Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26121 

Nebraska 

Arsenic in Soil in East Omaha, 

Nebraska; March 20, 2007. 

New Jersey 

Celotex Corporation; January 10, 2007. 

North Carolina 

APAC Carolina Inc. and Associated 

Asphalt Inc., Jake Alexander 

Boulevard; February 14, 2007. 

Weyerhaeuser Pulp and Paper Mill—

Exposure Investigation Report; March 

22, 2007. 

Pennsylvania 

Ivy Industrial Park Site—Public Health 

Evaluation of Residential Indoor Air 

and Well Water Sample Results; 

March 5, 2007. 

Remacor Site; January 10, 2007. 

Tennessee 

Mr. Zip Convenience Store; March 14, 

2007. 

Texas 

Former Delroc Oil Refinery/Woodwind 

Lakes Subdivision; February 23, 2007. 

Utah 

Vermiculite Intermountain and 

Intermountain Products, Inc.—

Epidemiological Investigation of 

Human Exposure to a Contaminated 

Vermiculite Ore Processing Site in 

Utah; March 1, 2007. 

Washington 

Home Heating Oil Release, Technical 

Review of the Site Hazard 

Assessment; March 29, 2007. 

Wisconsin 

Amery-Dresser Trail; January 23, 2007. 

Dated: May 2, 2007. 

Kenneth Rose, 

Acting Director, Office of Policy, Planning, 

and Evaluation, National Center for 

Environmental Health/Agency for Toxic 

Substances and Disease Registry. 

[FR Doc. E7–8758 Filed 5–7–07; 8:45 am] 

BILLING CODE 4163–70–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a 

Modified or Altered System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a Modified or Altered 

System of Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

CMS is proposing to modify or alter 

existing system of records titled 

‘‘Complaints Against Health Insurance 

Issuers and Health Plans (CAHII),’’

System No. 09–70–9005, established at 

66 FR 9858, (February 12, 2001). We 

propose to assign a new CMS 

identification number to this system to 

simplify the obsolete and confusing 

numbering system originally designed 

to identify the Bureau, Office, or Center 

that maintained information in the 

Health Care Financing Administration 

systems of records. The new assigned 

identifying number for this system 

should read: System No. 09–70–0516. 

We propose to modify existing routine 

use number 1 that permits disclosure to 

agency contractors and consultants to 

include disclosure to CMS grantees who 

perform a task for the agency. CMS 

grantees, charged with completing 

projects or activities that require CMS 

data to carry out that activity, are 

classified separate from CMS 

contractors and/or consultants. The 

modified routine use will remain as 

routine use number 1. We will delete 

routine use number 2 authorizing 

disclosure to support constituent 

requests made to a congressional 

representative. If an authorization for 

the disclosure has been obtained from 

the data subject, then no routine use is 

needed. The Privacy Act allows for 

disclosures with the ‘‘prior written 

consent’’ of the data subject. 

We propose to add 2 new routine uses 

authorizing disclosure to support a CMS 

contractor, consultant, or a grantee of a 

CMS-administered grant program, when 

disclosure is deemed reasonably 

necessary by CMS to combat fraud, 

waste, and abuse in certain health care 

programs. The new routine use will be 

published as routine use number 6. We 

will add a second new routine use to 

support another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States, when disclosure is 

deemed reasonably necessary by CMS to 

combat fraud, waste, and abuse in 

certain health care programs. This new 

routine use will be published as routine 

use number 7. We will broaden the 

scope of this system by including the 

section titled ‘‘Additional 

Circumstances Affecting Routine Use 

Disclosures,’’ that addresses ‘‘Protected 

Health Information (PHI)’’ and ‘‘small 

cell size.’’ The requirement for 

compliance with HHS regulation 

‘‘Standards for Privacy of Individually 

Identifiable Health Information’’ apply 

when ever the system collects or 

maintain PHI. This system may contain 

PHI. In addition, our policy to prohibit 

release if there is a possibility that an 

individual can be identified through 

‘‘small cell size’’ will apply to the data 

disclosed from this system. 

We are modifying the language in the 

remaining routine uses to provide a 

proper explanation as to the need for the 

routine use and to provide clarity to 

CMS’s intention to disclose individualspecific information contained in this 

system. The routine uses will then be 

prioritized and reordered according to 

their usage. We will also take the 

opportunity to update any sections of 

the system that were affected by the 

recent reorganization or because of the 

impact of the Medicare Prescription 

Drug, Improvement, and Modernization 

Act of 2003 (MMA) (Pub. L. 108–173) 

provisions and to update language in 

the administrative sections to 

correspond with language used in other 

CMS SORs. 

The primary purpose of this system is 

to collect and maintain information 

initiated by consumers complaints/ 

reports to CMS that their health 

insurance issuers and/or non-Federal 

governmental health plans are in 

violation of one or more of the following 

statutes: §§ 2722 and 2761 of the Public 

Health Service (PHS) Act; the Mental 

Health Parity Act of 1996 (MHPA); the 

Newborns’ and Mothers’ Health 

Protection Act of 1996 (NMHPA); and, 

the Women’s Health and Cancer Rights 

Act of 1998 (WHCRA). Information 

maintained in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor, consultant or grantee; (2) 

assist another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs or 

to his or her eligibility for, or an 

entitlement to benefits under the 

Medicare program; (4) inform a health 

insurance issuer and/or health plan who 

has been named in a complaint/inquiry 

and is believed to be potentially in 

violation of relevant portions of the 

PHS; (5) support litigation involving the 

Agency; and (6) combat fraud, waste, 

and abuse in certain health benefits 

programs. We have provided 

background information about this new 

system in the SUPPLEMENTARY

INFORMATION section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 


cprice-sewell on PROD1PC66 with NOTICES
26122 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

all portions of this notice. See ‘‘Effective 

Dates’’ section for comment period. 

DATES: Effective Dates: CMS filed a new 

system report with the Chair of the 

House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Homeland 

Security and Governmental Affairs, and 

the Administrator, Office of Information 

and Regulatory Affairs, Office of 

Management and Budget (OMB) on 

April 12, 2007. To ensure that all parties 

have adequate time in which to 

comment, the new SOR, including 

routine uses, will become effective 40 

days from the publication of the notice, 

or from the date it was submitted to 

OMB and the Congress, whichever is 

later, unless CMS receives comments 

that require alterations to this notice. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance, 

Enterprise Architecture and Strategy 

Group, Office of Information Services, 

CMS, Room N2–04–27, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. Comments received will be 

available for review at this location, by 

appointment, during regular business 

hours, Monday through Friday from 9 

a.m.—3 p.m., Eastern Time zone. 

FOR FURTHER INFORMATION CONTACT: 

Dave Mlawsky, Health Insurance 

Specialist, Division of Employer 

Operations, Employer Policy and 

Operations Group, Center for 

Beneficiary Choices, CMS, 7500 

Security Boulevard, Mail Stop S3–16–

26, Baltimore, Maryland 21244–1850. 

The telephone number is 410–786–6851 

or e-mail david.mlawsky@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: 

I. Description of the Modified or 

Altered System of Records 

A. Statutory and Regulatory Basis for 

SOR 

Authority for maintenance of this 

system is given under §§ 2722 and 2761 

of the Public Health Service (PHS) Act; 

the Mental Health Parity Act of 1996 

(MHPA); the Newborns’ and Mothers’

Health Protection Act of 1996 

(NMHPA); and the Women’s Health and 

Cancer Rights Act of 1998 (WHCRA) 

with respect to non-Federal 

governmental plans. 

B. Collection and Maintenance of Data 

in the System 

This system will collect and maintain 

individually identifiable and other data 

collected on individuals/consumers 

who make complaints/inquiries to CMS 

that their health insurance issuers and/ 

or non-Federal governmental health 

plans are in violation of the PHS. 

The system contains information such 

as consumer’s name, address, phone 

number, the name and address of their 

health plan or health insurance issuer, 

their plan ID number or social security 

number, the nature of their complaint/ 

inquiry against their health plan or 

issuer, and any medical and other 

additional information that is necessary 

for CAHII to help resolve the 

consumer’s complaint. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The government will 

only release CAHII information that can 

be associated with an individual as 

provided for under ‘‘Section III. 

Proposed Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of CAHII. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the SOR 

will be approved only to the extent 

necessary to accomplish the purpose of 

the disclosure and only after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

data is being collected; e.g., to collect 

and maintain information initiated by 

consumers complaints/reports to CMS 

that their health insurance issuers and/ 

or non-Federal governmental health 

plans are in violation of the PHS; 

2. Determines that the purpose for 

which the disclosure is to be made can 

only be accomplished if the record is 

provided in individually identifiable 

form; 

a. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

b. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all patient-identifiable information; 

and; 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Modified Routine Use Disclosures of 

Data in the System 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 

following routine use disclosures of 

information maintained in the system: 

1. To support Agency contractors, 

consultants, or grantees that have been 

contracted by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. We contemplate 

disclosing information under this 

routine use only in situations in which 

CMS may enter into a contractual or 

similar agreement with a third party to 

assist in accomplishing a CMS function 

relating to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor, consultant, or 

grantee whatever information is 

necessary for the contractor, consultant, 

or grantee to fulfill its duties. In these 

situations, safeguards are provided in 

the contract prohibiting the contractor, 

consultant, or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To assist another Federal or state 

agency, agency of a state government, an 

agency established by state law, or its 

fiscal agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 


cprice-sewell on PROD1PC66 with NOTICES
Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26123 

c. Refer a complaint or inquiry with 

respect to Title I of the Health Insurance 

Portability and Accountability Act of 

1996 (HIPAA), the Mental Health Parity 

Act of 1996 (MHPA), the Newborns’ and 

Mothers’ Health Protection Act of 1996 

(NMHPA), and the Women’s Health and 

Cancer Rights Act of 1998 (WHCRA). 

CAHII shares enforcement 

responsibilities with the U.S. 

Department of Labor, the U.S. 

Department of Treasury and State 

regulatory bodies with respect to Title I 

of HIPAA, MHPA, NMHPA and 

WHCRA. CAHII’s enforcement 

responsibilities are discussed in the 

‘‘Description of the New System of 

Records’’ section above. The 

Department of Labor enforces Title I of 

HIPAA, MHPA, NMHPA and WHCRA 

with respect to private group health 

plans. The Department of Treasury may 

levy excise taxes against private group 

health plans that do not comply with 

these Acts, except for WHCRA. In States 

that are substantially enforcing Title I of 

PHS, MHPA, NMHPA and WHCRA, the 

appropriate State agency enforces these 

provisions with respect to health 

insurance issuers. 

Occasionally, CAHII will receive an 

inquiry or complaint related to one of 

these four Acts in situations where it is 

within Labor’s or Treasury’s or a State’s, 

and not CAHII’s, jurisdiction to resolve. 

In such cases, CAHII must disclose 

information from the system of records 

to the appropriate agency so they can 

perform their enforcement function. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require CAHII information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

In addition, other state agencies in 

their administration of a Federal health 

program may require CAHII information 

for the purposes of determining, 

evaluating and/or assessing cost, 

effectiveness, and /or the quality of 

health care services provided in the 

state. 

3. To assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs or 

to his or her eligibility for, or an 

entitlement to, benefits under the 

Medicare program and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exist, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: The individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

Third parties contacts require CAHII 

information in order to provide support 

for the individual’s entitlement to 

benefits under the Medicare program; to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, and assist 

in the monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement of services 

provided. 

4. To inform a health insurance issuer 

and/or health plan, who has been 

named in a complaint and is believed to 

be potentially in violation of relevant 

portions of the PHS Act. 

When individuals file complaints or 

inquiries asking CAHII to clarify or 

enforce their rights under Title I of the 

Health Insurance Portability and 

Accountability Act of 1996 (HIPAA), the 

Mental Health Parity Act of 1996 

(MHPA), the Newborns’ and Mothers’

Health Protection Act of 1996 

(NMHPA), and the Women’s Health and 

Cancer Rights Act of 1998 (WHCRA), 

CAHII often must disclose information 

maintained in this system of records to 

the individual’s health insurance issuer 

or health plan in order for CAHII to 

satisfy its statutory charge to enforce 

these Federal Acts with respect to nonFederal governmental health plans in all 

States and health insurance issuers in 

some States. 

5. To assist the Department of Justice 

(DOJ), court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

6. To support a CMS contractor that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste or abuse in such programs. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud, waste or abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

7. To support another Federal agency 

or to an instrumentality of any 

governmental jurisdiction within or 

under the control of the United States 

(including any state or local 

governmental agency), that administers, 

or that has the authority to investigate 

potential fraud, waste, or abuse in a 

program funded in whole or in part by 

Federal funds, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 


cprice-sewell on PROD1PC66 with NOTICES
26124 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste or abuse in such programs. 

Other agencies may require CAHII 

information for the purpose of 

combating fraud, waste or abuse in such 

Federally-funded programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

To the extent this system contains 

Protected Health Information (PHI) as 

defined by HHS regulation ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information’’ (45 CFR parts 160 

and 164, subparts A and E) 65 FR 82462 

(12–28–00). Disclosures of such PHI that 

are otherwise authorized by these 

routine uses may only be made if, and 

as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’ (See 

45 CFR 164.512 (a) (1).) 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against unauthorized 

use. Personnel having access to the 

system have been trained in the Privacy 

Act and information security 

requirements. Employees who maintain 

records in this system are instructed not 

to release data until the intended 

recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: The Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the Modified or Altered 

System of Records on Individual Rights 

CMS proposes to modify this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system of records. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights of 

patients whose data are maintained in 

the system. CMS will collect only that 

information necessary to perform the 

system’s functions. In addition, CMS 

will make disclosure from the proposed 

system only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. CMS, therefore, does not 

anticipate an unfavorable effect on 

individual privacy as a result of 

information relating to individuals. 

Dated: April 12, 2007. 

Charlene Frizzera, 

Acting Chief Operating Officer Centers for 

Medicare & Medicaid Services. 

System No. 09–70–0516. 

SYSTEM NAME: 

• Complaints Against Health 

Insurance Issuers and Health Plans 

(CAHII),’’ HHS/CMS/CBC. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive 

Data. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850 and at 

various other contractor locations. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

This system will collect and maintain 

individually identifiable and other data 

collected on individuals/consumers 

who make complaints/inquiries to CMS 

that their health insurance issuers and/ 

or non-Federal governmental health 

plans are in violation of the PHS ACT. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The system contains information such 

as consumer’s name, address, phone 

number, the name and address of their 

health plan or health insurance issuer, 

their plan ID number or social security 

number, the nature of their complaint/ 

inquiry against their health plan or 

issuer, and any medical and other 

additional information that is necessary 

for CAHII to help resolve the 

consumer’s complaint. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of this 

system is given under §§ 2722 and 2761 

of the Public Health Service (PHS) Act; 

the Mental Health Parity Act of 1996 

(MHPA); the Newborns’ and Mothers’

Health Protection Act of 1996 

(NMHPA); and the Women’s Health and 

Cancer Rights Act of 1998 (WHCRA) 

with respect to non-Federal 

governmental plans. 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of this system is 

to collect and maintain information 

initiated by consumers complaints/ 

reports to CMS that their health 

insurance issuers and/or non-Federal 

governmental health plans are in 

violation of one or more of the following 

statutes: §§ 2722 and 2761 of the Public 

Health Service (PHS) Act; the Mental 

Health Parity Act of 1996 (MHPA); the 

Newborns’ and Mothers’ Health 

Protection Act of 1996 (NMHPA); and , 

the Women’s Health and Cancer Rights 

Act of 1998 (WHCRA). Information 

maintained in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the Agency or by a 

contractor, consultant or grantee; (2) 

assist another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent; (3) assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs or 

to his or her eligibility for, or an 

entitlement to benefits under the 

Medicare program; (4) inform a health 

insurance issuer and/or health plan who 

has been named in a complaint/inquiry 

and is believed to be potentially in 

violation of relevant portions of the PHS 

ACT; (5) support litigation involving the 

Agency; and (6) combat fraud, waste, 

and abuse in certain health benefits 

programs. 


cprice-sewell on PROD1PC66 with NOTICES
Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 26125 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. The Privacy Act allows us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such compatible use of data is 

known as a ‘‘routine use.’’ The proposed 

routine uses in this system meet the 

compatibility requirement of the Privacy 

Act. We are proposing to establish the 

following routine use disclosures of 

information maintained in the system: 

1. To support Agency contractors, 

consultants, or grantees that have been 

contracted by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. 

2. To assist another Federal or state 

agency, agency of a state government, an 

agency established by state law, or its 

fiscal agent to: 

a. Contribute to the accuracy of CMS’s 

payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Refer a complaint or with respect to 

Title I of the Health Insurance 

Portability and Accountability Act of 

1996 (HIPAA), the Mental Health Parity 

Act of 1996 (MHPA), the Newborns’ and 

Mothers’ Health Protection Act of 1996 

(NMHPA), and the Women’s Health and 

Cancer Rights Act of 1998 (WHCRA). 

3. To assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs or 

to his or her eligibility for, or an 

entitlement to, benefits under the 

Medicare program and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exists, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: The individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

4. To inform a health insurance issuer 

and/or health plan, who has been 

named in a complaint and is believed to 

be potentially in violation of relevant 

portions of the PHS Act. 

5. To assist the Department of Justice 

(DOJ), court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. any employee of the Agency in his 

or her official capacity, or 

c. any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. the United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

6. To support a CMS contractor that 

assists in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

7. To support another Federal agency 

or to an instrumentality of any 

governmental jurisdiction within or 

under the control of the United States 

(including any state or local 

governmental agency), that administers, 

or that has the authority to investigate 

potential fraud or abuse in a program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

To the extent this system contains 

Protected Health Information (PHI) as 

defined by HHS regulation ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information’’ (45 CFR parts 160 

and 164, subparts A and E) 65 FR 82462 

(12–28–00). Disclosures of such PHI that 

are otherwise authorized by these 

routine uses may only be made if, and 

as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’ (See 

45 CFR 164.512 (a) (1)). 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on electronic 

media. 

RETRIEVABILITY: 

The collected data are retrieved by an 

individual identifier; e.g., consumer’s 

name or health insurance claims 

number, if, applicable. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against unauthorized 

use. Personnel having access to the 

system have been trained in the Privacy 

Act and information security 

requirements. Employees who maintain 

records in this system are instructed not 

to release data until the intended 

recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations may apply 

but are not limited to: The Privacy Act 

of 1974; the Federal Information 

Security Management Act of 2002; the 


cprice-sewell on PROD1PC66 with NOTICES
26126 Federal Register / Vol. 72, No. 88 / Tuesday, May 8, 2007 / Notices 

Computer Fraud and Abuse Act of 1986; 

the Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain information for a total 

period not to exceed 6 years. All claimsrelated records are encompassed by the 

document preservation order and will 

be retained until notification is received 

from DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of Policy, Employer 

Policy and Operations Group, Center for 

Beneficiary Choices, CMS, 7500 

Security Boulevard, Baltimore, 

Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, employee identification number, 

tax identification number, national 

provider number, and for verification 

purposes, the subject individual’s name 

(woman’s maiden name, if applicable), 

HICN, and/or SSN (furnishing the SSN 

is voluntary, but it may make searching 

for a record easier and prevent delay). 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 (a) 

(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORDS SOURCE CATEGORIES: 

The data collected and maintained in 

this system are retrieved from 

individuals/consumers who file 

complaints/reports to CMS that their 

health insurance issuers and/or nonFederal governmental health plans are 

in violation of the PHS ACT. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. E7–8757 Filed 5–7–07; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a 

Modified System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Center for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a Modified System of 

Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to modify or alter a 

system titled, ‘‘End Stage Renal Disease 

(ESRD) Program Management and 

Medical Information System (PMMIS), 

System No. 09–70–0520,’’ and last 

modified at 67 Fed. Reg. 41244 (June 17, 

2002). This system contains records on 

individuals with ESRD who are entitled 

to receive Medicare benefits or who are 

treated by Department of Veteran Affairs 

(DVA) health care facilities. We propose 

to modify existing routine use number 

1 that permits disclosure to agency 

contractors and consultants to include 

disclosure to CMS grantees who perform 

a task for the agency. The modified 

routine use will remain as routine use 

number 1. For further clarity, we 

propose to separate existing routine use 

number 3 that permit disclosures to 

ESRD Network Organizations and to 

Quality Improvement Organizations into 

separate routine uses. The activities 

performed by the 2 different type 

organizations are not so closely related 

that they should be combined in one 

routine use. The modified routine use 

will be republished as routine use 

number 3 for ESRD Network 

Organizations and routine use number 4 

for Quality Improvement Organizations. 

We will delete routine use number 5 

authorizing disclosure to support 

constituent requests made to a 

congressional representative. If an 

authorization for the disclosure has 

been obtained from the data subject, 

then no routine use is needed. The 

Privacy Act allows for disclosures with 

the ‘‘prior written consent’’ of the data 

subject. 

We propose to broaden the scope of 

the disclosure provisions of this system 

by adding a routine use to permit the 

release of priority personal information 

to complete a transfer out event from a 

losing ESRD facility and/or a transfer-in 

event to a gaining ESRD facility to: (1) 

Contribute to the accuracy of CMS’

proper payment of Medicare benefits; 

and (2) enable such facilities to ensure 

the proper transfer of health records, 

and/or as necessary to enable such a 

facility to fulfill a requirement of a 

Federal statute or regulation that 

implements a health benefits program 

funded in whole or in part with Federal 

funds; (3) assist ESRD programs which 

may require PMMIS information for 

purposes related to this system. 

Information will be released to these 

organizations upon specific request, and 

only for those organizations if they meet 

the following requirements: (1) Provide 

an attestation or other qualifying 

information that they are providing 

assistance to qualified ESRD 

beneficiaries; (2) submit a report of the 

transfer-in or transfer-out event; (3) 

safeguard the confidentiality of the data 

and prevent unauthorized access; and 

(4) complete a written statement 

attesting to the information recipient’s 

understanding of and willingness to 

abide by these provisions. The PMMIS 

data will provide the ESRD facility with 

information regarding its enrollees’

enrollment status, transplant activities, 

dialysis activities, and Medicare 

utilization; facilitate the facility’s 

required utilization reviews and 

medication management program 

activities; and assist in quality of care 

issues as they relate to the beneficiary. 

The added routine use will be 

numbered as routine use number 6. 

We are modifying the language in the 

remaining routine uses to provide a 

proper explanation as to the need for the 

routine use and to provide clarity to 

CMS’s intention to disclose individualspecific information contained in this 

system. The routine uses will then be 

prioritized and reordered according to 

their usage. We will also take the 

opportunity to update any sections of 

the system that were affected by the 

recent reorganization or because of the 

impact of the Medicare Prescription 

Drug, Improvement, and Modernization 

Act of 2003 (MMA) (Pub. L. 108–173) 

provisions and to update language in 

the administrative sections to 

correspond with language used in other 

CMS SORs. 


cprice-sewell on PROD1PC66 with NOTICES