CMS-10148.Supporting Statement-11-29-06

Supporting Statement For the Health Insurance Portability and Accountability Act (HIPAA) Administrative
Simplification (A.S.) Non-Privacy Enforcement

A. Background

This submission modifies the information collection requirements in CMS-0014-N. The purpose of this collection is to establish a complaint form to capture complaint information voluntarily submitted to the Centers for Medicare and Medicaid Services (CMS), Office of E-Health Standards and Services (OESS) by the public regarding the Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification (A.S.) regulations except the Privacy Rule.

HIPAA became law in 1996 (Public Law 104–191). Subtitle F of Title II of HIPAA, titled ‘‘Administrative Simplification,’’ (A.S.) requires the Secretary of HHS to adopt national standards for certain information-related activities of the health care industry. The HIPAA provisions, by statute, apply only to “covered entities” referred to in section 1320d – 2(a)(1) of this title. Responsibility for administering and enforcing the HIPAA A.S. Transactions, Code Sets, Identifiers and Security Rules has been delegated to the Centers for Medicare & Medicaid Services (‘‘CMS’’). The initial information collected to enforce these rules will be used to initiate enforcement actions. Information collected subsequent to the initial information collection are not subject to the PRA since these collections are within the exemption at 5 CFR 1320.4(a).

This information collection change clarifies the “Identify the HIPAA Non-Privacy complaint category” section of the complaint form. In this section, complainants are given an opportunity to check the “Unique Identifiers” option to categorize the type of HIPAA complaint being filed. The revised form now includes a “”For a Unique Identifier Complaint” section, that allows a complaint to further categorize their identifier complaint as either a “National Provider Identifier (NPI)” or an “Employer Identification Number (EIN)” complaint. This change does not have an additional burden impact.

B. Justification

1 . Need and Legal Basis

The Secretary of Health and Human Services delegated to the Administrator, Centers for Medicare & Medicaid Services (CMS), the authority to investigate complaints of noncompliance with, and to make decisions regarding the interpretation, implementation, and enforcement of certain regulations adopting administrative simplification standards. See 68 FR 60694 (October 23, 2003). These regulations are codified at 45 CFR, parts 160, 162, and 164. This delegation includes authority with respect to the following regulations: the Transaction and Code Set Rule (TCS), 65 FR 50313 (August 17, 2000), the National Employer Identifier Number (EIN) Rule, 67 FR 38009 (May 31, 2002), the Security Rule, 68 FR 8334 (February 20, 2003), the National Provider Identifier Rule, 69 FR 3434 (January 23, 2004) and the HIPAA Enforcement Final Rule,

45 CFR Parts 160 and 164 (February 16, 2006).PROD1PC65 with RUL

This delegation does not include authority with respect to the regulations adopted under section 264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191, as amended, known as the Privacy Rule. The Secretary has delegated to the Office for Civil Rights the authority to receive and investigate complaints as they may relate to the Privacy Rule codified at 45 CFR parts 160 and 164. For the purpose of this notice, “administrative simplification provisions” means the administrative simplification regulatory requirements under HIPAA, other than privacy.

2. Information Users

The initial complaint submission can be performed using a paper or electronic form. It is expected that covered entities under HIPAA (health plans, health care clearinghouses, covered health care providers) and possibly individuals will submit the complaint form.

3. Use of Information Technology

This process involves the use of electronic and paper collection techniques. It is expected that approximately 90% of complaints submitted will be electronic. The electronic process allows for a more efficient submission process. This collection is currently available for completion electronically and will be expanded to collect additional HIPAA A.S. complaint types in the future. The collection requires an acknowledgement submission button as the electronic signature or signature on paper.

4. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be obtained from any other source.

5. Small Businesses

This collection would impact small businesses or other small entities if the entity chooses to submit a HIPAA A.S. complaint. The burden is minimized by allowing an entity of any size to submit complaints electronically.

6. Less Frequent Collection

Submission of the complaint form is a voluntary process.

7. Special Circumstances

This information collection does not contain any special circumstances.

8. Federal Register/Outside Consultation

Attached is a copy of the 60-day Federal Register notice that published on December 8, 2006.

9. Payments/Gifts to Respondents

There will be no payments and/or gifts to respondents.

10. Confidentiality

Filing a complaint with CMS is voluntary. However, without the information requested on the complaint form, CMS may be unable to proceed with a complaint. CMS collects this information under authority of 68 FR 60694 (October 23, 2003) issued pursuant to the HIPAA. CMS will use the information provided to determine if CMS has jurisdiction and, if so, how CMS will process the complaint. Information submitted on the complaint form is treated confidentially and is protected under the provisions of the Privacy Act of 1974. Names or other identifying information about individuals are disclosed only when it is necessary for investigation of possible HIPAA A.S. Non-Privacy violations, for internal systems operations, or for routine uses, which include disclosure of information outside the Department for purposes associated with HIPAA A.S. Non-Privacy compliance and as permitted by law.

11. Sensitive Questions

This information collection does not contain any sensitive questions.

12. Burden Estimates (Hours & Wages)

Public reporting burden for the collection of information on this complaint form is estimated to average 1 hour per response, including the time for reviewing instructions, gathering the data needed and entering and reviewing the information on the completed complaint form. It is estimated that approximately 500 respondents per year will file HIPAA Non-Privacy complaints using this form. The total public reporting burden per year will be approximately 500 hours. This estimate is based on information collections performed using a previous version of the HIPAA Non-Privacy complaint form between October 16, 2003 and October 16, 2004 and an anticipated additional 300 complaints per year for HIPAA Security Rule enforcement.

This information collection change clarifies the “Identify the HIPAA Non-Privacy complaint category” section of the complaint form. In this section, complainants are given an opportunity to check the “Unique Identifiers” option to categorize the type of HIPAA complaint being filed. The revised form now includes a “”For a Unique Identifier Complaint” section, that allows a complaint to further categorize their identifier complaint as either a “National Provider Identifier (NPI)” or an “Employer Identification Number (EIN)” complaint. This change does not have an additional burden impact.

13. Capital Costs

There are no capital costs for this collection.

14. Cost to Federal Government

There is no cost burden to the federal government.

15. Changes to Burden

This information collection change clarifies the “Identify the HIPAA Non-Privacy complaint category” section of the complaint form. In this section, complainants are given an opportunity to check the “Unique Identifiers” option to categorize the type of HIPAA complaint being filed. The revised form now includes a “”For a Unique Identifier Complaint” section, that allows a complaint to further categorize their identifier complaint as either a “National Provider Identifier (NPI)” or an “Employer Identification Number (EIN)” complaint. This change does not have an additional burden impact.

16. Publication/Tabulation Dates

Does not apply to this information collection.

17. Expiration Date

We are not seeking this exception.

18. Certification Statement

There are no exceptions to the certification statement.

4