CMS-10267. Approved Justification For Emergency Clearance

Justification for Emergency Clearance for the Paperwork Reduction Act Package for the CROWNWeb Authentication Service (CAS)

The Office of Clinical Standards and Quality (OCSQ) is requesting that the Paperwork Reduction Act (PRA) package for the CROWNWeb Authentication Service (CAS) be processed under 5 CFR 1320.13(a)(2) for emergency clearance. The agency cannot reasonably comply with the normal clearance procedures because the application and user account registration form must have OMB clearance by September 2008 to meet the time necessary to begin CAS security administrator training and user account registration for new CROWNWeb alpha testers and CROWNWeb production users. We had intended to use the new CMS identity management system; however, we were informed in February 2008 that due to pending system issues our timeline could not be met. While we do not expect a significant volume of public comments because this process is similar to existing processes in place for OCSQ legacy systems, we will not be able to guarantee the February 2, 2009, CROWNWeb production roll-out without the use of the emergency clearance process.

Project Background

The Office of Clinical Standards and Quality (OCSQ) is replacing two legacy applications that collect information for the CMS-2728 End Stage Renal Disease Medical Evidence Report Medicare Entitlement and/or Patient Registration (OMB No. 0938-0046) and the CMS-2746 ESRD Death Notification (OMB No. 0938-0448). The new system, replacing these two legacy applications, is known as the “Consolidated Renal Operations in a Web Enabled Network (CROWNWeb).” CROWNWeb is the system that is mandated for the Final Rule published April 15, 2008, with the title “Medicare and Medicaid Programs Conditions for Coverage for End-Stage Renal Disease Facilities.” Due to the sensitivity of the data available in CROWNWeb, CMS must ensure that only authorized dialysis facility and ESRD Network Organization personnel have access to CROWNWeb data and that only data pertaining to their own patients is available to facility personnel.

CAS is the system that will be used for creating and maintaining these CROWNWeb accounts. Each new account application form will require supervisor approval and notarization of the applicant’s identity data. The information collected on the CAS form includes (asterisk denotes required fields):

1. Type of Request

   • *Create Account or Change Account or Disable Account

   • *Date Requested

   • *CROWNWeb User ID for change or disable

2. Personnel Information

   • Prefix

   • *First Name

   • Middle Initial

   • *Last Name

   • Suffix

   • *Personal Address

   • *Birthdate

   • Home Phone

   • Cell Phone

3. Identification Information

   • *Identification Used

   • *ID Number

   • *Issued By

   • *Expiration Date

4. Business Information

   • *Business Name

   • *Email Address

   • *Job Title

   • *Phone Number

   • Fax Number

   • *Business Address

   • *Approving Manager’s Name

   • *Manager’s Email Address

   • *Manager’s Job Title

   • *Manager’s Phone Number

5. CROWNWeb Access

   • *System Access Required for the Applicant’s Job Role

Below is a timeline containing key dates for the PRA emergency process (in bold text) and for the CAS data collection and user account creation. The regular PRA process will delay the September 2008 training and user account creation. If we are unable to implement and test the approval and security aspects of CROWNWeb beginning September 2008, users will not be allowed to access the CROWNWeb system at its mandated production release in February 2009.

Timeline:

4/25/2008	CAS Registration Form is finalized and receives CMS/OCSQ Information Systems Security Officer (ISSO) approval.
5/12/2008	Submit emergency justification to OMB.
5/14/2008	Receive approval to submit emergency package to OMB.
5/23/2008	Publish Emergency FR notice, 60-day comment period.
7/22/2008	End of 60-day comment period.
7/22/2008 – 8/1/2008	Respond to public comments and submit responses to OMB for final review.
8/4/2008 – 8/29/2008	OMB final review
8/29/2008	Requested date of OMB approval
Sept. 2008	CAS Security Administrator and Help Desk training provided.
May – June 2008	CAS system requirements finalized.
May - Sept. 2008	CAS development effort underway.
Oct. 2008	CAS User Account Creations/Registration for CROWNWeb Alpha testers.
Nov. – Dec. 2008	Alpha testing period.
Dec. 2008 – Jan.2009	Data Entry into CAS for CROWNWeb Account creation begins for CROWNWeb production users.