benefit or payment, or • Type of coverage; automobile prevention of disease or disability, the
b. The initial or continued right to any medical, no-fault, liability payment, or restoration or maintenance of health, or
such benefit or payment (for example, a workers’ compensation settlement payment related projects.
State Medicaid Agency, State Workers’ • Insured’s Policy Number 8. To a member of Congress or to a
Compensation Board, or Department of • Effective Date of Coverage congressional staff member in response
Motor Vehicles) for the purpose of • Date of accident, injury or illness to an inquiry of the congressional office
coordination of benefits with the • Amount of payment under liability, made at the written request of the
Medicare program and implementation no-fault, or automobile medical policies, constituent about whom the record is
of the MSP provisions at 42 U.S.C. plans, and workers’ compensation maintained.
1395y(b). The information CMS may settlements 9. To the Department of Justice (DOJ),
disclose will be: • Employer Name and Address court or adjudicatory body when:
• Beneficiary Name (Workers’ Compensation Only) a. The agency or any component
• Beneficiary Address • Name of insured could be the driver thereof, or
• Beneficiary Health Insurance Claim of the car, a business, the beneficiary b. Any employee of the agency in his
Number (i.e., the name of the individual or entity or her official capacity, or
• Beneficiary Social Security Number which carries the insurance policy or c. Any employee of the agency in his
• Beneficiary Gender plan) or her individual capacity where the
sroberts on PROD1PC70 with NOTICES

• Beneficiary Date of Birth In order to receive this information DOJ has agreed to represent the
• Amount of Medicare Conditional the entity must agree to the following employee, or
Payment conditions: d. The United States Government is a
• Provider Name and Number c. To utilize the information solely for party to litigation or has an interest in
• Physician Name and Number the purpose of coordination of benefits such litigation, and by careful review,

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00055 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1
Federal Register / Vol. 71, No. 44 / Tuesday, March 7, 2006 / Notices 11427

CMS determines that the records are RETRIEVABILITY: NOTIFICATION PROCEDURE:


both relevant and necessary to the All Medicare records are accessible by For purpose of access, the subject
litigation and that the use of such HICN, and SSN search. This system individual should write to the system
records by the DOJ, court or supports both on-line and batch access. manager who will require the system
adjudicatory body is compatible with name, HICN, address, date of birth, and
the purpose for which the agency SAFEGUARDS: gender, and for verification purposes,
collected the records. the subject individual’s name (woman’s
10. To a CMS contractor (including, CMS has safeguards in place for
maiden name, if applicable), and SSN.
but not necessarily limited to fiscal authorized users and monitors such
Furnishing the SSN is voluntary, but it
intermediaries and carriers) that assists users to ensure against excessive or
may make searching for a record easier
in the administration of a CMS- unauthorized use. Personnel having
and prevent delay.
administered health benefits program, access to the system have been trained
or to a grantee of a CMS-administered in the Privacy Act and information RECORD ACCESS PROCEDURE:
grant program, when disclosure is security requirements. Employees who For purpose of access, use the same
deemed reasonably necessary by CMS to maintain records in this system are procedures outlined in Notification
prevent, deter, discover, detect, instructed not to release data until the Procedures above. Requestors should
investigate, examine, prosecute, sue intended recipient agrees to implement also specify the record contents being
with respect to, defend against, correct, appropriate management, operational sought. (These procedures are in
remedy, or otherwise combat fraud or and technical safeguards sufficient to accordance with department regulation
abuse in such program. protect the confidentiality, integrity and 45 CFR 5b.5(a)(2)).
11. To another Federal agency or to an availability of the information and
instrumentality of any governmental information systems and to prevent CONTESTING RECORDS PROCEDURES:
jurisdiction within or under the control unauthorized access. The subject individual should contact
of the United States (including any State This system will conform to all the system manager named above, and
or local governmental agency), that applicable Federal laws and regulations reasonably identify the records and
administers, or that has the authority to and Federal, HHS, and CMS policies specify the information to be contested.
investigate potential fraud or abuse in, and standards as they relate to State the corrective action sought and
a health benefits program funded in information security and data privacy. the reasons for the correction with
whole or in part by Federal funds, when These laws and regulations may apply supporting justification. (These
disclosure is deemed reasonably but are not limited to: The Privacy Act Procedures are in accordance with
necessary by CMS to prevent, deter, of 1974; the Federal Information Department regulation 45 CFR 5b.7).
discover, detect, investigate, examine, Security Management Act of 2002; the RECORDS SOURCE CATEGORIES:
prosecute, sue with respect to, defend Computer Fraud and Abuse Act of 1986;
against, correct, remedy, or otherwise the Health Insurance Portability and The data contained in this system of
combat fraud or abuse in such programs. Accountability Act of 1996; the E- records are extracted from other CMS
B. Additional Provisions Affecting Government Act of 2002; the Clinger- systems of records: Enrollment
Routine Use Disclosures: To the extent Cohen Act of 1996; the Medicare Database, Medicare Advantage
this system contains Protected Health Modernization Act of 2003, and the Prescription Drug System, and the
Information (PHI) as defined by HHS corresponding implementing Medicaid Statistical Information
regulation ‘‘Standards for Privacy of regulations. OMB Circular A–130, System. Information will also be
Individually Identifiable Health Management of Federal Resources, provided from the application
Information’’ (45 CFR Parts 160 and 164, Appendix III, Security of Federal submitted by the individual through
Subparts A and E) 65 FR 82462 (12–28– Automated Information Resources also state Medicaid agencies, the Social
00). Disclosures of such PHI that are applies. Federal, HHS, and CMS Security Administration and through
otherwise authorized by these routine policies and standards include but are other entities assisting beneficiaries.
uses may only be made if, and as, not limited to: All pertinent National SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
permitted or required by the ‘‘Standards Institute of Standards and Technology OF THE ACT:
for Privacy of Individually Identifiable publications; the HHS Information None.
Health Information.’’ (See 45 CFR 164– Systems Program Handbook and the
512(a)(1)). CMS Information Security Handbook. [FR Doc. 06–2156 Filed 3–6–06; 8:45 am]
In addition, our policy will be to BILLING CODE 4120–03–P
prohibit release even of data not directly RETENTION AND DISPOSAL:
identifiable, except pursuant to one of
Records are maintained in the active DEPARTMENT OF HEALTH AND
the routine uses or if required by law,
files for a period of 15 years. The HUMAN SERVICES
if we determine there is a possibility
records are then retired to archival files
that an individual can be identified
maintained at the Health Care Data Administration for Children and
through implicit deduction based on
Center. All claims-related records are Families
small cell sizes (instances where the
encompassed by the document
patient population is so small that Children’s Bureau Proposed Research
preservation order and will be retained
individuals who are familiar with the Priorities for Fiscal Years 2006–2008
until notification is received from DOJ.
enrollees could, because of the small
size, use this information to deduce the SYSTEM MANAGER AND ADDRESS: AGENCY: Administration on Children,
identity of the beneficiary). Youth and Families (ACYF),
Director, Division of Enrollment and
sroberts on PROD1PC70 with NOTICES

Administration for Children and


POLICIES AND PRACTICES FOR STORING, Eligibility Policy, Medicare Enrollment
RETRIEVING, ACCESSING, RETAINING, AND
Families (ACF), HHS.
and Appeals Group, Center for
DISPOSING OF RECORDS IN THE SYSTEM: ACTION: Correction: Notice of proposed
Beneficiary Choices, CMS, Mail Stop
STORAGE:
child abuse and neglect research
S1–05–06, 7500 Security Boulevard,
priorities for Fiscal Years 2006–2008.
All records are stored electronically. Baltimore, Maryland 21244–1850.

VerDate Aug<31>2005 16:39 Mar 06, 2006 Jkt 208001 PO 00000 Frm 00056 Fmt 4703 Sfmt 4703 E:\FR\FM\07MRN1.SGM 07MRN1

Вам также может понравиться