Privacy Act of 1974; Report of a New Routine Use for Selected CMS Systems of Records

AGENCY:

Centers for Medicare & Medicaid Services (CMS) Department of Health and Human Services (HHS).

ACTION:

Altered System Notice, Adding a New Routine Use for Selected CMS Systems of Records.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974 (5 U.S.C. 552a), CMS is adding a new routine use to twenty-three CMS systems of records to assist in preventing and detecting fraud, waste and abuse. The new routine use will authorize CMS to disclose provider and beneficiary-identifiable records to representatives of health plans for the purpose of preventing and detecting fraud, waste and abuse, pursuant to section 1128C(a)(2) of the Social Security Act (“the Act”). At section 1128C(c) of the Act, a health plan is defined as a plan or program that provides health benefits, whether directly, through insurance, or otherwise, and includes: (1) A policy of health insurance; (2) a contract of a service benefit organization; and (3) a membership agreement with a health maintenance organization or other prepaid health plan.

Disclosures made pursuant to the routine use will be coordinated through CMS' Data Sharing and Partnership Group, Center for Program Integrity, CMS. CMS has identified twenty-three systems that contain the data potentially necessary to disclose to health plans for the prevention and detection of fraud, waste and abuse. These systems are listed at the end of this notice.

DATES:

Effective Dates: The new routine use described in this notice will become effective without further notice 30 days after publication of this notice in the Federal Register (FR), unless comments received on or before that date result in revisions to this notice.

ADDRESSES:

The public should send comments to: CMS Privacy Officer, Division of Privacy Policy, Privacy Policy and Compliance Group, Office of E-Health Standards & Services, Office of Enterprise Management, CMS, Room S2-24-25, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9:00 a.m.-3:00 p.m., Eastern Time zone.

FOR FURTHER INFORMATION CONTACT:

Shantanu Agrawal, MD, MPhil, FAAEM, Medical Director, Director, Data Sharing and Partnership Group, CMS Center for Program Integrity, 7500 Security Boulevard, Mail Stop AR-18-50, Baltimore, MD 21244, Office phone: 410.786.1795, Facsimile: 410.786.0604, Email: shantanu.agrawal@cms.hhs.gov.

SUPPLEMENTARY INFORMATION:

Section 1128C(a)(2) of the Act authorizes the Secretary and the Attorney General to consult with, and arrange for the sharing of data with, representatives of health plans. At section 1128C(c) of the Act, a health plan is defined as a plan or program that provides health benefits, whether directly, through insurance, or otherwise, and includes: (1) A policy of health insurance; (2) a contract of a service benefit organization; and (3) a membership agreement with a health maintenance organization or other prepaid health plan. In order for CMS to disclose data with representatives of health plans pursuant to section 1128C(a)(2) of the Act, CMS is establishing a new routine use for twenty-three systems identified as containing the data that may be used to detect and prevent fraud, waste, and abuse. The Secretary's authority under section 1128C(a)(2) of the Act has been delegated to the Administrator of CMS. Advance notice of the proposed new routine use for the twenty-three systems of record was provided to OMB and Congress as required by the Privacy Act at 5 U.S.C. 552a(r).

For the reasons described above, the following routine use is added to the twenty-three systems of records listed below:

“To disclose to health plans, defined for this purpose as plans or programs that provide health benefits, whether directly, through insurance, or otherwise, and includes—(1) a policy of health insurance; (2) a contract of a service benefit organization; and (3) a membership agreement with a health maintenance organization or other prepaid health plan when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs. Disclosures may include provider and beneficiary-identifiable data.”

1. Health Plan Management System (HPMS), System No. 09-70-0500, published at 73 Federal Register (FR) 2257 (January 14, 2008).

2. Medicare Multi-Carrier Claims System (MCS), System No. 09-70-0501, published at 71 FR 64968 (November 6, 2006).

3. Enrollment Database (EDB), System No. 09-70-0502, published at 73 FR 10249 (February 26, 2008).

4. Fiscal Intermediary Shared System (FISS), System No. 09-70-0503, published at 71 FR 64961 (November 6, 2006).

5. Inpatient Rehabilitation Facilities—Patient Assessment Instrument (IRF-PAI), System No. 09-70-0521, published at 71 FR 67143 (November 20, 2006).

6. HHA Outcome and Assessment Information Set (OASIS), System No. 09-70-0522, published at 72 FR 63906 (November 13, 2007).

7. Unique Physician/Practitioner Identification Number System (UPIN), System No. 09-70-0525, published at 71 FR 66535 (November 15, 2006).

8. Common Working File (CWF), System No, 09-70-0526, published at 71 FR 64955 (November 6, 2006).

9. Fraud Investigation Database (FID), System No. 09-70-0527, published at 71 FR 77759 (December 27, 2006).

10. Long Term Care MDS (LTC MDS), System No. 09-70-0528, published at 72 FR 12801 (March 19, 2007).

11. Medicare Supplier Identification File (MSIF), System No. 09-70-0530, published at 71 FR 70404 (December 4, 2006).

12. Provider Enrollment, Chain and Ownership System (PECOS), System No. 09-70-0532, published at 71 FR 60536 (October 13, 2006).

13. Medicare Exclusion Database (MED), System No. 09-70-0534, published at 71 FR 70967 (December 7, 2006).

14. Medicare Beneficiary Database (MBD), System No. 09-70-0536, published at 71 FR 70396 (December 4, 2006).

15. Medicaid Statistical Information System (MSIS), System No. 09-70-0541, published at 71 FR 65527 (November 8, 2006).

16. Medicare Retiree Drug Subsidy Program (RDSP), System No. 09-70-0550, published at 70 FR 41035 (July 15, 2005).

17. Medicare Drug Data Processing System (DDPS), System No. 09-70-0553, published at 73 FR 30943 (May 29, 2008).

18. National Plan and Provider Enumeration System (NPPES), System No. 09-70-0555, published at 75 FR 30411 (June 1, 2010).

19. National Claims History (NCH), System No. 09-70-0558, published at 71 FR 67137 (November 20, 2006).

20. Integrated Data Repository (IDR) System No. 09-70-0571, published at 71 FR 74915 (December 13, 2006).

21. Chronic Condition Data Repository (CCDR), System No. 09-70-0573, published at 71 FR 74915 (December 13, 2006).

22. Medicaid Integrity Program System (MIPS), System No. 09-70-0599, published at 73 FR 11639 (March 4, 2008).

23. Medicare Advantage Prescription Drug System (MARx), System No. 09-70-0588, published at 70 FR 60530 (October 18, 2005).