Attachment 12 - SOR.MCBS.FED.REG.2006

60722

Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices

These laws and regulations may apply
but are not limited to: The Privacy Act
of 1974; the Federal Information
Security Management Act of 2002; the
Computer Fraud and Abuse Act of 1986;
the Health Insurance Portability and
Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,
Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS, and CMS
policies and standards include but are
not limited to: all pertinent National
Institute of Standards and Technology
publications; the HHS Information
Systems Program Handbook and the
CMS Information Security Handbook.
RETENTION AND DISPOSAL:

CMS will retain information for a total
period not to exceed 10 years. All
claims-related records are encompassed
by the document preservation order and
will be retained until notification is
received from DOJ.
SYSTEM MANAGER AND ADDRESS:

Director Office of Research
Development & Information, Mail Stop
S3–06–24, Centers for Medicare &
Medicaid Services, 7500 Security
Boulevard, Baltimore, MD 21244–1849.
NOTIFICATION PROCEDURE:

For purpose of access, the subject
individual should write to the system
manager who will require the system
name, employee identification number,
tax identification number, national
provider number, and for verification
purposes, the subject individual’s name
(woman’s maiden name, if applicable),
HICN, and/or SSN (furnishing the SSN
is voluntary, but it may make searching
for a record easier and prevent delay).
RECORD ACCESS PROCEDURE:

For purpose of access, use the same
procedures outlined in Notification
Procedures above. Requestors should
also reasonably specify the record
contents being sought. (These
procedures are in accordance with
Department regulation 45 CFR 5b.5 (a)
(2)).

jlentini on PROD1PC65 with NOTICES

CONTESTING RECORD PROCEDURES:

The subject individual should contact
the system manager named above, and
reasonably identify the record and
specify the information to be contested.
State the corrective action sought and
the reasons for the correction with
supporting justification. (These

VerDate Aug<31>2005

16:16 Oct 13, 2006

Jkt 211001

procedures are in accordance with
Department regulation 45 CFR 5b.7).
RECORDS SOURCE CATEGORIES:

Data will be collected from Medicare
administrative and claims records,
SRRDE site administrative data systems,
patient medical charts, and physician
records.
SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
OF THE ACT:

None.
[FR Doc. E6–17055 Filed 10–13–06; 8:45 am]
BILLING CODE 4120–03–P

DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Medicare & Medicaid
Services
Privacy Act of 1974; Report of a
Modified or Altered System of Records
Centers for Medicare &
Medicaid Services (CMS), Department
of Health and Human Services (HHS).
ACTION: Notice of a Modified or Altered
System of Records (SOR).
AGENCY:

SUMMARY: In accordance with the
Privacy Act of 1974, we are proposing
to modify or alter an existing SOR,
‘‘Medicare Current Beneficiary Survey
(MCBS),’’ System No. 09–70–6002, last
published at 66 Federal Register 15496
(March 19, 2001). We propose to assign
a new CMS identification number to
this system to simplify the obsolete and
confusing numbering system originally
designed to identify the Bureau, Office,
or Center of the Health Care Financing
Administration that maintained the
system of records. The new assigned
identifying number for this system
should read: System No. 09–70–0519.
We propose to modify existing routine
use number 2 that permits disclosure to
agency contractors and consultants to
include disclosure to CMS grantees who
perform a task for the agency. CMS
grantees, charged with completing
projects or activities that require CMS
data to carry out that activity, are
classified separate from CMS
contractors and/or consultants. The
modified routine use will be
renumbered as routine use number 1.
We will delete routine use number 4
authorizing disclosure to support
constituent requests made to a
congressional representative. If an
authorization for the disclosure has
been obtained from the data subject,
then no routine use is needed. The
Privacy Act allows for disclosures with
the ‘‘prior written consent’’ of the data
subject.

PO 00000

Frm 00037

Fmt 4703

Sfmt 4703

We are modifying the language in the
remaining routine uses to provide a
proper explanation as to the need for the
routine use and to provide clarity to
CMS’s intention to disclose individualspecific information contained in this
system. The routine uses will then be
prioritized and reordered according to
their usage. We will also take the
opportunity to update any sections of
the system that were affected by the
recent reorganization or because of the
impact of the Medicare Prescription
Drug, Improvement, and Modernization
Act of 2003 (MMA) (Pub. L. 108–173)
provisions and to update language in
the administrative sections to
correspond with language used in other
CMS SORs.
The primary purpose of this modified
system is to collect and maintain a
research database for CMS and other
researchers that is capable of producing
data sets suitable for both longitudinal
and cross-sectional analysis to be used
to: (1) Produce projections for current
programs and proposed program
changes, (2) produce national level
estimates of health care expenditures by
the aged and disabled, and (3) provide
a research database that can be used to
provide guidance to program
management and policies. The
information retrieved from this system
of records will also be disclosed to: (1)
Support regulatory, reimbursement, and
policy functions performed within the
agency or by a contractor, consultant, or
a CMS grantee; (2) assist another Federal
or State agency with information to
contribute to the accuracy of CMS’s
proper payment of Medicare benefits,
enable such agency to administer a
Federal health benefits program, or to
enable such agency to fulfill a
requirement of Federal statute or
regulation that implements a health
benefits program funded in whole or in
part with Federal funds; (3) assist an
individual or organization for a research
project or in support of an evaluation
project related to the prevention of
disease or disability, the restoration or
maintenance of health, or payment
related projects; and (4) support
litigation involving the agency. We have
provided background information about
the modified system in the
SUPPLEMENTARY INFORMATION section
below. Although the Privacy Act
requires only that CMS provide an
opportunity for interested persons to
comment on the modified or altered
routine uses, CMS invites comments on
all portions of this notice. See EFFECTIVE
DATE section for comment period.
EFFECTIVE DATE: CMS filed a modified or
altered SOR report with the Chair of the

E:\FR\FM\16OCN1.SGM

16OCN1

Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
House Committee on Government
Reform and Oversight, the Chair of the
Senate Committee on Homeland
Security & Governmental Affairs, and
the Administrator, Office of Information
and Regulatory Affairs, Office of
Management and Budget (OMB) on
October 6, 2006. To ensure that all
parties have adequate time in which to
comment, the new system will become
effective 30 days from the publication of
the notice, or 40 days from the date it
was submitted to OMB and the
Congress, whichever is later. We may
defer implementation of this system or
one or more of the routine use
statements listed below if we receive
comments that persuade us to defer
implementation.
The public should address
comments to: CMS Privacy Officer,
Division of Privacy Compliance,
Enterprise Architecture and Strategy
Group, Office of Information Services,
CMS, Room N2–04–27, 7500 Security
Boulevard, Baltimore, Maryland 21244–
1850. Comments received will be
available for review at this location, by
appointment, during regular business
hours, Monday through Friday from 9
a.m.–3 p.m., eastern time zone.
FOR FURTHER INFORMATION CONTACT:
William Long, Social Science Research
Analyst, Division of Survey
Management and Data Release,
Information and Methods Group, Office
of Research, Development and
Information, CMS, Mail Stop C3–20–11,
7500 Security Boulevard, Baltimore,
Maryland 21244–1850. He can also be
reached by telephone at 410–786–7927,
or via e-mail at
[email protected].
ADDRESSES:

CMS has
previously published SOR notice on this
system at 66 Federal Register (FR)
15496 (March 19, 2001), and 55 FR
35957 (September 4, 1990). MCBS is an
ongoing, multi-purpose survey for use
by all components of CMS, by the
Department, and by others concerned
with Medicare policy. The core of the
MCBS concept is a series of interviews
of a representative sample of the
Medicare population regarding: their
patterns of use and cost of health
services over time; their sources of
coverage and payment; their assets and
income; their demographic
characteristics; their health and
functional status; their health and work
history; and their family support. The
same beneficiaries will be interviewed
repeatedly over several years to observe
changes in health care use with changes
in coverage, and to observe processes
that occur over time, such as

jlentini on PROD1PC65 with NOTICES

SUPPLEMENTARY INFORMATION:

VerDate Aug<31>2005

16:16 Oct 13, 2006

Jkt 211001

institutionalization or spending down of
assets.
I. Description of the Modified or
Altered System of Records
A. Statutory and Regulatory Basis for
SOR
Authority for maintenance of the
system is given under section 1875 of
the Social Security Act (42 United
States Code 1395ll).
B. Collection and Maintenance of Data
in the System
Records in this system will be
maintained on a random sample of
persons enrolled for hospital insurance
and/or supplemental medical benefits
under the Medicare program. Records in
this system will include, but are not
limited to, name, social security
number, health insurance claim
number, age, gender, ethnicity,
education, military service history,
income data, marital status, medical
utilization and cost data, prescription
drug usage and cost data, health and
functional status, health insurance
coverage, medical condition status,
household composition data, and
medical provider names.
II. Agency Policies, Procedures, and
Restrictions on the Routine Use
A. Agency Policies, Procedures, and
Restrictions on the Routine Use
The Privacy Act permits us to disclose
information without an individual’s
consent if the information is to be used
for a purpose that is compatible with the
purpose(s) for which the information
was collected. Any such disclosure of
data is known as a ‘‘routine use.’’ The
government will only release MCBS
information that can be associated with
an individual as provided for under
‘‘Section III. Proposed Routine Use
Disclosures of Data in the System.’’ Both
identifiable and non-identifiable data
may be disclosed under a routine use.
We will only collect the minimum
personal data necessary to achieve the
purpose of MCBS. CMS has the
following policies and procedures
concerning disclosures of information
that will be maintained in the system.
Disclosure of information from this
system will be approved only to the
extent necessary to accomplish the
purpose of the disclosure and only after
CMS:
1. Determines that the use or
disclosure is consistent with the reason
that the data is being collected, e.g., to
maintain a research database for CMS
and other researchers that is capable of
producing data sets suitable for both
longitudinal and cross-sectional

PO 00000

Frm 00038

Fmt 4703

Sfmt 4703

60723

analysis to be used to: (1) Produce
projections for current programs and
proposed program changes, (2) produce
national level estimates of health care
expenditures by the aged and disabled,
and (3) provide a research database that
can be used to provide guidance to
program management and policies.
2. Determines that:
a. The purpose for which the
disclosure is to be made can only be
accomplished if the record is provided
in individually identifiable form;
b. The purpose for which the
disclosure is to be made is of sufficient
importance to warrant the effect and/or
risk on the privacy of the individual that
additional exposure of the record might
bring; and
c. There is a strong probability that
the proposed use of the data would in
fact accomplish the stated purpose(s).
3. Requires the information recipient
to:
a. Establish administrative, technical,
and physical safeguards to prevent
unauthorized use of disclosure of the
record;
b. Remove or destroy at the earliest
time all patient-identifiable information;
and
c. Agree to not use or disclose the
information for any purpose other than
the stated purpose under which the
information was disclosed.
4. Determines that the data are valid
and reliable.
III. Proposed Routine Use Disclosures
of Data in the System
A. The Privacy Act allows us to
disclose information without an
individual’s consent if the information
is to be used for a purpose that is
compatible with the purpose(s) for
which the information was collected.
Any such compatible use of data is
known as a ‘‘routine use.’’ The proposed
routine uses in this system meet the
compatibility requirement of the Privacy
Act. We are proposing to establish the
following routine use disclosures of
information maintained in the system:
1. To support agency contractors,
consultants, or grantees, who have been
engaged by the agency to assist in the
performance of a service related to this
collection and who need to have access
to the records in order to perform the
activity.
We contemplate disclosing
information under this routine use only
in situations in which CMS may enter
into a contractual or similar agreement
with a third party to assist in
accomplishing CMS function relating to
purposes for this system.
CMS occasionally contracts out
certain of its functions when doing so

E:\FR\FM\16OCN1.SGM

16OCN1

jlentini on PROD1PC65 with NOTICES

60724

Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices

would contribute to effective and
efficient operations. CMS must be able
to give a contractor, consultant or
grantee whatever information is
necessary for the contractor or
consultant to fulfill its duties. In these
situations, safeguards are provided in
the contract prohibiting the contractor,
consultant or grantee from using or
disclosing the information for any
purpose other than that described in the
contract and requires the contractor,
consultant or grantee to return or
destroy all information at the
completion of the contract.
2. To another Federal or State agency
to:
a. Contribute to the accuracy of CMS’s
proper payment of Medicare benefits;
b. Enable such agency to administer a
Federal health benefits program, or, as
necessary, to enable such agency to
fulfill a requirement of a Federal statute
or regulation that implements a health
benefits program funded in whole or in
part with Federal funds; and/or
c. Assist Federal/State Medicaid
programs within the State.
Other Federal or State agencies, in
their administration of a Federal health
program, may require MCBS
information in order to support
evaluations and monitoring of Medicare
claims information of beneficiaries,
including proper reimbursement for
services provided.
3. To assist an individual or
organization for a research project or in
support of an evaluation project related
to the prevention of disease or
disability, the restoration or
maintenance of health, or payment
related projects.
The MCBS data will provide for
research or in support of evaluation
projects, a broader, national perspective
of the status of Medicare beneficiaries.
CMS anticipates that many researchers
will have legitimate requests to use
these data in projects that could
ultimately improve the care provided to
Medicare beneficiaries and the policy
that governs the care.
4. To support the Department of
Justice (DOJ), court or adjudicatory body
when:
a. The agency or any component
thereof, or
b. Any employee of the agency in his
or her official capacity, or
c. Any employee of the agency in his
or her individual capacity where the
DOJ has agreed to represent the
employee, or
d. The United States Government is a
party to litigation or has an interest in
such litigation, and by careful review,
CMS determines that the records are
both relevant and necessary to the

VerDate Aug<31>2005

16:16 Oct 13, 2006

Jkt 211001

litigation and that the use of such
records by the DOJ, court or
adjudicatory body is compatible with
the purpose for which the agency
collected the records.
Whenever CMS is involved in
litigation, and occasionally when
another party is involved in litigation
and CMS’ policies or operations could
be affected by the outcome of the
litigation, CMS would be able to
disclose information to the DOJ, court or
adjudicatory body involved.
B. Additional Provisions Affecting
Routine Use Disclosures
To the extent this system contains
Protected Health Information (PHI) as
defined by HHS regulation ‘‘Standards
for Privacy of Individually Identifiable
Health Information’’ (45 CFR Parts 160
and 164, Subparts A and E) 65 FR 82462
(12–28–00). Disclosures of such PHI that
are otherwise authorized by these
routine uses may only be made if, and
as, permitted or required by the
‘‘Standards for Privacy of Individually
Identifiable Health Information.’’ (See
45 CFR 164–512 (a) (1)).
In addition, our policy will be to
prohibit release even of data not directly
identifiable, except pursuant to one of
the routine uses or if required by law,
if we determine there is a possibility
that an individual can be identified
through implicit deduction based on
small cell sizes (instances where the
patient population is so small that
individuals could, because of the small
size, use this information to deduce the
identity of the beneficiary).
IV. Safeguards
CMS has safeguards in place for
authorized users and monitors such
users to ensure against excessive or
unauthorized use. Personnel having
access to the system have been trained
in the Privacy Act and information
security requirements. Employees who
maintain records in this system are
instructed not to release data until the
intended recipient agrees to implement
appropriate management, operational
and technical safeguards sufficient to
protect the confidentiality, integrity and
availability of the information and
information systems and to prevent
unauthorized access.
This system will conform to all
applicable Federal laws and regulations
and Federal, HHS, and CMS policies
and standards as they relate to
information security and data privacy.
These laws and regulations may apply
but are not limited to: the Privacy Act
of 1974; the Federal Information
Security Management Act of 2002; the
Computer Fraud and Abuse Act of 1986;

PO 00000

Frm 00039

Fmt 4703

Sfmt 4703

the Health Insurance Portability and
Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,
Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS, and CMS
policies and standards include but are
not limited to: all pertinent National
Institute of Standards and Technology
publications; the HHS Information
Systems Program Handbook and the
CMS Information Security Handbook.
V. Effects of the Modified or Altered
System of Records on Individual Rights
CMS proposes to modify this system
in accordance with the principles and
requirements of the Privacy Act and will
collect, use, and disseminate
information only as prescribed therein.
Data in this system will be subject to the
authorized releases in accordance with
the routine uses identified in this
system of records.
CMS will take precautionary
measures to minimize the risks of
unauthorized access to the records and
the potential harm to individual privacy
or other personal or property rights of
patients whose data are maintained in
the system. CMS will collect only that
information necessary to perform the
system’s functions. In addition, CMS
will make disclosure from the proposed
system only with consent of the subject
individual, or his/her legal
representative, or in accordance with an
applicable exception provision of the
Privacy Act. CMS, therefore, does not
anticipate an unfavorable effect on
individual privacy as a result of
information relating to individuals.
Dated: October 4, 2006.
Charlene Frizzera,
Acting Chief Operating Officer, Centers for
Medicare & Medicaid Services.
SYSTEM NO. 09–70–0519
SYSTEM NAME:

‘‘Medicare Current Beneficiary Survey
(MCBS),’’ HHS/CMS/ORDI.
SECURITY CLASSIFICATION:

Level Three Privacy Act Sensitive
Data.
SYSTEM LOCATION:

The Centers for Medicare & Medicaid
Services (CMS) Data Center, 7500
Security Boulevard, North Building,
First Floor, Baltimore, Maryland 21244–
1850 and at various contractor sites and
at CMS Regional Offices.

E:\FR\FM\16OCN1.SGM

16OCN1

Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:

Records in this system will be
maintained on a random sample of
persons enrolled for hospital insurance
and/or supplemental medical benefits
under the Medicare program.
CATEGORIES OF RECORDS IN THE SYSTEM:

Records in this system will include,
but are not limited to, name, social
security number (SSN), health insurance
claim number (HICN), age, gender,
ethnicity, education, military service
history, income data, marital status,
medical utilization and cost data,
prescription drug usage and cost data,
health and functional status, health
insurance coverage, medical condition
status, household composition data, and
medical provider names.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Authority for maintenance of the
system is given under section 1875 of
the Social Security Act (42 United
States Code 1395ll).

jlentini on PROD1PC65 with NOTICES

PURPOSE(S) OF THE SYSTEM:

The primary purpose of this modified
system is to collect and maintain a
research database for CMS and other
researchers that is capable of producing
data sets suitable for both longitudinal
and cross-sectional analysis to be used
to: (1) Produce projections for current
programs and proposed program
changes, (2) produce national level
estimates of health care expenditures by
the aged and disabled, and (3) provide
a research database that can be used to
provide guidance to program
management and policies. The
information retrieved from this system
of records will also be disclosed to: (1)
Support regulatory, reimbursement, and
policy functions performed within the
agency or by a contractor, consultant, or
a CMS grantee; (2) assist another Federal
or State agency with information to
contribute to the accuracy of CMS’s
proper payment of Medicare benefits,
enable such agency to administer a
Federal health benefits program, or to
enable such agency to fulfill a
requirement of Federal statute or
regulation that implements a health
benefits program funded in whole or in
part with Federal funds; (3) assist an
individual or organization for a research
project or in support of an evaluation
project related to the prevention of
disease or disability, the restoration or
maintenance of health, or payment
related projects; and (4) support
litigation involving the agency.

VerDate Aug<31>2005

16:16 Oct 13, 2006

Jkt 211001

ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OR USERS AND
THE PURPOSES OF SUCH USES:

A. The Privacy Act allows us to
disclose information without an
individual’s consent if the information
is to be used for a purpose that is
compatible with the purpose(s) for
which the information was collected.
Any such compatible use of data is
known as a ‘‘routine use.’’ The proposed
routine uses in this system meet the
compatibility requirement of the Privacy
Act. We are proposing to establish the
following routine use disclosures of
information maintained in the system:
1. To support agency contractors,
consultants, or grantees, who have been
engaged by the agency to assist in the
performance of a service related to this
collection and who need to have access
to the records in order to perform the
activity.
2. To another Federal or State agency
to:
a. Contribute to the accuracy of CMS’s
proper payment of Medicare benefits;
b. Enable such agency to administer a
Federal health benefits program, or, as
necessary, to enable such agency to
fulfill a requirement of a Federal statute
or regulation that implements a health
benefits program funded in whole or in
part with Federal funds; and/or
c. Assist Federal/State Medicaid
programs within the State.
3. To assist an individual or
organization for a research project or in
support of an evaluation project related
to the prevention of disease or
disability, the restoration or
maintenance of health, or payment
related projects.
4. To support the Department of
Justice (DOJ), court or adjudicatory body
when:
a. The agency or any component
thereof, or
b. Any employee of the agency in his
or her official capacity, or
c. Any employee of the agency in his
or her individual capacity where the
DOJ has agreed to represent the
employee, or
d. The United States Government is a
party to litigation or has an interest in
such litigation, and by careful review,
CMS determines that the records are
both relevant and necessary to the
litigation and that the use of such
records by the DOJ, court or
adjudicatory body is compatible with
the purpose for which the agency
collected the records.
B. Additional Provisions Affecting
Routine Use Disclosures.
To the extent this system contains
Protected Health Information (PHI) as
defined by HHS regulation ‘‘Standards

PO 00000

Frm 00040

Fmt 4703

Sfmt 4703

60725

for Privacy of Individually Identifiable
Health Information’’ (45 CFR Parts 160
and 164, Subparts A and E) 65 FR 82462
(12–28–00). Disclosures of such PHI that
are otherwise authorized by these
routine uses may only be made if, and
as, permitted or required by the
‘‘Standards for Privacy of Individually
Identifiable Health Information.’’ (See
45 CFR 164–512(a)(1)).
In addition, our policy will be to
prohibit release even of data not directly
identifiable, except pursuant to one of
the routine uses or if required by law,
if we determine there is a possibility
that an individual can be identified
through implicit deduction based on
small cell sizes (instances where the
patient population is so small that
individuals could, because of the small
size, use this information to deduce the
identity of the beneficiary).
POLICIES AND PRACTICES FOR STORING,
RETRIEVING, ACCESSING, RETAINING, AND
DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:

All records are stored on computer
diskette and magnetic storage media.
RETRIEVABILITY:

Information can be retrieved by the
name and HICN of the beneficiary.
SAFEGUARDS:

CMS has safeguards in place for
authorized users and monitors such
users to ensure against excessive or
unauthorized use. Personnel having
access to the system have been trained
in the Privacy Act and information
security requirements. Employees who
maintain records in this system are
instructed not to release data until the
intended recipient agrees to implement
appropriate management, operational
and technical safeguards sufficient to
protect the confidentiality, integrity and
availability of the information and
information systems and to prevent
unauthorized access.
This system will conform to all
applicable Federal laws and regulations
and Federal, HHS, and CMS policies
and standards as they relate to
information security and data privacy.
These laws and regulations may apply
but are not limited to: the Privacy Act
of 1974; the Federal Information
Security Management Act of 2002; the
Computer Fraud and Abuse Act of 1986;
the Health Insurance Portability and
Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,

E:\FR\FM\16OCN1.SGM

16OCN1

60726

Federal Register / Vol. 71, No. 199 / Monday, October 16, 2006 / Notices

Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS, and CMS
policies and standards include but are
not limited to: all pertinent National
Institute of Standards and Technology
publications, the HHS Information
Systems Program Handbook and the
CMS Information Security Handbook.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
OF THE ACT:

RETENTION AND DISPOSAL:

Centers for Medicare & Medicaid
Services

Records will be maintained for 10
years after the final action of the
research project is complete. All claimsrelated records are encompassed by the
document preservation order and will
be retained until notification is received
from DOJ.
SYSTEM MANAGER(S) AND ADDRESS:

Deputy Director, Office of Research,
Development and Information, CMS,
Mail Stop C3–20–01, 7500 Security
Boulevard, Baltimore, Maryland 21244–
1850.
NOTIFICATION PROCEDURE:

For purpose of access, the subject
individual should write to the system
manager who will require the system
name, HICN, address, date of birth, and
gender, and for verification purposes,
the subject individual’s name (woman’s
maiden name, if applicable), and SSN.
Furnishing the SSN is voluntary, but it
may make searching for a record easier
and prevent delay.
RECORD ACCESS PROCEDURE:

For purpose of access, use the same
procedures outlined in Notification
Procedures above. Requestors should
also specify the record contents being
sought. (These procedures are in
accordance with department regulation
45 CFR 5b(a)(2)).
CONTESTING RECORDS PROCEDURES:

The subject individual should contact
the system manager named above, and
reasonably identify the records and
specify the information to be contested.
State the corrective action sought and
the reasons for the correction with
supporting justification. (These
Procedures are in accordance with
Department regulation 45 CFR 5b.7).

jlentini on PROD1PC65 with NOTICES

RECORDS SOURCE CATEGORIES:

Information contained in these
records will be obtained from the
Medicare enrollment records, Medicare
bill records, Medicare provider records,
Medicare beneficiaries and/or their
representatives, and Medicare carriers
and intermediaries.

VerDate Aug<31>2005

16:16 Oct 13, 2006

Jkt 211001

None.
[FR Doc. E6–17057 Filed 10–13–06; 8:45 am]
BILLING CODE 4120–03–P

DEPARTMENT OF HEALTH AND
HUMAN SERVICES

Privacy Act of 1974; Report of a
Modified or Altered System of Records
Centers for Medicare &
Medicaid Services (CMS), Department
of Health and Human Services (HHS).
ACTION: Notice of a modified or altered
system of records (SOR).
AGENCY:

SUMMARY: In accordance with the
Privacy Act of 1974, we are proposing
to modify or alter an existing SOR,
‘‘Person-Level Medicaid Data System
(PMDS),’’ System No. 09–70–0033,
established at 49 Federal Register (FR)
47573 (December 5, 1984) and last
modified at 65 FR 37792 (June 16,
2000). We propose to assign a new CMS
identification number to this system to
simplify the obsolete and confusing
numbering system originally designed
to identify the Bureau, Office, or Center
that maintained information in the
Health Care Financing Administration
systems of records. The new assigned
identifying number for this system
should read: System No. 09–70–0507.
We propose to modify existing routine
use number 2 that permits disclosure to
agency contractors and consultants to
include disclosure to CMS grantees who
perform a task for the agency. CMS
grantees, charged with completing
projects or activities that require CMS
data to carry out that activity, are
classified separate from CMS
contractors and/or consultants. The
modified routine use will be
renumbered as routine use number 1.
We will delete routine use number 3
authorizing disclosure to support
constituent requests made to a
congressional representative. If an
authorization for the disclosure has
been obtained from the data subject,
then no routine use is needed. The
Privacy Act allows for disclosures with
the ‘‘prior written consent’’ of the data
subject.
We propose to broaden the scope of
the disclosure provisions of this system
by adding a routine use to permit the
release of information to other Federal
and State agencies to: (1) Contribute to
the accuracy of CMS’ proper payment of
Medicare benefits; and (2) enable such

PO 00000

Frm 00041

Fmt 4703

Sfmt 4703

agency to administer a Federal health
benefits program, and/or as necessary to
enable such agency to fulfill a
requirement of a Federal statute or
regulation that implements a health
benefits program funded in whole or in
part with Federal funds.
We are modifying the language in the
remaining routine uses to provide a
proper explanation as to the need for the
routine use and to provide clarity to
CMS’s intention to disclose individualspecific information contained in this
system. The routine uses will then be
prioritized and reordered according to
their usage. We will also take the
opportunity to update any sections of
the system that were affected by the
recent reorganization or because of the
impact of the Medicare Prescription
Drug, Improvement, and Modernization
Act of 2003 (MMA) (Pub. L 108–173)
provisions and to update language in
the administrative sections to
correspond with language used in other
CMS SORs.
The primary purpose of this modified
system is to collect and maintain
individually-identifiable data to study
Medicaid use and expenditures in order
to increase CMS’ understanding of the
Medicaid and Medicare programs and to
improve CMS’ ability to conduct
program evaluation, strengthen program
management, evaluate policy
alternatives, conduct and evaluate
demonstration projects, and advise
States in the area of Medicaid financing.
The information retrieved from this
system of records will also be disclosed
to: (1) Support regulatory,
reimbursement, and policy functions
performed within the Agency or by a
contractor, consultant, or grantee; (2)
assist another Federal and/or State
agency; (3) support an individual or
organization for research, evaluation or
epidemiological projects; and (4)
support litigation involving the agency.
We have provided background
information about the modified system
in the SUPPLEMENTARY INFORMATION
section below. Although the Privacy Act
requires only that CMS provide an
opportunity for interested persons to
comment on the modified or altered
routine uses, CMS invites comments on
all portions of this notice. See EFFECTIVE
DATE section for comment period.
EFFECTIVE DATE: CMS filed a modified or
altered SOR report with the Chair of the
House Committee on Government
Reform and Oversight, the Chair of the
Senate Committee on Homeland
Security & Governmental Affairs, and
the Administrator, Office of Information
and Regulatory Affairs, Office of
Management and Budget (OMB) on

E:\FR\FM\16OCN1.SGM

16OCN1