61388 Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 

Sincerely,

Mark B. McClellan, M.D., Ph.D.

Section 1116 of the Social Security Act 

(42 U.S.C. section 1316); 42 CFR Section 

430.18)

(Catalog of Federal Domestic Assistance 

Program No. 13.714, Medicaid Assistance 

Program)

Dated: October 6, 2004. 

Mark B. McClellan, 

Administrator, Centers for Medicare & 

Medicaid Services.

[FR Doc. 04–23252 Filed 10–15–04; 8:45 am] 

BILLING CODE 4120–03–P

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of Modified 

or Altered System

AGENCY: Department of Health and 

Human Services (HHS) Centers for 

Medicare & Medicaid Services 

(CMS)(formerly the Health Care 

Financing Administration).

ACTION: Notice of Modified or Altered 

System of Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to modify or alter an 

SOR, ‘‘Group Health Plan System,’’

System No. 09–70–4001. We propose to 

broaden the scope of this system with 

the redesign of the electronic processing 

procedure used to process data 

currently from a Common Object 

Business Oriented Language (commonly 

referred to as COBOL) format resident 

on the CMS mainframe to Data Base 2 

format (commonly known as DB2). To 

more accurately reflect the changes 

proposed for this system, we will 

modify the name to read: ‘‘Medicare 

Managed Care System (MMCS).’’ We 

propose to delete published routine use 

number 5 authorizing disclosures to 

contractors; published routine use 

number 6 authorizing disclosures to 

contractors; and published routine use 

number 7 authorizing disclosures to a 

Medicaid State Agency. 

Proposed routine use number 1 for 

contractors and consultants makes 

material changes to published routine 

uses numbers 5 and 6. Routine uses 5 

and 6 authorized release to contractors. 

They are being deleted because their 

meaning is unclear as to what data is 

being disclosed to what entity. Routine 

use number 7 is being deleted because 

disclosure to a State Medicaid Agency 

will now be made under proposed 

routine use number 2 that reads, ‘‘to 

another Federal and/or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent.’’

CMS proposes to add new routine 

uses to permit release of information to: 

(1) Third parties where the contact has 

information relating to the individual’s 

capacity to manage his or her own 

affairs; (2) other insurers, third party 

administrators (TPA), employers, selfinsurers, managed care organizations, 

other supplemental insurers, noncoordinating insurers, multiple 

employer trusts, group health plans (i.e., 

health maintenance organizations 

(HMOs) or a competitive medical plan 

(CMP) with a Medicare contract, or a 

Medicare-approved health care 

prepayment plan (HCPP)), directly or 

through a contractor, and other groups 

providing protection for their enrollees 

to assist in the processing of individual 

insurance claims; and (3 & 4) combat 

fraud and abuse in certain health 

benefits programs. 

The security classification previously 

reported as ‘‘None’’ will be modified to 

reflect that the data in this system are 

considered to be ‘‘Level Three Privacy 

Act Sensitive.’’ We are modifying the 

language in the remaining routine uses 

to provide clarity and uniformity to 

CMS’s intention to disclose individualspecific information contained in this 

system. The routine uses will then be 

prioritized and reordered according to 

their proposed usage. We will also take 

the opportunity to update any sections 

of the system that were affected by the 

recent reorganization and to update 

language in the administrative sections 

to correspond with language used in 

other CMS SORs. 

The primary purpose of the SOR is to 

maintain a master file of Medicare 

Managed Care Organizations (MCO) 

plan members for accounting and 

payment control; expedite the exchange 

of data with MCOs; and control the 

posting of pro-rata amounts to the Part 

B deductible of currently enrolled MCO 

members. MMCS include the following 

entities: Health Maintenance 

Organizations (HMO), Competitive 

Medical Plans (CMP), Health Care 

Prepayment Plan (HCPP), and Medicare 

Choice Organizations (MCO). 

Information in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor or consultant, (2) support 

another Federal and/or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) provider and suppliers of 

service directly or dealing through 

contractors, fiscal intermediaries (FI) or 

carriers for administration of Title XVIII; 

(4) provide information to third party 

contacts in situations where the contact 

has information relating to the 

individual’s capacity to manage his or 

her affairs; (5) other insurers, third party 

administrators (TPA), and other groups 

providing protection for their enrollees 

to assist in the processing of individual 

insurance claims (6) facilitate research 

on the quality and effectiveness of care 

provided, as well as payment-related 

projects, (7) support constituent 

requests made to a congressional 

representative, (8) support litigation 

involving the Agency, and (9 & 10) 

combat fraud and abuse in certain 

health benefits programs.

DATES: CMS filed a modified or altered 

system report with the Chair of the 

House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on August 19, 2004. To ensure 

that all parties have adequate time in 

which to comment, the modified or 

altered SOR, including routine uses, 

will become effective 40 days from the 

publication of the notice, or from the 

date it was submitted to OMB and the 

Congress, whichever is later, unless 

CMS receives comments that require 

alterations to this notice.

ADDRESSES: The public should address 

comments to: Director, Division of 

Privacy Compliance Data Development 

(DPCDD), CMS, Room N2–04–27, 7500 

Security Boulevard, Baltimore, 

Maryland 21244–1850. Comments 

received will be available for review at 

this location, by appointment, during 

regular business hours, Monday through 

Friday from 9 a.m.–3 p.m., Eastern 

daylight time.

FOR FURTHER INFORMATION CONTACT:

Laquia Marks, Information Technology 

Specialist, Division of Managed Care 

Systems, Informational Services 

Modernization Group, OIS, CMS, Room 

N3–16–24, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. The 

telephone number is 410–786–3312.

SUPPLEMENTARY INFORMATION: 

I. Description of the Modified System 

A. Statutory and Regulatory Basis for 

the SOR 

In 1987, CMS established an SOR, 

Group Health Plan System,’’ System No. 

09–70–4001, under the authority of 

§§ 1833(a)(1)(A), 1866, and 1876 of Title 

XVIII of the Social Security Act (the 

Act) (42 U.S.C. 1395 (a)(1)(A), 1395cc, 

and 1395mm). Notice of this system, 

Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 61389

was published at 52 FR 13525 (Apr. 23, 

1987) and a routine use for Medicaid 

state agencies added at 57 FR 60819 

(Dec. 22, 1992). This information 

includes names and health insurance 

claims numbers of recipients of 

Medicare Hospital Insurance (Part A) 

and Medicare Medical Insurance (Part 

B) who are enrolled in a MMCS. 

II. Collection and Maintenance of Data 

in the System 

A. Scope of the Data Collected 

The system includes the following 

information about a beneficiary’s health 

insurance entitlement and 

supplementary medical benefits usage, 

including name, health insurance 

claims number (HICN), and social 

security number. 

B. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

The Privacy Act permits us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such disclosure of 

data is known as a ‘‘routine use.’’ The 

government will only release MMCS 

information that can be associated with 

an individual as provided for under 

‘‘Section III. Proposed Routine Use 

Disclosures of Data in the System.’’ Both 

identifiable and non-identifiable data 

may be disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of MMCS. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the SOR 

will be approved only to the extent 

necessary to accomplish the purpose of 

the disclosure and only after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

data is being collected; e.g., maintain a 

master file of MCO plan members for 

accounting and payment control; 

expedite the exchange of data with 

MCOs; and control the posting of prorata amounts to the Part B deductible of 

currently enrolled MCO members. 

2. Determines that the purpose for 

which the disclosure is to be made can 

only be accomplished if the record is 

provided in individually identifiable 

form; 

a. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

b. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s).

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all patient-identifiable information; 

and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the MMCS without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. We are proposing to establish 

or modify the following routine use 

disclosures of information maintained 

in the system: 

1. To Agency contractors, or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or consultant 

whatever information is necessary for 

the contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To support another Federal or state 

agency, agency of a state government, an 

agency established by state law, or its 

fiscal agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require MMCS 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

In addition, other state agencies in 

their administration of a Federal health 

program may require MMCS 

information for the purposes of 

determining, evaluating and/or 

assessing cost, effectiveness, and /or the 

quality of health care services provided 

in the state. 

Disclosure under this routine use 

shall be used by state Medicaid agencies 

pursuant to agreements with the HHS 

for determining Medicaid and Medicare 

eligibility, for quality control studies, 

for determining eligibility of recipients 

of assistance under Titles IV, XVIII, and 

XIX of the Social Security Act (the Act), 

and for the administration of the 

Medicaid program. Data will be released 

to the state only on those individuals 

who are patients under the services of 

a Medicaid program within the state or 

who are residents of that state.

We also contemplate disclosing 

information under this routine use in 

situations in which state auditing 

agencies require MMCS information for 

auditing state Medicaid eligibility 

considerations. CMS may enter into an 

agreement with state auditing agencies 

to assist in accomplishing functions 

relating to purposes for this system to 

providers and suppliers of services 

directly or through fiscal intermediaries 

(FIs) or carriers for the administration of 

Title XVIII of the Act. 

3. To providers and suppliers of 

services directly or through fiscal 

intermediaries (FIs) or carriers for the 

administration of Title XVIII of the Act. 

Providers and suppliers of services 

require MMCS information in order to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, as it 

concerns the individual’s entitlement to 

benefits under the Medicare program, 

61390 Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 

including proper reimbursement for 

services provided. 

4. To provide information to third 

party contacts in situations where the 

party to be contacted has information 

relating to the individual’s capacity to 

manage his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, a language barrier 

exist, or the custodian of the 

information will not, as a matter of 

policy, provide it to the individual), or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: the individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

Third parties contacts require MMCS 

information in order to provide support 

for the individual’s entitlement to 

benefits under the Medicare program; to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, and assist 

in the monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement of services 

provided. 

5. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations (HMOs) or a competitive 

medical plan (CMP) with a Medicare 

contract, or a Medicare-approved health 

care prepayment plan (HCPP)), directly 

or through a contractor, and other 

groups providing protection for their 

enrollees. Information to be disclosed 

shall be limited to Medicare entitlement 

data. In order to receive the information, 

they must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

Other insurers, TPAs, HMOs, and 

HCPPs may require MMCS information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

6. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

MMCS data will provide for research, 

evaluation, and epidemiological 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

7. To a Member of Congress or a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries often request the help of 

a Member of Congress in resolving some 

issues relating to a matter before CMS. 

The Member of Congress then writes 

CMS, and CMS must be able to give 

sufficient information tin response to 

the inquiry. 

8. To the Department of Justice (DOJ), 

court or adjudicatory body when:

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

9. To a CMS contractor (including, but 

not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud and abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

10. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require MMCS 

information for the purpose of 

combating fraud and abuse in such 

Federally funded programs.

B. Additional Circumstances Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (12–28–00), Subparts A 

and E. Disclosures of Protected Health 

Information authorized by these routine 

Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 61391

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent NIST 

publications; the HHS Automated 

Information Systems Security Handbook 

and the CMS Information Security 

Handbook. 

V. Effect of the Modified SOR on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system of records. 

CMS will monitor the collection and 

reporting of MMCS data. MMCS 

information on individuals is completed 

by contractor personnel and submitted 

to CMS through standard systems 

located at different locations. CMS will 

utilize a variety of onsite and offsite 

edits and audits to increase the accuracy 

of MMCS data. 

CMS will take precautionary 

measures (see item IV. above) to 

minimize the risks of unauthorized 

access to the records and the potential 

harm to individual privacy or other 

personal or property rights. CMS will 

collect only that information necessary 

to perform the system’s functions. In 

addition, CMS will make disclosure of 

identifiable data from the modified 

system only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of the disclosure of 

information relating to individuals.

Dated: August 19, 2004. 

Mark B. McClellan, 

Administrator.

SYSTEM No. 09–70–4001 

SYSTEM NAME: 

‘‘Medicare Managed Care System 

(MMCS)’’ HHS/CMS/CBC 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

Recipients of Medicare hospital 

insurance (Part A) and Medicare 

medical insurance (Part B) who are 

enrolled in a Medicare Managed Care 

Plan. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The system contains information 

about a beneficiary’s health insurance 

entitlement and medical insurance 

benefits usage. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of the 

system is given under the provisions of 

§§ 1833(a)(1)(A), 1866, and 1876 of Title 

XVIII of the Social Security Act (the 

Act) (42 U.S.C. 1395(A)(1)(a), 1395cc, 

and 1395mm). 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the SOR is to 

maintain a master file of Medicare 

Managed Care Organizations (MCO) 

plan members for accounting and 

payment control; expedite the exchange 

of data with MCOs; and control the 

posting of pro-rata amounts to the Part 

B deductible of currently enrolled MCO 

members. MMCS include the following 

entities: Health Maintenance 

Organizations (HMO), Competitive 

Medical Plans (CMP), Health Care 

Prepayment Plan (HCPP), and Medicare 

Choice Organizations (MCO). 

Information in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor or consultant, (2) support 

another Federal and/or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) provider and suppliers of 

service directly or dealing through 

contractors, fiscal intermediaries (FI) or 

carriers for administration of Title XVIII; 

(4) provide information to third party 

contacts in situations where the contact 

has information relating to the 

individual’s capacity to manage his or 

her affairs; (5) other insurers, third party 

administrators (TPA), and other groups 

providing protection for their enrollees 

to assist in the processing of individual 

insurance claims (6) facilitate research 

on the quality and effectiveness of care 

provided, as well as payment-related 

projects, (7) support constituent 

requests made to a congressional 

representative, (8) support litigation 

involving the Agency, and (9 & 10) 

combat fraud and abuse in certain 

health benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the MMCS without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. We are proposing to establish 

or modify the following routine use 

disclosures of information maintained 

in the system: 

61392 Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 

1. To Agency contractors, or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

2. To support another Federal or state 

agency, agency of a state government, an 

agency established by state law, or its 

fiscal agent to:

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

3. To providers and suppliers of 

services directly or through fiscal 

intermediaries (FIs) or carriers for the 

administration of Title XVIII of the Act. 

4. To provide information to third 

party contacts in situations where the 

party to be contacted has information 

relating to the individual’s capacity to 

manage his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: the individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, a language barrier 

exists, or the custodian of the 

information will not, as a matter of 

policy, provide it to the individual), or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: the individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

5. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations (HMOs) or a competitive 

medical plan (CMP) with a Medicare 

contract, or a Medicare-approved health 

care prepayment plan (HCPP)), directly 

or through a contractor, and other 

groups providing protection for their 

enrollees. Information to be disclosed 

shall be limited to Medicare entitlement 

data. In order to receive the information, 

they must agree to:

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

6. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

7. To a Member of Congress or a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

8. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation. 

9. To a CMS contractor (including, but 

not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

10. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs.

B. ADDITIONAL CIRCUMSTANCES AFFECTING

ROUTINE USE DISCLOSURES

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (12–28–00), Subparts A 

and E. Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

Computer diskette and on magnetic 

storage media. 

RETRIEVABILITY: 

Information can be retrieved by name 

and health insurance claim number of 

the beneficiary.

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

Federal Register / Vol. 69, No. 200 / Monday, October 18, 2004 / Notices 61393

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management Of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent NIST 

publications; the HHS Automated 

Information Systems Security Handbook 

and the CMS Information Security 

Handbook. 

RETENTION AND DISPOSAL: 

Records are maintained in a secure 

storage area with identifiers. Disposal 

occurs three years from the last action 

on the hospital’s cost report, and should 

be coordinated with disposal of the 

reports. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of Managed Care 

Operations, Information Services 

Modernization Group, Office of 

Information Services, CMS, 7500 

Security Boulevard, N3–16–24, 

Baltimore, Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the systems 

manager who will require the system 

name, SSN, address, date of birth, sex, 

and for verification purposes, the 

subject individual’s name (woman’s 

maiden name, if applicable). Furnishing 

the SSN is voluntary, but it may make 

searching for a record easier and prevent 

delay. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 

5b.5(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Data for this system is collected from 

MCO (which obtained the data from the 

individuals concerned), Social Security 

Administration, and the Enrollment 

Database system of records. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None.

[FR Doc. 04–23251 Filed 10–15–04; 8:45 am] 

BILLING CODE 4120–03–P

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Administration for Children and 

Families 

Proposed Information Collection 

Activity; Comment Request 

Proposed Projects 

Title: Building Strong Families 

Demonstration and Evaluation—

Baseline Information. 

OMB No.: New Collection. 

Description: The proposed 

information collection activity is for 

baseline information during eligibility 

screening and enrollment in local 

programs participating in the Building 

Strong Families (BSF) evaluation. The 

BSF evaluation is an important 

opportunity to learn if well-designed 

interventions can help low-income 

couples develop the knowledge and 

relationship skills that research has 

shown are associated with healthy 

marriages. BSF programs will provide 

instruction and support to improve 

marriage and relationship skills and 

enhance couples’ understanding of 

marriage. In addition, BSF programs 

will provide links to a variety of other 

services that could help couples sustain 

a healthy relationship (e.g., employment 

assistance). The evaluation’s goal is to 

include a maximum of six programs that 

will add a BSF component to existing 

services and enroll into the evaluation 

approximately 2,000 couples into each 

program, i.e., 1,000 couples randomly 

assigned to participate in BSF services 

and 1,000 couples in the control group, 

for a total of 12,000 couples (24,000 

individuals). The evaluation will assess 

the net impact of the BSF interventions 

on these two groups. 

Respondents: The respondents for the 

baseline data collection will be lowincome, unmarried, expectant or recent 

parents who volunteer to participate in 

the evaluation. (Some couples may have 

been recently married since the 

conception of their child.) There will be 

four forms used in the baseline data 

collection: (1) The Mother/Father 

Eligibility Checklist; (2) the Consent to 

Participate in the BSF Study Form; (3) 

the Baseline Information Form; and (4) 

the Contact Information Form. The 

Mother/Father Eligibility Checklist will 

be used by program staff to determine if 

respondents meet the minimum 

requirements for participating in the 

BSF program. We estimate that about 25 

percent of couples interviewed will 

meet the eligibility criteria for the 

program. The Consent to Participate in 

the BSF Study Form explains in detail 

the design of the evaluation, the process 

for selection, and the results of agreeing 

to participate in the study (e.g., being 

contacted for follow-up information). 

The Baseline Information Form collects 

basic demographic information about 

respondents, as well as brief 

information concerning pregnancies and 

births, family structure, employment 

and income, and emotional well-being, 

all of which is relevant for the study. 

The Contact Information Form gathers 

information on friends and relatives 

who can assist in locating respondents 

based on respondents’ agreements to 

participate in follow-up surveys that 

will be conducted many months later. 

All forms will be administered to both 

members of the couples by BSF program 

staff members. The forms will be 

administered in a number of different 

settings, but we anticipate the two most 

common will be in hospitals, following 

the birth of children, and in the 

mother’s/father’s home shortly after 

births.