Privacy Act Review

Document Title: TRICARE Award Fee Provider Survey

Privacy Reviewer: DHA Privacy and Civil Liberties Office

Approval Date: 09.20.2017

DHA Privacy and Civil Liberties Office (Privacy Office)

Conclusions and Recommendations

This is the Privacy Act Review (PAR) of the TRICARE Award Fee Provider Survey. The DoD sponsor of this Survey is TRICARE. This PAR is based on:

• TRICARE Award Fee Provider OMB Supporting Statement - Part A_19May.docx

• OMB Supporting Statement - Part B_27Apr17.docx

• PL114-328.docx

• TRICARE Provider SatSurvey _CATI 21Sept17.doc

• Email correspondence

(Collectively, the "Survey Documentation").

A. No Privacy Act Statement Required

The Privacy Office concludes that the collection and use of Survey responses will not be part of a Privacy Act system of records. All responses will be anonymous. No personally identifiable information (PII) or protected health information (PHI) will be solicited or collected from Survey participants. A Privacy Act Statement is not required for this collection because the Survey is not requesting individuals to furnish personal information for a system of records.

B. Privacy Advisory Recommended

Because participants will not be asked to provide PII that will be maintained and associated with their responses, or retrieved as part of this Survey, the DHA Privacy and Civil Liberties Office has determined that a Privacy Advisory is sufficient. The DHA Privacy and Civil Liberties Office accepts the Privacy Advisory language provided in your Survey instrument. Please ensure that your interviewers read the Privacy Advisory as written in the Survey instrument prior to asking the first Survey question (see below).

Privacy Advisory

Answering the questions is voluntary. You may ask to skip any question you don’t want to answer and you can stop at any time. We would like to know what you think. Your answers will be confidential and any identifying information will be protected by the research team, and will not be tied to your answers when the results are released.

Providing information in this Survey is voluntary

C. Limitation on Recommendations

The Privacy Office’s analysis and recommendations assume that the actual Survey documents, the methods used to solicit Survey participants, and the manner in which the Survey is conducted are in accordance with the statements made in the Survey Documentation. If any of these assumptions, or information provided in the Survey Documentation is incorrect, the Privacy Office’s Analysis and Recommendations may change and may no longer be applicable to this Survey absent subsequent Privacy Office review.

Privacy Office's Internal Review Checklist

X Statement of purpose check:

The Decision Support Division (DSD) under the authority of the Office of the Assistant Secretary of Defense (Health Affairs)/Defense Health Agency (DHA) is proposing an extension of an existing information collection of TRICARE network civilian providers. The TRICARE Award Fee Provider Survey (TAFPS) is designed to assess TRICARE network civilian provider satisfaction, attitudes, and perceptions regarding the business functions/services that are provided by the MCSC in the six (6) TRICARE regions world-wide. Specifically, the TAFPS obtains provider opinions regarding claims processing, customer service, and administrative support by the TRICARE regional contractors. The findings from these surveys, coupled with additional performance criteria from other sources, are used by the TRICARE Regional Administrative Contracting Officers to determine bi-annual award fees of the MCSC. Regional Award Fee Determination Officials (AFDO) and TRICARE Regional Administrative Contracting Officers use this data to determine bi-annual award fees of the MCSC contractors.

Section 706 of the Fiscal Year 2017 National Defense Authorization Act directed DoD to establish military-civilian integrated health delivery systems through partnerships with other health systems, including local or regional health systems in the private sector with the goals of (a) delivering high quality health care as measured by leading national health quality measurements or organizations; (b) achieving greater efficiency in the delivery of health care by identifying and implementing within each such system improvement opportunities; (c) improve population-based health outcomes by using a team approach; and (d) coordinate and integrate health care across the continuum of care, connecting all aspects of the health care received by the patient.

X Timeframe check:

The proposed survey is an ongoing survey fielded monthly and the results will be reported twice a year

X Beneficiaries affected check:

Each month, random samples of TRICARE network providers who have had an encounter with a TRICARE patient in the preceding month are contacted. Potential survey participants are drawn from random samples of network providers identified by the MCSC in each Region. The total sample size (including all TRICARE Regions) received annually is approximately 11,500. The government pulls the sample on a monthly basis. Information in the samples consists of first and last name of the network provider’s office manager or billing supervisor, provider identification (ID) number, and office telephone number.

The survey is delivered exclusively by phone, and interviewers see only name and phone number. The survey vendor must attempt to reach each and every potential respondent in the sample. Telephone call attempts are to be made between the hours of 9 AM and 6 PM respondent time. Repeated attempts must be made until the provider is contacted, found ineligible or five attempts have been made. After five attempts to contact the provider have been made, no further attempts are to be made.

The survey script instructs the interviewer to administer the survey only to the person listed in the survey sample. Therefore, it is unlikely that the Survey would be administered to anyone other than the intended participants.

X Reporting by subgroup check:

The random samples are constructed such that there is a sufficient amount in each sample to yield 1,224 completed responses per year, reported in groups of 102 participant responses for each of the six TRICARE Regions every six months.

The survey uses a single instrument, but is fielded and reported separately for each TRICARE Region: TRICARE Regional Office (TRO) North, TRO West, TRO South, as well as TRICARE Overseas for Latin America, the Pacific, and Eurasia-Africa. The Survey does not create subgroups for any Region.

X Sampling check:

If the researchers create a sample of the data, it will contain responses for at least 1,224 participants.

X Miscellaneous/unique identifiers check:

Participants will not be requested to furnish personal information for a system of records. The results of the survey are aggregated, and are not associated with an individual person.

Survey operations are conducted using standardized telephone scripts. These telephone scripts are read verbatim without adding any other scripting or tag questions, such as “How are you?” An electronic telephone interviewing system is used for administering the survey. An electronic telephone interviewing system uses standardized scripts and design specifications. The survey vendor is responsible for programming the scripts and specifications into their electronic telephone interviewing software. Regardless of patient response, the interviewer must record all responses in the telephone interview.

X Access to survey check:

Data collected through the electronic telephone interviewing system must be retained in a secure manner for a minimum of one year and must be easily retrievable by the survey vendor.

To protect data confidentiality, the survey vendor (a) prevents unauthorized access to confidential electronic and hard copy information by restricting physical access to confidential data (use locks or password-protected entry systems on rooms, file cabinets and areas where confidential data are stored); (b) develops confidentiality agreements which include language related to HIPAA regulations and the protection of patient information, and obtain signatures from all personnel with access to survey information, including staff and all subcontractors involved in survey administration and data collection; (c) executes Business Associate Agreement(s) with DHA in accordance with HIPAA regulations; (d) confirms that staff and subcontractors are compliant with HIPAA regulations in regard to patient protected health information (PHI); (e) establishes protocols for secure file transmission. Emailing of PHI via unsecure email is prohibited; and (f) establishes protocols for identifying security breaches and instituting corrective actions.

X De-identification segregated from database creation or maintenance (cannot be the same party or is a HIPAA violation) check:

Since the Survey questions do not ask a participant to furnish protected health information, these HIPAA-related issues do not appear to be a concern.

X Crosswalk collection – min. necessary vs. limited dataset vs. de-identified check:

Since the Survey questions do not ask a participant to furnish protected health information, these HIPAA-related issues do not appear to be a concern.

X Sponsors monitor the work of contractors check:

Deloitte Consulting LLP and Zogby Analytics are the contractors involved with this Survey. As per the contract terms, the Government has unlimited rights to all documents/material delivered under this contract. All documents and materials, to include the questionnaire and data, produced under this contract are Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

X All work product is owned by the government, if not, subject to destruction check:

The survey reports are provided to DHA every 6 months, as determined by the Award Fee Surveys reporting schedule. After all survey fieldwork has concluded, the survey responses are exported without any personal information attached. Instead, an auto-generated ID number is given to each survey respondent. The data is stored securely until the delivery of the report to DHA, when the sample file is then destroyed using an erasure program called “Eraser.” The program uses US DoD 5220.22-M (8-306 /E, C and E) (7 passes) to destroy the file.

X “Not Totally Anonymous” check:

Telephone surveys are fielded monthly and the results are reported to the TRICARE Regional Offices bi-annually. The results of the survey are aggregated, and are not associated with an individual person. The dialog for telephone survey includes the federal requirements for disclosure. The respondent database is only retained by the Government. Only aggregated information about demographics of the entire database is available to the contracting officer and vendor.

X Telephone collection check:

If the telephone is answered by someone other than the intended participant, the person is thanked and the interview is terminated. If the telephone is answered by a voicemail or answering machine, the interviewer is instructed to not leave a message. The interviewer will disposition the call as a “call back.” The phone number is then entered back into the system, and a call back may be initiated 2 hours after the first (the amount of time is determined by an algorithm based on the sample size of each survey). If a respondent tells the interviewer to call back at a certain time, a calendar will appear on the screen for the interviewer to enter a time and/or date.

No Privacy Act Statement is required for collection.

X Privacy Advisory is required.

Privacy Office's Analysis of the Survey:

After reviewing the Survey Documentation, the Privacy Office concludes that the collection of information requested by the TRICARE Award Fee Provider Survey does not raise any Privacy Act concerns.

The participants are not asked to provide PII during the Survey, a Privacy Advisory should be sufficient. The language provided in the Survey instrument fulfills the elements of a Privacy Advisory. Prior to asking the first Survey question, participants are informed that their participation is voluntary; they may skip any question or stop the Survey at any time, and their identity will be protected and their answers will not linked to responses when the results are released. So long as that text is provided before the first Survey question, an independent Privacy Advisory is not necessary.

TRICARE Award Fee Provider Survey_PAR_Federal Privacy Compliance Manager Approved on behalf of Chief DHA Privacy and Civil Liberties Office 4