26126 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain information for a total 

period not to exceed 6 years. All claimsrelated records are encompassed by the 

document preservation order and will 

be retained until notification is received 

from DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of Policy, Employer 

Policy and Operations Group, Center for 

Beneficiary Choices, CMS, 7500 

Security Boulevard, Baltimore, 

Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, employee identification number, 

tax identification number, national 

provider number, and for verification 

purposes, the subject individual’s name 

(woman’s maiden name, if applicable), 

HICN, and/or SSN (furnishing the SSN 

is voluntary, but it may make searching 

for a record easier and prevent delay). 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 (a) 

(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORDS SOURCE CATEGORIES: 

The data collected and maintained in 

this system are retrieved from 

individuals/consumers who file 

complaints/reports to CMS that their 

health insurance issuers and/or nonFederal governmental health plans are 

in violation of the PHS ACT. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. E7–8757 Filed 5–7–07; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a 

Modified System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Center for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a Modified System of 

Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to modify or alter a 

system titled, ‘‘End Stage Renal Disease 

(ESRD) Program Management and 

Medical Information System (PMMIS), 

System No. 09–70–0520,’’ and last 

modified at 67 Fed. Reg. 41244 (June 17, 

2002). This system contains records on 

individuals with ESRD who are entitled 

to receive Medicare benefits or who are 

treated by Department of Veteran Affairs 

(DVA) health care facilities. We propose 

to modify existing routine use number 

1 that permits disclosure to agency 

contractors and consultants to include 

disclosure to CMS grantees who perform 

a task for the agency. The modified 

routine use will remain as routine use 

number 1. For further clarity, we 

propose to separate existing routine use 

number 3 that permit disclosures to 

ESRD Network Organizations and to 

Quality Improvement Organizations into 

separate routine uses. The activities 

performed by the 2 different type 

organizations are not so closely related 

that they should be combined in one 

routine use. The modified routine use 

will be republished as routine use 

number 3 for ESRD Network 

Organizations and routine use number 4 

for Quality Improvement Organizations. 

We will delete routine use number 5 

authorizing disclosure to support 

constituent requests made to a 

congressional representative. If an 

authorization for the disclosure has 

been obtained from the data subject, 

then no routine use is needed. The 

Privacy Act allows for disclosures with 

the ‘‘prior written consent’’ of the data 

subject. 

We propose to broaden the scope of 

the disclosure provisions of this system 

by adding a routine use to permit the 

release of priority personal information 

to complete a transfer out event from a 

losing ESRD facility and/or a transfer-in 

event to a gaining ESRD facility to: (1) 

Contribute to the accuracy of CMS’

proper payment of Medicare benefits; 

and (2) enable such facilities to ensure 

the proper transfer of health records, 

and/or as necessary to enable such a 

facility to fulfill a requirement of a 

Federal statute or regulation that 

implements a health benefits program 

funded in whole or in part with Federal 

funds; (3) assist ESRD programs which 

may require PMMIS information for 

purposes related to this system. 

Information will be released to these 

organizations upon specific request, and 

only for those organizations if they meet 

the following requirements: (1) Provide 

an attestation or other qualifying 

information that they are providing 

assistance to qualified ESRD 

beneficiaries; (2) submit a report of the 

transfer-in or transfer-out event; (3) 

safeguard the confidentiality of the data 

and prevent unauthorized access; and 

(4) complete a written statement 

attesting to the information recipient’s 

understanding of and willingness to 

abide by these provisions. The PMMIS 

data will provide the ESRD facility with 

information regarding its enrollees’

enrollment status, transplant activities, 

dialysis activities, and Medicare 

utilization; facilitate the facility’s 

required utilization reviews and 

medication management program 

activities; and assist in quality of care 

issues as they relate to the beneficiary. 

The added routine use will be 

numbered as routine use number 6. 

We are modifying the language in the 

remaining routine uses to provide a 

proper explanation as to the need for the 

routine use and to provide clarity to 

CMS’s intention to disclose individualspecific information contained in this 

system. The routine uses will then be 

prioritized and reordered according to 

their usage. We will also take the 

opportunity to update any sections of 

the system that were affected by the 

recent reorganization or because of the 

impact of the Medicare Prescription 

Drug, Improvement, and Modernization 

Act of 2003 (MMA) (Pub. L. 108–173) 

provisions and to update language in 

the administrative sections to 

correspond with language used in other 

CMS SORs. 


cprice-sewell on PROD1PC66 with NOTICES
Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26127 

The primary purpose of the system of 

records is to maintain information on 

Medicare ESRD beneficiaries, nonMedicare ESRD patients, Medicare 

approved ESRD hospitals and dialysis 

facilities, and Department of Veterans 

Affairs (DVA) patients. The ESRD/ 

PMMIS is used by CMS and the renal 

community to perform their duties and 

responsibilities in monitoring the 

Medicare status, transplant activities, 

dialysis activities, and Medicare 

utilization (inpatient and physician/ 

supplier bills) of ESRD patients and 

their Medicare providers, as well as in 

calculating the Medicare covered 

periods of ESRD. Information retrieved 

from this system of records will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor, consultant or grantee; (2) 

assist another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) support an ESRD Network 

Organizations; (4) assist Quality 

Improvement Organizations (QIO) to 

implement quality improvement 

programs; (5) facilitate research on the 

quality and effectiveness of care 

provided and payment related projects; 

(6) permit the release of priority 

personal information to complete a 

transfer out event and/or a transfer-in 

event; (7) support litigation involving 

the agency; and, (8) combat fraud, 

waste, and abuse in certain health 

benefits programs. We have provided 

background information about the new 

system in the SUPPLEMENTARY

INFORMATION section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See Effective 

Dates section for comment period. 

DATES: Effective Dates: CMS filed a 

modified or altered system report with 

the Chair of the House Committee on 

Government Reform and Oversight, the 

Chair of the Senate Committee on 

Homeland Security & Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on April 12, 2007. To ensure that 

all parties have adequate time in which 

to comment, the modified system, 

including routine uses, will become 

effective 30 days from the publication of 

the notice, or 40 days from the date it 

was submitted to OMB and Congress, 

whichever is later, unless CMS receives 

comments that require alterations to this 

notice. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance, 

Enterprise Architecture and Strategy 

Group, Office of Information Services, 

CMS, Room N2–04–27, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. Comments received will be 

available for review at this location, by 

appointment, during regular business 

hours, Monday through Friday from 9 

a.m.–3 p.m., eastern time zone. 

FOR FURTHER INFORMATION CONTACT: 

Dennis Stricker, Director, Information 

Support Group, Office of Clinical 

Standards and Quality, CMS, Room S3–

02–01, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. The 

telephone number is (410) 786–3116. 

The e-mail address is 

dennis.stricker@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: 

I. Description of the Proposed System of 

Records 

A. Statutory and Regulatory Basis for 

SOR 

The statutory authority for this system 

is given under the provisions of 

Sections 226A, 1875, and 1881 of the 

Social Security Act (the Act) (Title 42 

United States Code (U.S.C.), sections 

426–1, 1395ll, and 1395rr). 

B. Collection and Maintenance of Data 

in the System 

This system will collect and maintain 

individually identifiable and other data 

collected on individuals with ESRD 

who receive Medicare benefits or who 

are treated by DVA health care facilities. 

The system contains information on 

both the beneficiary and the provider of 

services. 

The collected information will 

include, but is not limited to 

beneficiary/patient medical records, 

claims data, and payment data collected 

from several non-reimbursement data 

collection instruments and Medicare 

bills. The provider of services’ name, 

address, Medicare identification 

number, types of services provided, 

certification and or termination date, 

and ESRD network number. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The Government will 

only release PMMIS information that 

can be associated with an individual as 

provided for under ‘‘Section III. 

Proposed Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. We will 

only collect the minimum personal data 

necessary to achieve the purpose of 

PMMIS. 

CMS has the following policies and 

procedures concerning disclosures of 

information that will be maintained in 

the system. Disclosure of information 

from the system will be approved only 

to the extent necessary to accomplish 

the purpose of the disclosure and only 

after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected; e.g., to 

maintain information on Medicare 

ESRD beneficiaries, non-Medicare ESRD 

patients, Medicare approved ESRD 

hospitals and dialysis facilities, and 

Department of Veterans Affairs (DVA) 

patients. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy, at the earliest 

time, all patient-identifiable 

information; and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 


cprice-sewell on PROD1PC66 with NOTICES
26128 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

following routine use disclosures of 

information maintained in the system: 

1. To agency contractors, consultants 

or grantees, who have been engaged by 

the agency to assist in the performance 

of a service related to this collection and 

who need to have access to the records 

in order to perform the activity. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing CMS function relating to 

purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor, consultant or 

grantee whatever information is 

necessary for the contractor, consultant 

or grantee to fulfill its duties. In these 

situations, safeguards are provided in 

the contract prohibiting the contractor, 

consultant or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor, 

consultant or grantee to return or 

destroy all information at the 

completion of the contract. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Determine compliance with the 

Federal conditions that an ESRD facility 

must meet in order to participate in 

Medicare. 

Other Federal or State agencies in 

their administration of a federal health 

program may require PMMIS 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

In addition, other state agencies in 

their administration of a Federal health 

program may require PMMIS 

information for the purposes of 

determining, evaluating and/or 

assessing cost, effectiveness, and/or the 

quality of health care services provided 

in the state. 

In addition, disclosure under this 

routine use shall be used by state 

agencies pursuant to agreements with 

the HHS for determining Medicare 

eligibility, for quality control studies, 

for determining eligibility of recipients 

of assistance under titles IV, XVIII, and 

XIX of the Act, and for the 

administration of the Medicare program. 

Data will be released to the state only on 

those individuals who are patients 

under the services of a program within 

the state or who are residents of that 

state. 

We also contemplate disclosing 

information under this routine use in 

situations in which state auditing 

agencies require PMMIS information for 

auditing eligibility considerations. CMS 

may enter into an agreement with state 

auditing agencies to assist in 

accomplishing functions relating to 

purposes for this system of records. 

3. To ESRD Network Organizations in 

connection with review of claims, or in 

connection with studies or quality 

improvements projects or other review 

activities, and in performing affirmative 

outreach activities to individuals for the 

purpose of establishing and maintaining 

their entitlement to Medicare benefits or 

health insurance plans. 

ESRD Network Organizations will 

work to implement quality 

improvement programs, provide 

consultation to CMS, its contractors, 

and its state agencies, in connection 

with studies or quality improvements 

projects or in performing affirmative 

outreach activities to individuals. 

4. To Quality Improvement 

Organizations in connection with 

review of claims, or in connection with 

studies or quality improvements 

projects or other review activities, 

conducted pursuant to Part B of Title XI 

of the Social Security Act and in 

performing affirmative outreach 

activities to individuals for the purpose 

of establishing and maintaining their 

entitlement to Medicare benefits or 

health insurance plans. 

QIOs will work to implement quality 

improvement programs, provide 

consultation to CMS, its contractors, 

and its state agencies, in connection 

with studies or quality improvements 

projects or other review activities. 

The QIOs will assist the state agencies 

in related monitoring and enforcement 

efforts; assist CMS and intermediaries in 

program integrity assessment; and 

prepare summary information for 

release to CMS. 

5. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

The PMMIS data will provide for 

research or support of evaluation 

projects and a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policies that 

govern their care. 

6. To assist with a transfer out event 

from a losing ESRD facility and/or a 

transfer-in event to a gaining ESRD 

facility to: 

a. Contribute to the accuracy of CMS’

proper payment of Medicare benefits; 

and 

b. Enable such facilities to ensure the 

proper transfer of health records, and/or 

as necessary to enable such a facility to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; and 

c. Assist ESRD programs which may 

require PMMIS information for 

purposes related to this system. 

Information will be released to these 

facilities upon specific request, and only 

for those facilities if they meet the 

following requirements: 

a. Provide an attestation or other 

qualifying information that they are 

providing assistance to qualified ESRD 

beneficiaries/patients; 

b. Submit a report of the transfer-in or 

transfer-out event with the following 

required priority information: Name, 

address, HICN or SSN, date of birth; 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access; 

and 

d. complete a written statement 

attesting to the information recipient’s 

understanding of and willingness to 

abide by these provisions. 

Both the gaining and losing facilities 

may require priority information 

submitted as a transfer-in or transfer-out 

report to implement quality transfer of 

beneficiaries from one facility to 

another; provide consultation to CMS, 

its contractors, and its state agencies, in 

connection with transfer of patients. 

7. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 


cprice-sewell on PROD1PC66 with NOTICES
Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26129 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, and occasionally when 

another party is involved in litigation 

and CMS policies or operations could be 

affected by the outcome of the litigation, 

CMS would be able to disclose 

information to the DOJ, court or 

adjudicatory body involved. 

8. To a CMS contractor (including, but 

not necessarily limited to, fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such program. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual, grantee, cooperative 

agreement or consultant relationship 

with a third party to assist in 

accomplishing CMS functions relating 

to the purpose of combating fraud, 

waste, or abuse. CMS occasionally 

contracts out certain of its functions or 

makes grants or cooperative agreements 

when doing so would contribute to 

effective and efficient operations. CMS 

must be able to give a contractor, 

grantee, consultant or other legal agent 

whatever information is necessary for 

the agent to fulfill its duties. In these 

situations, safeguards are provided in 

the contract prohibiting the agent from 

using or disclosing the information for 

any purpose other than that described in 

the contract and requiring the agent to 

return or destroy all information. 

9. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any State 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud, waste, or 

abuse in, a health benefits program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

Other agencies may require PMMIS 

information for the purpose of 

combating fraud, waste, and abuse in 

such Federally-funded programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

To the extent this system contains 

Protected Health Information (PHI) as 

defined by HHS regulation ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information’’ (45 CFR parts 160 

and 164, subparts A and E) 65 Fed. Reg. 

82462 (12–28–00). Disclosures of such 

PHI that are otherwise authorized by 

these routine uses may only be made if, 

and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’ (See 

45 CFR 164–512 (a)(1)). 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors of such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: The Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the Modified System of 

Records on Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system of records. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights of 

patients whose data are maintained in 

this system. CMS will collect only that 

information necessary to perform the 

system’s functions. In addition, CMS 

will make disclosure from the proposed 

system only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. CMS, therefore, does not 

anticipate an unfavorable effect on 

individual privacy as a result of 

information relating to individuals. 

Dated: April 12, 2007. 

Charlene Frizzera, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

System No. 09–70–0520. 

SYSTEM NAME: 

‘‘ESRD Program Management and 

Medical Information (PMMIS),’’ HHS/ 

CMS/OCSQ. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive 

Data. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850 and at 

various other contractor locations. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

This system will collect and maintain 

individually identifiable and other data 

collected on individuals with ESRD 

who receive Medicare benefits or who 

are treated by DVA health care facilities. 

The system contains information on 

both the beneficiary and the provider of 

services. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The collected information will 

include, but is not limited to 


cprice-sewell on PROD1PC66 with NOTICES
26130 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

beneficiary/patient medical records, 

claims data, and payment data collected 

from several non-reimbursement data 

collection instruments and Medicare 

bills. The provider of services’ name, 

address, Medicare identification 

number, types of services provided, 

certification and or termination date, 

and ESRD network number. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

The statutory authority for this system 

is given under the provisions of 

Sections 226A, 1875, and 1881 of the 

Social Security Act (the Act) (Title 42 

United States Code (U.S.C.), sections 

426–1, 1395ll, and 1395rr). 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the system of 

records is to maintain information on 

Medicare ESRD beneficiaries, nonMedicare ESRD patients; Medicare 

approved ESRD hospitals and dialysis 

facilities, and Department of Veterans 

Affairs (DVA) patients. The ESRD/ 

PMMIS is used by CMS and the renal 

community to perform their duties and 

responsibilities in monitoring the 

Medicare status, transplant activities, 

dialysis activities, and Medicare 

utilization (inpatient and physician/ 

supplier bills) of ESRD patients and 

their Medicare providers, as well as in 

calculating the Medicare covered 

periods of ESRD. Information retrieved 

from this system of records will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor, consultant or grantee; (2) 

assist another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) support an ESRD Network 

Organizations; (4) assist Quality 

Improvement Organizations (QIO) to 

implement quality improvement 

programs; (5) facilitate research on the 

quality and effectiveness of care 

provided and payment related projects; 

(6) permit the release of priority 

personal information to complete a 

transfer out event and/or a transfer-in 

event; (7) support litigation involving 

the agency; and, (8) combat fraud, 

waste, and abuse in certain health 

benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 

following routine use disclosures of 

information maintained in the system: 

1. To agency contractors, consultants 

or grantees, who have been engaged by 

the agency to assist in the performance 

of a service related to this collection and 

who need to have access to the records 

in order to perform the activity. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Determine compliance with the 

Federal conditions that an ESRD facility 

must meet in order to participate in 

Medicare. 

3. To ESRD Network Organizations in 

connection with review of claims, or in 

connection with studies or quality 

improvements projects or other review 

activities, and in performing affirmative 

outreach activities to individuals for the 

purpose of establishing and maintaining 

their entitlement to Medicare benefits or 

health insurance plans. 

4. To Quality Improvement 

Organizations in connection with 

review of claims, or in connection with 

studies or quality improvements 

projects or other review activities, 

conducted pursuant to Part B of Title XI 

of the Social Security Act and in 

performing affirmative outreach 

activities to individuals for the purpose 

of establishing and maintaining their 

entitlement to Medicare benefits or 

health insurance plans. 

5. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

6. To assist with a transfer out event 

from a losing ESRD facility and/or a 

transfer-in event to a gaining ESRD 

facility to: 

a. Contribute to the accuracy of CMS’

proper payment of Medicare benefits; 

and 

b. Enable such facilities to ensure the 

proper transfer of health records, and/or 

as necessary to enable such a facility to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; and 

c. Assist ESRD programs which may 

require PMMIS information for 

purposes related to this system. 

Information will be released to these 

facilities upon specific request, and only 

for those facilities if they meet the 

following requirements: 

d. Provide an attestation or other 

qualifying information that they are 

providing assistance to qualified ESRD 

beneficiaries/patients; 

e. Submit a report of the transfer-in or 

transfer-out event with the following 

required priority information: Name, 

address, HICN or SSN, date of birth; 

f. Safeguard the confidentiality of the 

data and prevent unauthorized access; 

and 

g. Complete a written statement 

attesting to the information recipient’s 

understanding of and willingness to 

abide by these provisions. 

7. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

8. To a CMS contractor (including, but 

not necessarily limited to, fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such program. 

9. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any State 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud, waste, or 

abuse in, a health benefits program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 


cprice-sewell on PROD1PC66 with NOTICES
Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26131 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures: To the extent 

this system contains Protected Health 

Information (PHI) as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR parts 160 and 164, 

subparts A and E) 65 FR 82462 (12–28–

00). Disclosures of such PHI that are 

otherwise authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’ (See 45 CFR 164–

512 (a) (1)). 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on electronic 

media. 

RETRIEVABILITY: 

The collected data are retrieved by an 

individual identifier; e.g., beneficiary 

name or HICN, and unique provider 

identification number. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: The Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

Records will be retained until an 

approved disposition authority is 

obtained from the National Archives 

and Records Administration. All claimsrelated records are encompassed by the 

document preservation order and will 

be retained until notification is received 

from DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Information Support Group, 

Office of Clinical Standards and 

Quality, CMS, Room S3–02–01, 7500 

Security Boulevard, Baltimore, 

Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, employee identification number, 

tax identification number, national 

provider number, and for verification 

purposes, the subject individual’s name 

(woman’s maiden name, if applicable), 

HICN, and/or SSN (furnishing the SSN 

is voluntary, but it may make searching 

for a record easier and prevent delay). 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 (a) 

(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORDS SOURCE CATEGORIES: 

The data contained in these records 

are obtained from Medicare ESRD 

medical evidence reports, kidney 

transplant reports, ESRD beneficiary 

reimbursement method selection forms, 

ESRD death notification forms, 

Medicare bills, CMS Medicare Master 

files, ESRD facility surveys, ESRD 

facility certification notices, and the 

Medicare/Medicaid Automated 

Certification System (MMACS). 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

Appendix A 

1. ESRD Network of New England, 

Incorporated, Post Office Box 9484, New 

Haven, Connecticut 06534. 

2. ESRD Network of New York, 

Incorporated, 1249 Fifth Avenue, A–419, 

New York, New York 10029. 

3. Trans-Atlantic Renal Council, Cranbury 

Plaza, 2525 Route 130—Building C, 

Cranbury, New Jersey 08512–9595. 

4. ESRD Network Organization Number 4, 

200 Lothrop Street, Pittsburgh, Pennsylvania 

15213–2582. 

5. Mid-Atlantic Renal Coalition, 1527 

Huguenot Road, Midlothian, Virginia 23113. 

6. Southeastern Kidney Council, 

Incorporated, 1000 Saint Albans Drive, Suite 

270, Raleigh, North Carolina 27609. 

7. ESRD Network of Florida, Incorporated, 

One Davis Boulevard, Suite 304, Tampa, 

Florida 33606. 

8. Network 8, Incorporated, Post Office Box 

55868, Jackson, Mississippi 39296–5868. 

9 & 10. The Renal Network, Incorporated, 

911 East 86th Street, Suite 202, Indianapolis, 

Indiana 46240. 

11. Renal Network of the Upper Midwest, 

970 Raymond Avenue #205, Saint Paul, 

Minnesota 55114. 

12. ESRD Network Number 12, 7509 NW 

T Tiffany Spring Parkway, Suite 105, Kansas 

City, Missouri 64153. 

13. ESRD Network Organization Number 

13, 6600 North Meridan Avenue, Suite 155, 

Oklahoma City, Oklahoma 73116–1411. 

14. ESRD Network of Texas, Incorporated, 

14114 Dallas Parkway, Suite 660, Dallas, 

Texas 75240–4349. 

15. Intermountain ESRD Network, 

Incorporated, 1301 Pennsylvania Street, Suite 

220, Denver, Colorado 80203–5012. 

16. Northwest Renal Network, 4702 42nd 

Avenue, Seattle, Washington 98116. 

17. TransPacific Renal Network, 25 

Mitchell Boulevard, Suite 7, San Rafael, 

California 94903. 

18. Southern California Renal Disease 

Council, 6255 Sunset Boulevard, Suite 2211, 

Los Angeles, California 90082. 

[FR Doc. E7–8759 Filed 5–7–07; 8:45 am] 

BILLING CODE 4120–03–P 


cprice-sewell on PROD1PC66 with NOTICES