Federal Register / Vol. 75, No. 104 / Tuesday, June 1, 2010 / Notices 30411 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a 

Modified or Altered System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a Modified or Altered 

System of Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

CMS is proposing to modify or alter 

existing system of records titled 

‘‘National Provider System,’’ System No. 

09–70–0008. Under the authority of the 

Health Insurance Portability and 

Accountability Act of 1996 (HIPAA) 

Public Law (Pub. L.) 104–191, this 

system was established and published 

in the Federal Register (FR) at 63 FR 

40297 (July 28, 1998). The system name 

‘‘National Provider System’’ describes 

the original system designed to 

enumerate individual health care 

providers and maintain the information 

submitted in their application, the 

National Provider Identifier (NPI) 

Application/Update Form (Form CMS– 

10114). Expectation of the adoption of a 

standard unique health identifier for 

health plans would broaden the 

function of the system to enable it to 

assign health plan identifiers to health 

plans; as a result, the name of the 

system is proposed to read: the 

‘‘National Plan and Provider 

Enumeration System (NPPES).’’ 

Although the Federal Register Notice 

(July 28, 1998) stated that both 

organizational providers and providers 

who are individuals are included in the 

NPS database, and the system may be 

expanded in the future to include 

enumerated health plans, this system of 

records will be applicable only to the 

collection and maintenance of 

information about enumerated health 

care providers who are individuals (e.g., 

physicians and non-physician 

practitioners), containing the 

information they submitted on their NPI 

applications and their assigned NPI. 

We propose to assign a new CMS 

identification number to this system to 

simplify the obsolete and confusing 

numbering system originally designed 

to identify the Bureau, Office, or Center 

that maintained information in the 

Health Care Financing Administration 

systems of records. The new assigned 

identifying number for this system 

should read: System No. 09–70–0555. 

We propose to delete published 

routine use number 1 authorizing 

disclosure to Federal and Medicaid 

health plans that are enumerators and 

their agents. Published routine use 

number 1 will be deleted because the 

proposal to have Federal and Medicaid 

health plans serving as enumerators was 

not implemented. 

We propose to delete published 

routine use number 2 authorizing 

disclosures to entities implementing or 

maintaining systems and data files 

necessary for compliance with Title XI, 

Part C of the Social Security Act because 

the information necessary for this use is 

available in accordance with the NPS 

Data Dissemination Notice (CMS–6060– 

N) published in the Federal Register on 

May 30, 2007. 

We propose to delete routine use 

number 3 authorizing disclosure to 

support constituent requests made to a 

congressional representative. If an 

authorization for the disclosure has 

been obtained from the data subject, 

then no routine use is needed. The 

Privacy Act allows for disclosures with 

the ‘‘prior written consent’’ of the data 

subject. 

We propose to delete published 

routine use number 4 authorizing 

disclosures to another Federal agency 

for use in processing research and 

statistical data related to the 

administration of its programs because 

the information from NPPES that would 

be used for this purpose is available in 

accordance with the Notice published in 

the Federal Register on May 30, 2007 

(CMS–6060–N). 

We propose to delete published 

routine use number 6 authorizing 

disclosures to an individual or 

organization for a research, 

demonstration, evaluation, or 

epidemiological project because the 

information in NPPES that would be 

used for this purpose is available in 

accordance with the Notice published in 

the Federal Register on May 30, 2007 

(CMS–6060–N). 

We propose to delete published 

routine use number 7 authorizing 

disclosures to contractors for the 

purpose of refining ADP or 

telecommunication systems or 

supporting records in the system. 

Disclosures allowed by published 

routine use number 7 will be covered by 

a new routine use for contractors, 

consultants, or grantees who have been 

contracted by the Agency to assist with 

a CMS assigned task and who need 

access to the records in order to 

complete that task. The new routine use 

will be numbered as routine use 

number 1. 

We propose to delete routine use 

number 8 authorizing disclosures to an 

agency of the State government for 

purposes of determining effectiveness of 

health care services provided in the 

State because the information in NPPES 

that would be used for this purpose is 

available in accordance with the Notice 

published in the Federal Register on 

May 30, 2007 (CMS–6060–N). 

We propose to delete in part routine 

use number 9 authorizing disclosures to 

another Federal or State agency to fulfill 

a Federal or State statute or regulation 

that implements a program funded in 

whole or in part with Federal funds 

because the information in NPPES that 

would be used for this purpose is 

available in accordance with the Notice 

published in the Federal Register on 

May 30, 2007 (CMS–6060–N). We retain 

routine use number 9 for purposes of 

identifying health care providers for 

Debt Collection Information Act of 1996 

and the Balanced Budget Act of 1997 

and include this as routine use 

number 2. 

Routine use number 5 authorizing 

disclosures to the Department of Justice, 

to a court or other tribunal, or to another 

party before such tribunal, is revised for 

clarity and is renumbered as routine use 

number 3. 

We have added two new routine uses 

for the purposes of combating fraud, 

waste, and abuse in CMS-administered 

health benefits programs and to support 

other Federal agencies, States, and local 

government agencies in combating 

fraud, waste, and abuse in programs 

funded in whole or in part by Federal 

funds. These two routine uses are 

routine use numbers 4 and 5. 

In addition, we propose to add a new 

routine use to disclose information 

maintained in this system to respond to 

a suspected or confirmed breach of the 

security or confidentiality of 

information maintained in the system. 

This new routine use will be numbered 

as routine use 6. 

The security classification previously 

reported as ‘‘None’’ will be modified to 

reflect that data in this system are 

considered to be ‘‘Level Three Privacy 

Act Sensitive.’’ We are modifying the 

language in the remaining routine uses 

to provide a proper explanation as to the 

need for the routine use and to provide 

clarity to CMS’s intention to disclose 

individual-specific information 

contained in this system. We will also 

take the opportunity to update any 

sections of the System of Records Notice 

that were affected by the reorganization 

of CMS or to update language in the 

administrative sections to correspond 

with language used in other CMS SORs 

where appropriate. 

The purpose of the NPPES is to 

collect and maintain, on behalf of the 

Secretary, information needed to 


erowe on DSK5CLS3C1PROD with NOTICES
30412 Federal Register / Vol. 75, No. 104 / Tuesday, June 1, 2010 / Notices 

uniquely identify an individual 

physician or non-physician practitioner, 

assign a National Provider Identifier 

(NPI) to that physician or non-physician 

practitioner, and maintain and update 

the information in that health care 

provider’s record in NPPES. Information 

maintained in this system will also be 

disclosed to: (1) Support the NPI 

Enumerator and other agency 

contractors who need NPPES data to 

perform their contractual requirements; 

(2) to assist Federal and State agencies 

to identify health care providers for debt 

collection under Federal statutes; (3) to 

assist the Department of Justice in 

litigation; (4) to support CMS 

contractors in combating fraud, waste, 

and abuse in CMS-administered health 

benefits programs; (5) to support other 

Federal agencies or States in combating 

fraud, waste, and abuse in federallyfunded programs; and (6) to assist 

Federal agencies in responding to 

security breaches of information 

contained in NPPES. We have provided 

background information about the 

system in the SUPPLEMENTARY

INFORMATION section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See ‘‘Effective 

Dates’’ section for comment period. 

DATES: Effective Dates: CMS filed a 

modified or altered system report with 

the Chair of the House Committee on 

Government Reform and Oversight, the 

Chair of the Senate Committee on 

Homeland Security & Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on May 25, 2010. To ensure that 

all parties have adequate time in which 

to comment, the modified system, 

including routine uses, will become 

effective 30 days from the publication of 

the notice, or 40 days from the date it 

was submitted to OMB and Congress, 

whichever is later, unless CMS receives 

comments that require alterations to this 

notice. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Information Security and 

Privacy Management, Enterprise 

Architecture and Strategy Group, Office 

of Information Services, CMS, Room 

N2–24–08, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

Comments received will be available for 

review at this location, by appointment, 

during regular business hours, Monday 

through Friday from 9 a.m.—3 p.m., 

Eastern Time zone. 

FOR FURTHER INFORMATION CONTACT: 

Patricia Peyton, Office of Financial 

Management, Program Integrity Staff, 

Division of Provider/Supplier 

Enrollment, Centers for Medicare & 

Medicaid Services, 7500 Security 

Boulevard, Mail Stop C3–02–16, 

Baltimore, Maryland 21244–1850. The 

telephone number is 410–786–1812 or 

contact Patricia.Peyton@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: 

I. Description of the Modified or 

Altered System of Records 

A. Statutory and Regulatory Basis for 

this SOR 

Authority for maintenance of this 

system is given under §§ 1173 and 1175 

of the Act; as amended by Public Law 

104–191, authorize the assignment of a 

unique identifier to all health care 

providers and the maintenance of a data 

base containing the information they 

furnished in their application for an 

NPI. 

B. Collection and Maintenance of Data 

in the System 

For purposes of this SOR, the system 

contains information related to health 

care providers who are individuals who 

have applied for and have been assigned 

a NPI. The definition of a health care 

provider is limited to those entities that 

furnish or bill and are paid for, health 

care services in the normal course of 

business. The statutory definition of a 

health care provider is found at 45 CFR 

160.103. 

The system contains name(s), 

demographic information, (gender, date 

of birth), provider taxonomy 

information, address data, contact 

information, practice location 

information, and certain optional 

information such as social security 

numbers and provider identifiers 

assigned to these health care providers 

by health plans. 

II. Agency Policies, Procedures, and 

Restrictions on Routine Use 

A. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

The Privacy Act permits us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such disclosure of 

data is known as a ‘‘routine use.’’ The 

government will only release NPPES 

information that can be associated with 

an individual as provided for under 

‘‘Section III. Proposed Routine Use 

Disclosures of Data in the System.’’ Both 

individually identifiable and nonindividually-identifiable data may be 

disclosed under a routine use. 

We will only disclose the minimum 

personal data necessary to achieve the 

purpose of NPPES. CMS has the 

following policies and procedures 

concerning disclosures of information 

that is maintained in the system. 

Disclosure of information from the 

system will be approved only to the 

extent necessary to accomplish the 

purpose of the disclosure and only after 

CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected; e.g., 

maintain information to uniquely 

identify an individual physician or nonphysician practitioner, assign a National 

Provider Identifier (NPI) to that 

physician or non-physician practitioner, 

and maintain and update information 

about that physician or non-physician. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use or disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all individually-identifiable 

information; and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 

following routine use disclosures of 

information maintained in the system: 


erowe on DSK5CLS3C1PROD with NOTICES
Federal Register / Vol. 75, No. 104 / Tuesday, June 1, 2010 / Notices 30413 

1. To support Agency contractors 

(such as the NPI Enumerator contractor), 

consultants, or grantees that have been 

contracted by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor, consultant, or 

grantee whatever information is 

necessary for the contractor, consultant, 

or grantee to fulfill its duties. In these 

situations, safeguards are provided in 

the contract prohibiting the contractor, 

consultant, or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To assist another Federal or State 

agency, agency of a State government, 

agency established by State law, or its 

fiscal agent to identify health care 

providers for debt collection under the 

provisions of the Debt Collection 

Information Act of 1996 and the 

Balanced Budget Act of 1997. 

3. Federal or State agencies, agencies 

of State governments, agencies 

established by State law, or their fiscal 

agents may need NPPES data to assist 

them in collecting debts from health 

care providers as authorized by the Debt 

Collection Information Act of 1996 and 

the Balanced Budget Act of 1997. To 

assist the Department of Justice (DOJ), 

court, or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government is a 

party of litigation or has an interest in 

such litigation and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court, or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

4. To support a CMS contractor that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

5. We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud, waste, or abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

6. To support another Federal agency 

or an instrumentality of any 

governmental jurisdiction within or 

under the control of the United States 

(including any State or local 

governmental agency) that administers, 

or that has the authority to investigate, 

potential fraud or abuse in a program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

Other agencies may require NPPES 

information for the purpose of 

combating fraud, waste, or abuse in 

such Federally-funded programs. 

7. To assist appropriate Federal 

agencies and Department contractors 

that have a need to know the 

information for the purpose of assisting 

the Department’s efforts to respond to a 

suspected or confirmed breach of the 

security or confidentiality of 

information maintained in this system 

of records, and the information 

disclosed is relevant and unnecessary 

for the assistance. 

Other Federal agencies and 

contractors may require NPPES 

information for the purpose of assisting 

in a response to a suspected or 

confirmed breach of the security or 

confidentiality of information. 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against unauthorized 

use. Personnel having access to the 

system have been trained in the Privacy 

Act and information security 

requirements to maintain the 

confidentiality of protected information. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: The Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the Modified System of 

Records on Individual Rights 

CMS proposes to modify this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system of records. 

CMS will take precautionary 

measures (see item IV above) to 

minimize the risks of unauthorized 

access to the records and the potential 

harm to individual privacy or other 

personal or property rights of physicians 

and non-physician practitioners whose 

data are maintained in the system. CMS 

will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 


erowe on DSK5CLS3C1PROD with NOTICES
30414 Federal Register / Vol. 75, No. 104 / Tuesday, June 1, 2010 / Notices 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, in accordance with an 

applicable exception provision of the 

Privacy Act. CMS, therefore, does not 

anticipate an unfavorable effect on 

individual privacy as a result of 

information relating to individuals. 

Dated: May 25, 2010. 

Michelle Snyder, 

Deputy Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

SYSTEM NUMBER: 09–70–0555 

SYSTEM NAME: 

‘‘National Plan and Provider 

Enumeration System’’ (NPPES), HHS/ 

CMS/OFM’’. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive 

Data. 

SYSTEM LOCATION: 

The Centers for Medicare & Medicaid 

Services (CMS) Data Center, 7500 

Security Boulevard, North Building, 

First Floor, Baltimore, Maryland 21244– 

1850. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

For purposes of this SOR, the system 

contains information related to health 

care providers who are individuals who 

have applied for and have been assigned 

a NPI. The definition of a health care 

provider is limited to those entities that 

furnish or bill and are paid for, health 

care services in the normal course of 

business. The statutory definition of a 

health care provider is found at 45 CFR 

160.103. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The system contains name(s), 

demographic information, (gender, date 

of birth), provider taxonomy 

information, address data, contact 

information, practice location 

information, and certain optional 

information such as social security 

numbers and provider identifiers 

assigned to these health care providers 

by health plans. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of this 

system is given under §§ 1173 and 1175 

of the Act; as amended by Public Law 

104–191, authorize the assignment of a 

unique identifier to all health care 

providers and the maintenance of a data 

base on containing the information they 

furnished in their application for an 

NPI. 

PURPOSE(S) OF THE SYSTEM: 

The purpose of the NPPES is to 

collect and maintain, on behalf of the 

Secretary, information needed to 

uniquely identify an individual 

physician or non-physician practitioner, 

assign a National Provider Identifier 

(NPI) to that physician or non-physician 

practitioner, and maintain and update 

the information in that health care 

provider’s record in NPPES. Information 

maintained in this system will also be 

disclosed to: (1) Support the NPI 

Enumerator and other agency 

contractors who need NPPES data to 

perform their contractual requirements; 

(2) to assist Federal and State agencies 

to identify health care providers for debt 

collection under Federal statutes; (3) to 

assist the Department of Justice in 

litigation; (4) to support CMS 

contractors in combating fraud, waste, 

and abuse in CMS-administered health 

benefits programs; (5) to support other 

Federal agencies or States in combating 

fraud, waste, and abuse in federallyfunded programs; and (6) to assist 

Federal agencies in responding to 

security breaches of information 

contained in NPPES. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 

following routine use disclosures of 

information maintained in the system: 

1. To support Agency contractors 

(such as the NPI Enumerator contractor), 

consultants, or grantees that have been 

contracted by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. 

2. To assist another Federal or State 

agency, agency of a State government, 

agency established by State law, or its 

fiscal agent to identify health care 

providers for debt collection under the 

provisions of the Debt Collection 

Information Act of 1996 and the 

Balanced Budget Act of 1997. 

3. To assist the Department of Justice 

(DOJ), court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

4. To support a CMS contractor that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

5. To support another Federal agency 

or to an instrumentality of any 

governmental jurisdiction within or 

under the control of the United States 

(including any State or local 

governmental agency), that administers, 

or that has the authority to investigate 

potential fraud or abuse in a program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

6. To assist appropriate Federal 

agencies and Department contractors 

that have a need to know the 

information for the purpose of assisting 

the Department’s efforts to respond to a 

suspected or confirmed breach of the 

security or confidentiality of 

information maintained in this system 

of records, and the information 

disclosed is relevant and unnecessary 

for the assistance. 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on paper and 

magnetic disk. 

RETRIEVABILITY: 

Magnetic media records are retrieved 

by the name of the health care provider 

or the NPI. Paper records are retrieved 

alphabetically by name of health care 

provider or the NPI. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 


erowe on DSK5CLS3C1PROD with NOTICES
Federal Register / Vol. 75, No. 104 / Tuesday, June 1, 2010 / Notices 30415 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements to maintain the 

confidentiality of protected information. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: the Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain identifiable data 

indefinitely in accordance with 69 FR 

3434. 

SYSTEM MANAGERS AND ADDRESS: 

Director, Division of Provider/ 

Supplier Enrollment, Office of Financial 

Management, CMS, 7500 Security 

Boulevard, Baltimore, Maryland 21244– 

1850. 

NOTIFICATION PROCEDURE: 

For purpose of access by a subject 

individual, the subject individual may 

access to view or update his or her own 

record in NPPES by using his or her 

NPPES User ID and password or the 

subject individual should write to the 

system manager who will require the 

system name, the subject individual’s 

SSN, and, for verification purposes, the 

subject individual’s name (woman’s 

maiden name, if applicable). NPPES 

data that are publicly available may be 

found in the NPI Registry at https:// 

nppes.cms.gov/NPPES/ 

NPIRegistryHome.do and in the 

downloadable monthly NPPES File at 

http://nppesdata.cms.gov/ 

CMS_NPI_files.html. 

RECORD ACCESS PROCEDURE: 

For purpose of access, the same 

procedures outlined in Notification 

Procedures above are applicable to 

subject individuals. Other requestors 

must write to the system manager and 

specify the record contents being 

sought. (These procedures are in 

accordance with Department regulation 

45 CFR 5b.5 (a)(2).) 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7.) 

RECORD SOURCE CATEGORIES: 

Information contained in this system 

is received from the Form(s) CMS– 

10114, ‘‘National Provider Identifier 

Application/Update Form.’’ 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 2010–12996 Filed 5–28–10; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HOMELAND 

SECURITY 

Federal Emergency Management 

Agency 

[Internal Agency Docket No. FEMA–3310– 

EM; Docket ID FEMA–2010–0002] 

Minnesota; Amendment No. 1 to Notice 

of an Emergency Declaration 

AGENCY: Federal Emergency 

Management Agency, DHS. 

ACTION: Notice. 

SUMMARY: This notice amends the notice 

of an emergency declaration for the 

State of Minnesota (FEMA–3310–EM), 

dated March 19, 2010, and related 

determinations. 

DATES: Effective Date: April 26, 2010. 

FOR FURTHER INFORMATION CONTACT: 

Peggy Miller, Recovery Directorate, 

Federal Emergency Management 

Agency, 500 C Street, SW., Washington, 

DC 20472, (202) 646–3886. 

SUPPLEMENTARY INFORMATION: Notice is 

hereby given that the incident period for 

this emergency is closed effective April 

26, 2010. 

(The following Catalog of Federal Domestic 

Assistance Numbers (CFDA) are to be used 

for reporting and drawing funds: 97.030, 

Community Disaster Loans; 97.031, Cora 

Brown Fund; 97.032, Crisis Counseling; 

97.033, Disaster Legal Services; 97.034, 

Disaster Unemployment Assistance (DUA); 

97.046, Fire Management Assistance Grant; 

97.048, Disaster Housing Assistance to 

Individuals and Households in Presidentially 

Declared Disaster Areas; 97.049, 

Presidentially Declared Disaster Assistance— 

Disaster Housing Operations for Individuals 

and Households; 97.050, Presidentially 

Declared Disaster Assistance to Individuals 

and Households—Other Needs; 97.036, 

Disaster Grants—Public Assistance 

(Presidentially Declared Disasters); 97.039, 

Hazard Mitigation Grant.) 

W. Craig Fugate, 

Administrator, Federal Emergency 

Management Agency. 

[FR Doc. 2010–13047 Filed 5–28–10; 8:45 am] 

BILLING CODE 9111–23–P 

DEPARTMENT OF HOMELAND 

SECURITY 

Federal Emergency Management 

Agency 

[Internal Agency Docket No. FEMA–1898– 

DR; Docket ID FEMA–2010–0002] 

Pennsylvania; Amendment No. 1 to 

Notice of a Major Disaster Declaration 

AGENCY: Federal Emergency 

Management Agency, DHS. 

ACTION: Notice. 

SUMMARY: This notice amends the notice 

of a major disaster declaration for the 

Commonwealth of Pennsylvania 

(FEMA–1898–DR), dated April 16, 2010, 

and related determinations. 

DATES: Effective Date: May 24, 2010. 

FOR FURTHER INFORMATION CONTACT: 

Peggy Miller, Recovery Directorate, 

Federal Emergency Management 

Agency, 500 C Street, SW., Washington, 

DC 20472, (202) 646–3886. 

SUPPLEMENTARY INFORMATION: The notice 

of a major disaster declaration for the 

Commonwealth of Pennsylvania is 

hereby amended to include the 

following areas among those areas 

determined to have been adversely 

affected by the event declared a major 

disaster by the President in his 

declaration of April 16, 2010. 

All counties in the Commonwealth of 

Pennsylvania are eligible to apply for 

assistance under the Hazard Mitigation Grant 

Program. 

The following Catalog of Federal Domestic 

Assistance Numbers (CFDA) are to be used 

for reporting and drawing funds: 97.030, 

Community Disaster Loans; 97.031, Cora 

Brown Fund; 97.032, Crisis Counseling; 

97.033, Disaster Legal Services; 97.034, 

Disaster Unemployment Assistance (DUA); 

97.046, Fire Management Assistance Grant; 

97.048, Disaster Housing Assistance to 

Individuals and Households in Presidentially 

Declared Disaster Areas; 97.049, 

Presidentially Declared Disaster Assistance— 


erowe on DSK5CLS3C1PROD with NOTICES