47190 Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 

external partnerships to advance the 

science, practice and workforce for 

eliminating health disparities inside/ 

outside CDC; (6) maintains critical 

linkages with federal partners including 

the Office of the Secretary, Department 

of Health and Human Services, and 

represents CDC on related scientific and 

policy committees; (7) establishes 

external advisory capacity and internal 

advisory and action capacity; (8) 

improves support of efforts to improve 

minority health and achieve health 

equity in the U.S. by collaborating with 

CDC’s National Centers and other 

entities; (9) synthesizes, disseminates, 

and encourages use of scientific 

evidence regarding effective 

interventions to achieve health 

disparities elimination outcomes; (10) 

analyzes trends in and determinants of 

health disparities to provide decision 

support to CDC’s Executive Leadership 

in allocating CDC resources to agencywide programs for surveillance, 

research, intervention and evaluation; 

(11) positions CDC to address relevant 

provisions in the 2010 Patient 

Protection and Affordable Care Act that 

address health disparities; (12) 

strengthens CDC’s global health work to 

achieve equity; (13) supports CDC’s 

response to public health emergencies 

in vulnerable populations; and (14) 

ensures administrative effectiveness and 

efficiency of agency-wide efforts to 

achieve health equity. 

II. Delegation of Authority: All 

delegations and redelegations of 

authority made to officials and 

employees of affected organizational 

components will continue in them or 

their successors pending further 

redelegation, provided they are 

consistent with this reorganization. 

Authority: 44 U.S.C. 3101. 

Dated: July 27, 2011. 

Carlton Duncan, 

Acting Chief Operating Officer, Centers for 

Disease Control and Prevention. 

[FR Doc. 2011–19739 Filed 8–3–11; 8:45 am] 

BILLING CODE 4160–18–M 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of Modified 

or Altered System 

AGENCY: Centers for Medicare & 

Medicaid Services, Department of 

Health and Human Services (HHS). 

ACTION: Notice of Modified or Altered 

System of Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to modify or alter a 

SOR titled, ‘‘Medicare Advantage 

Prescription Drug (MARx) System, No. 

09–70–4001,’’ last modified at 70 FR 

60530 (October 18, 2005). CMS proposes 

to broaden the data collected and stored 

by this system as part of a redesign and 

modernization of the MARx System. On 

December 8, 2003, Congress passed the 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173). MMA 

amended the Social Security Act (the 

Act) by adding the Medicare Part D 

Program under Title XVIII and 

mandated that CMS establish a 

voluntary Medicare prescription drug 

benefit program effective January 1, 

2006. Under the Medicare Part D 

benefit, the Act allows Medicare 

payment to plans that contract with 

CMS to provide qualified Part D 

prescription drug coverage as described 

in 42 Code of Federal Regulations (CFR) 

423.401. The MARx System processes 

all enrollment/disenrollment 

transactions associated with the Part D 

program. 

The modified MARx System will 

accept and store Health Plan-supplied 

beneficiary residence addresses on an 

initial Part C and/or Part D enrollment 

or a subsequent record update 

transaction from the Plan. The main 

source of beneficiary residence address 

is the Social Security Administration 

(SSA). The address SSA provides, 

however, may not be the beneficiary’s 

residence address. Beneficiary addresses 

are initially provided by SSA from the 

beneficiary’s enrollment in Part A and/ 

or Part B, and frequently reflect an 

address of a representative payee or a 

Post Office (P.O.) Box, not the residence 

of the beneficiary. This limits the 

effectiveness of geographically-sensitive 

Plan payment decisions. Plans have 

more accurate beneficiary address 

information, which is updated on a 

case-by-case basis. CMS wishes to allow 

this data to be transmitted in initial 

enrollment and subsequent record 

update transactions from the Plans, and 

additionally translated into valid 

residence address State and County 

Codes for subsequent use in service area 

determination. Support for Plansupplied residence address will 

improve the accurate application of 

geographically sensitive rates in Plan 

payment calculation. The Plan-supplied 

beneficiary residence address will be 

updated and saved with the 

beneficiary’s enrollment data in the 

MARx System. The residence address 

provided by the Plan will only apply to 

periods when the beneficiary is enrolled 

in that Plan. 

We propose to modify existing routine 

use number 1 that permits disclosure to 

agency contractors and consultants to 

include disclosure to CMS grantees who 

perform a task for the agency. CMS 

grantees, charges with completing 

projects or activities that require CMS 

data to carry out that activity, are 

classified separate from CMS 

contractors and/or consultants. The 

modified routine use will remain as 

routine use number 1. We will delete 

routine use number 7 authorizing 

disclosure to support constituent 

requests made to a congressional 

representative. If an authorization for 

the disclosure has been obtained from 

the data subject, then no routine use is 

needed. 

We will broaden the scope of 

published routine uses number 8 and 9, 

authorizing disclosures to combat fraud 

and abuse in the Medicare and 

Medicaid programs to include 

combating ‘‘waste’’ which refers to 

specific beneficiary/recipient practices 

that result in unnecessary cost to all 

Federally-funded health benefit 

programs. We will add a new routine 

use authorizing disclosure of 

individually identifiable information to 

assist in efforts to respond to a 

suspected or confirmed breach of the 

security or confidentiality of 

information maintained in these 

systems of records. 

We are modifying the language in the 

remaining routine uses to provide a 

proper explanation as to the need for the 

routine use and to provide clarity to 

CMS’s intention to disclose individualspecific information contained in this 

system. The routine uses will then be 

prioritized and reordered according to 

their usage. We will also take the 

opportunity to update language in the 

administrative sections to correspond 

with language used in other CMS SORs. 

We propose to assign a new CMS 

identification number to this system to 

simplify the obsolete and confusing 

numbering system originally designed 

to identify the Bureau, Office, or Center 

that maintained information in the 

Health Care Financing Administration 

systems of records. The new assigned 

identifying number for this system 

should read: System No. 09–70–0588. 

The primary purpose of the SOR is to 

maintain a master file of Medicare 

Advantage (MA) and Medicare 

Advantage Prescription Drug (MA–PD) 

plan members for accounting and 

payment control; expedite the exchange 

of data with MA and MA–PD; control 

the posting of pro-rata amounts to the 

Part B deductible of currently enrolled 


sroberts on DSK5SPTVN1PROD with NOTICES
Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 47191 

MA members; and track participation of 

the prescription drug benefits provided 

under prescription drug plans (PDPs) 

and Medicare employer plans. 

Information in this system is disclosed 

to: (1) Support regulatory, 

reimbursement, and policy functions 

performed by a contractor, consultant, 

or CMS grantee contracted by the 

Agency; (2) support another Federal or 

State agency, agency of a state 

government, an agency established by 

state law, or its fiscal agent; (3) assist 

providers and suppliers of service 

directly or dealing through contractors, 

fiscal intermediaries (FI) or carriers for 

the administration of Title XVIII 

Medicaid state agency; (4) assist third 

party contacts in situations where the 

party to be contacted has, or is expected 

to have information relating to the 

individual’s capacity to manage his or 

her affairs; (5) assist insurance 

companies, third party administrators, 

employers, self-insurers, managed care 

organizations, and other supplemental 

insurers; (6) facilitate research on the 

quality and effectiveness of care 

provided, as well as payment-related 

projects; (7) support litigation involving 

the Agency; (8) combat fraud and abuse 

in certain health benefits programs, and 

(9) assist in a response to a suspected or 

confirmed breach of the security or 

confidentiality of information. CMS has 

provided background information about 

the modified system in the 

SUPPLEMENTARY INFORMATION section 

below. Although the Privacy Act 

requires only that CMS provide an 

opportunity for interested persons to 

comment on the proposed routine uses, 

CMS invites comments on all portions 

of this notice. See ‘‘Effective Dates’’ 

section for comment period. 

DATES: Effective Dates: CMS filed a 

modified or altered system report with 

the Chair of the House Committee on 

Government Reform and Oversight, the 

Chair of the Senate Committee on 

Governmental Affairs, and the 

Administrator, Office of Information 

and Regulatory Affairs, Office of 

Management and Budget (OMB) on July 

28, 2011. To ensure that all parties have 

adequate time in which to comment, the 

modified or altered SOR, including 

routine uses, will become effective 40 

days from the publication of the notice, 

or from the date it was submitted to 

OMB and the Congress, whichever is 

later, unless CMS receives comments 

that require alterations to this notice. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Information Security & 

Privacy Management (DISPM), CMS, 

Room N1–24–08, 7500 Security 

Boulevard, Baltimore, Maryland 21244– 

1850. Comments received will be 

available for review at this location, by 

appointment, during regular business 

hours, Monday through Friday from 

9 a.m.–3 p.m., Eastern daylight time. 

FOR FURTHER INFORMATION CONTACT: 

Ronald Graham, Director, Division of 

MA & Part D Application Analysis, 

Information Services Design and 

Development Group, Office of 

Information Services, CMS, Room N3– 

18–07, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. The 

telephone number is 410–786–1513. 

SUPPLEMENTARY INFORMATION: CMS will 

redesign and modernize the MARx 

System to simplify the data model, 

modernize the design to build 

independent component services, and 

align the system processes to the 

business cycle. Taking a businesscentric approach to the design of this 

system will better meet customer and 

CMS needs while reducing maintenance 

costs. This will provide CMS with a 

more flexible system able to respond to 

changing and evolving programmatic 

needs with greater immediacy than is 

possible today with the legacy MARx 

design. 

The redesign and modernization of 

the MARx System will provide 

enhanced Medicare Part C and Part D 

functionality to improve processing 

efficiencies and better support current 

and future business needs to: (1) 

Receive, validate and disseminate data 

for beneficiary membership in Part C 

and Part D Plans; (2) Calculate and 

disseminate beneficiary premium 

amounts, including dissemination to 

premium withholding agencies; and (3) 

Calculate and disseminate Plan payment 

amounts. 

I. Description of the Modified System of 

Records 

A. Statutory and Regulatory Basis for 

the System 

Authority for maintenance of the 

system is given under Section 101 of the 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173) amended 

the Title XVIII of the Social Security 

Act. Authority for maintenance of the 

system is also given under the 

provisions of §§ 1833(a)(1)(A), 1860, 

1866, and 1876 of Title XVIII of the Act 

(42 U.S.C. 1395(A)(1)(a), 1395cc, and 

1395mm). 

B. Collection and Maintenance of Data 

in the System 

The system includes information on 

recipients of Medicare hospital 

insurance (Part A), Medicare medical 

insurance (Part B), and recipients of the 

Prescription Drug Benefits Program (Part 

D) enrolled in the Medicare Advantage 

(MA) Program (Part C). The system also 

includes information about a 

beneficiary’s entitlement to Medicare 

benefits and enrollment in Medicare 

Programs, prescription drug coverage 

and supplementary medical claims 

information. The system collects 

identifying information such as 

beneficiary name, health insurance 

claim number (HICN), social security 

number, and other demographic 

information such as residence address. 

II. Agency Policies, Procedures, and 

Restrictions on Routine Uses 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The government will 

only release MARx information that can 

be associated with an individual as 

provided for under ‘‘Section III. 

Proposed Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. 

CMS will only collect the minimum 

personal data necessary to achieve the 

purpose of MARx. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the SOR 

will be approved only to the extent 

necessary to accomplish the purpose of 

the disclosure and only after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

data is being collected; e.g., maintain a 

master file of MA and MA–PD plan 

members for accounting and payment 

control; expedite the exchange of data 

with MA and MA–PD; control the 

posting of pro-rata amounts to the Part 

B deductible of currently enrolled MA 

members; and track participation of the 

prescription drug benefits provided 

under private prescription drug plans 

and Medicare employer plans. 

2. Determines that the purpose for 

which the disclosure is to be made can 

only be accomplished if the record is 

provided in individually identifiable 

form; 

a. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 


sroberts on DSK5SPTVN1PROD with NOTICES
47192 Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 

b. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all patient-identifiable information; 

and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the MARx without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. CMS is not proposing to 

establish any new or modify any of the 

following existing routine use 

disclosures of information maintained 

in the system as part of the redesign and 

modernization of the MARx System: 

1. To Agency contractors, consultants, 

or CMS grantees that have been 

contracted by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. 

CMS contemplates disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor, consultant, or CMS 

grantees whatever information is 

necessary for the contractor or 

consultant to fulfill its duties. In these 

situations, safeguards are provided in 

the contract prohibiting the contractor, 

consultant, or CMS grantees from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor, 

consultant, or CMS grantees to return or 

destroy all information at the 

completion of the contract. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require MARx information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

Disclosure under this routine use 

shall be used by state Medicaid agencies 

pursuant to agreements with the HHS 

for determining Medicaid and Medicare 

eligibility, for quality control studies, 

for determining eligibility of recipients 

of assistance under Titles IV, XVIII, and 

XIX of the Act, and for the 

administration of the Medicaid program. 

Data will be released to the state only on 

those individuals who are patients 

under the services of a Medicaid 

program within the state or who are 

residents of that state. 

CMS also contemplates disclosing 

information under this routine use in 

situations in which state auditing 

agencies require MARx information for 

auditing state Medicaid eligibility 

considerations. CMS may enter into an 

agreement with state auditing agencies 

to assist in accomplishing functions 

relating to purposes for this system to 

providers and suppliers of services 

directly or through fiscal intermediaries 

or carriers for the administration of Title 

XVIII of the Act. 

3. To assist providers and suppliers of 

services directly or through fiscal 

intermediaries or carriers for the 

administration of Title XVIII of the Act. 

Providers and suppliers of services 

require MARx information in order to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, as it 

concerns the individual’s entitlement to 

benefits under the Medicare program, 

including proper reimbursement for 

services provided. 

4. To third party contacts in situations 

where the party to be contacted has, or 

is expected to have information relating 

to the individual’s capacity to manage 

his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exist, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: The individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

Third party contacts require MARx 

information in order to provide support 

for the individual’s entitlement to 

benefits under the Medicare program; to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, and assist 

in the monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement of services 

provided. 

5. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations (HMOs) or a competitive 

medical plan with a Medicare contract, 

or a Medicare-approved health care 

prepayment plan (HCPP)), directly or 

through a contractor, and other groups 

providing protection for their enrollees. 

Information to be disclosed shall be 


sroberts on DSK5SPTVN1PROD with NOTICES
Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 47193 

limited to Medicare entitlement data. In 

order to receive the information, they 

must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

Other insurers, TPAs, HMOs, and 

HCPPs may require MARx information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

6. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

MARx data will provide for research, 

evaluation, and epidemiological 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

7. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

8. To a CMS contractor (including, but 

not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

or to a CMS grantee of a CMSadministered grant program, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

CMS contemplates disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud and abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or CMS grantee 

whatever information is necessary for 

the contractor or CMS grantee to fulfill 

its duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or CMS grantee from 

using or disclosing the information for 

any purpose other than that described in 

the contract and requiring the contractor 

or CMS grantee to return or destroy all 

information. 

9. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require MARx 

information for the purpose of 

combating fraud and abuse in such 

Federally-funded programs. 

10. To appropriate Federal agencies, 

Department officials and Agency 

contractors that need access to 

identifiable information to provide 

assistance to the Department’s efforts to 

respond to a suspected or confirmed 

breach of the security or confidentiality 

of information. In order to receive the 

information, CMS must: 

a. Determines that the use or 

disclosure does not violate legal 

limitations under which the record was 

provided, collected, or obtained; 

b. Determines that the purpose for 

which the disclosure is to be made: 

(1) Cannot be reasonably 

accomplished unless the record is 

provided in individually identifiable 

form, 

(2) Is of sufficient importance to 

warrant the effect and/or risk on the 

privacy of the individual that additional 

exposure of the record might bring, and 

(3) There is reasonable probability 

that the objective for the use would be 

accomplished; 

c. Requires the recipient of the 

information to: 

(1) establish reasonable 

administrative, technical, and physical 

safeguards to prevent unauthorized use 

or disclosure of the record, and 

(2) remove or destroy the information 

that allows the individual to be 

identified at the earliest time at which 

removal or destruction can be 

accomplished consistent with the 

purpose of the disclosure, and 

(3) Make no further use or disclosure 

of the record except: 

(a) In emergency circumstances 

affecting the health or safety of any 

individual, or 

(b) When required by law; 

d. Secures a written statement 

attesting to the information recipient’s 

understanding of and willingness to 

abide by these provisions and complete 

a Data Use Agreement (CMS Form 0235) 

in accordance with current CMS 

policies. 

Other Federal agencies and 

contractors may require MARx 

information for the purpose of assisting 

in a respond to a suspected or 

confirmed breach of the security or 

confidentiality of information. 

B. Additional Circumstances Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR parts 160 and 164, 

65 FR 82462 (12–28–00), Subparts A 

and E. The protected health information 

is collected from the Plan during the 

enrollment process and passed onto the 

Medicare Beneficiary Database. These 

elements include the Beneficiary Name, 

Sex, Date of Birth, and Health Insurance 

Claim Number. Disclosures of Protected 

Health Information authorized by these 

routine uses may only be made if, and 

as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’ 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if CMS determines there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 


sroberts on DSK5SPTVN1PROD with NOTICES
47194 Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the 

E-Government Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the Modified System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

CMS will only disclose the minimum 

personal data necessary to achieve the 

purpose of MARx. Disclosure of 

information from the system will be 

approved only to the extent necessary to 

accomplish the purpose of the 

disclosure. CMS has assigned a higher 

level of security clearance for the 

information maintained in this system 

in an effort to provide added security 

and protection of data in this system. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights. 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of the disclosure of 

information relating to individuals. 

Dated: July 28, 2011. 

Michelle Snyder, 

Deputy Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

SYSTEM NO. 09–70–0588 

SYSTEM NAME: 

‘‘Medicare Advantage Prescription 

Drug (MARx)’’ System HHS/CMS/CM. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

The system includes information on 

recipients of Medicare hospital 

insurance (Part A) and Medicare 

medical insurance (Part B), and 

recipients of the Prescription Drug 

Benefits Program (Part D) enrolled in the 

Medicare Advantage (MA) Program . 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The system includes information 

about a beneficiary’s entitlement to 

Medicare benefits and enrollment in 

Medicare Programs, prescription drug 

coverage and supplementary medical 

claims information. The system contains 

identifying information such as 

beneficiary name, health insurance 

claim number, social security number, 

and other demographic information. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of the 

system is given under Section 101 of the 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173), which 

amended the Title XVIII of the Social 

Security Act. Authority for maintenance 

of the system is also given under the 

provisions of §§ 1833(a)(1)(A), 1860D–1 

to D–43, 1866, and 1876 of Title XVIII 

of the Act (42 U.S.C. 1395(A)(1)(a), 

1395w–101 to 1395w–153, 1395cc, and 

1395mm). 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the SOR is to 

maintain a master file of Medicare 

Advantage (MA) and Medicare 

Advantage Prescription Drug (MA–PD) 

plan members for accounting and 

payment control; expedite the exchange 

of data with MA and MA–PD; control 

the posting of pro-rata amounts to the 

Part B deductible of currently enrolled 

MA members; and track participation of 

the prescription drug benefits provided 

under prescription drug plans (PDPs) 

and Medicare employer plans.. 

Information in this system is disclosed 

to: (1) Support regulatory, 

reimbursement, and policy functions 

performed by a contractor, consultant, 

or CMS grantee contracted by the 

Agency; (2) support another Federal or 

State agency, agency of a state 

government, an agency established by 

state law, or its fiscal agent; (3) assist 

providers and suppliers of service 

directly or dealing through contractors, 

fiscal intermediaries (FI) or carriers for 

the administration of Title XVIII (4) 

assist third party contacts in situations 

where the party to be contacted has, or 

is expected to have information relating 

to the individual’s capacity to manage 

his or her affairs; (5) assist insurance 

companies, third party administrators, 

employers, self-insurers, managed care 

organizations, and other supplemental 

insurers; (6) facilitate research on the 

quality and effectiveness of care 

provided, as well as payment-related 

projects; (7) support litigation involving 

the Agency; (8) combat fraud, waste, 

and abuse in certain health benefits 

programs, and (9) assist in a response to 

a suspected or confirmed breach of the 

security or confidentiality of 

information. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

B. Entities Who May Receive 

Disclosures Under Routine Use. 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the MARx without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. 

1. To Agency contractors, consultants, 

or CMS grantees that have been 

contracted by the Agency to assist in 


sroberts on DSK5SPTVN1PROD with NOTICES
Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 47195 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need access to the records in 

order to assist CMS. 

5. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

6. To assist providers and suppliers of 

services directly or through fiscal 

intermediaries or carriers for the 

administration of Title XVIII of the Act. 

7. To third party contacts in situations 

where the party to be contacted has, or 

is expected to have information relating 

to the individual’s capacity to manage 

his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

b. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exists, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

d. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: The individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

6. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations (HMOs) or a competitive 

medical plan with a Medicare contract, 

or a Medicare-approved health care 

prepayment plan (HCPP)), directly or 

through a contractor, and other groups 

providing protection for their enrollees. 

Information to be disclosed shall be 

limited to Medicare entitlement data. In 

order to receive the information, they 

must agree to: 

e. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

f. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

g. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

11. To an individual or organization 

for a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

12. To the Department of Justice 

(DOJ), court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

13. To a CMS contractor (including, 

but not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

or to a CMS grantee of a CMSadministered grant program, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud, waste, or abuse in such 

programs. 

14. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud, waste, or 

abuse in, a health benefits program 

funded in whole or in part by Federal 

funds, when disclosure is deemed 

reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud, 

waste, or abuse in such programs. 

15. To assist appropriate Federal 

agencies and Department contractors 

that have a need to know the 

information for the purpose of assisting 

the Department’s efforts to respond to a 

suspected or confirmed breach of the 

security or confidentiality of 

information maintained in this system 

of records, and the information 

disclosed is relevant and necessary for 

the assistance. In order to receive the 

information, CMS must: 

a. Determines that the use or 

disclosure does not violate legal 

limitations under which the record was 

provided, collected, or obtained; 

b. Determines that the purpose for 

which the disclosure is to be made: 

(1) Cannot be reasonably 

accomplished unless the record is 

provided in individually identifiable 

form, 

(2) is of sufficient importance to 

warrant the effect and/or risk on the 

privacy of the individual that additional 

exposure of the record might bring, and 

(3) there is reasonable probability that 

the objective for the use would be 

accomplished; 

c. Require the recipient of the 

information to: 

(1) establish reasonable 

administrative, technical, and physical 

safeguards to prevent unauthorized use 

or disclosure of the record, and 

(2) remove or destroy the information 

that allows the individual to be 

identified at the earliest time at which 

removal or destruction can be 

accomplished consistent with the 

purpose of the disclosure, and 

(3) Make no further use or disclosure 

of the record except: 

(a) In emergency circumstances 

affecting the health or safety of any 

individual, or 

(b) When required by law. 

d. Secure a written statement attesting 

to the information recipient’s 

understanding of and willingness to 

abide by these provisions and complete 

a Data Use Agreement (CMS Form 0235) 

in accordance with current CMS 

policies. 

C. ADDITIONAL CIRCUMSTANCES AFFECTING

ROUTINE USE DISCLOSURES

This system contains Protected Health 

Information as defined by HHS 


sroberts on DSK5SPTVN1PROD with NOTICES
47196 Federal Register / Vol. 76, No. 150 / Thursday, August 4, 2011 / Notices 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 Fed. Reg. 82462 (12–28–00), Subparts 

A and E. The protected health 

information is collected from the Plan 

during the enrollment process and 

passed onto the Medicare Beneficiary 

Database. These elements include the 

Beneficiary Name, Sex, Date of Birth, 

and Health Insurance Claim Number. 

Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’ 

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if CMS determines there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

Magnetic storage media. 

RETRIEVABILITY: 

Information can be retrieved by name 

and health insurance claim number of 

the beneficiary. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: The Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

Records are maintained with 

identifiers for all transactions after they 

are entered into the system for a period 

of 6 years and 3 months. Records are 

housed in both active and archival files. 

All claims-related records are 

encompassed by the document 

preservation order and will be retained 

until notification is received from the 

Department of Justice. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of MA & Part D 

Application Analysis, Information 

Services Design and Development 

Group, Office of Information Services, 

CMS. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the systems 

manager who will require the system 

name, SSN, address, date of birth, sex, 

and for verification purposes, the 

subject individual’s name (woman’s 

maiden name, if applicable). Furnishing 

the SSN is voluntary, but it may make 

searching for a record easier and prevent 

delay. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 

5b.5(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Data for this system is collected from 

MAs, MA–PDs, and PDPs (which 

obtained the data from the individuals 

concerned); Social Security 

Administration; and the Medicare 

Beneficiary Database, 1–800 Medicare 

Choice, and Health Plan Management 

System. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 2011–19803 Filed 8–3–11; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Administration for Children and 

Families 

Submission for OMB Review; 

Comment Request 

Title: Request for Assistance for Child 

Victims of Human Trafficking 

OMB No.: 0970–0362. 

Description: The William Wilberforce 

Trafficking Victims Protection 

Reauthorization Act (TVPRA) of 2008, 

Public Law 110–457, directs the U.S. 

Secretary of Health and Human Service 

(HHS), upon receipt of credible 

information that a non-U.S. citizen, nonLawful Permanent Resident (alien) child 

may have been subjected to a severe 

form of trafficking in persons and is 

seeking Federal assistance available to 

victims of trafficking, to promptly 

determine if the child is eligible for 

interim assistance. The law further 

directs the Secretary of HHS to 

determine if a child receiving interim 

assistance is eligible for assistance as a 

victim of a severe form of trafficking in 

persons after consultation with the 

Attorney General, the Secretary of 

Homeland Security, and 

nongovernmental organizations with 

expertise on victims of severe form of 

trafficking. 

In developing procedures for 

collecting the necessary information 

from potential child victims of 

trafficking, their case managers, 

attorneys, or other representatives to 

allow HHS to grant interim eligibility, 

HHS devised a form. HHS has 

determined that the use of a standard 

form to collect information is the best 

way to ensure requestors are notified of 

their option to request assistance for 

child victims of trafficking and to make 

prompt and consistent determinations 

about the child’s eligibility for 

assistance. 

Specifically, the form asks the 

requestor for his/her identifying 


sroberts on DSK5SPTVN1PROD with NOTICES