[Federal Register Volume 63, Number 139 (Tuesday, July 21, 1998)]
[Notices]
[Pages 39101-39104]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-19376]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Health Care Financing Administration


Privacy Act of 1974; Report of New System

AGENCY: Department of Health and Human Services (HHS), Health Care 
Financing Administration (HCFA).

ACTION: Notice of new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to establish a new system of records, called 
``End-Stage Renal Disease (ESRD) Managed Care Demonstration System,'' 
HHS/HCFA/OSP No. 09-70-0067. We have provided background information 
about the proposed new system in the Supplementary Information section 
below. Although the Privacy Act requires only that the ``routine uses'' 
portion of the system be published for comment, HCFA invites comments 
on all portions of this notice.

DATES: HCFA filed a new system report with the Chairman of the 
Committee on Government Reform and Oversight of the House of 
Representatives, the Chairman of the Committee on Governmental Affairs 
of the Senate, and the Administrator, Office of Information and 
Regulatory Affairs, Office of Management and Budget (OMB), on July 9, 
1998. The new system of records, including routine uses, will become 
effective 40 days from the date submitted to OMB and the Congress, 
unless HCFA receives comments which require alteration to this notice.

ADDRESSES: The public should address comments to the HCFA Privacy Act 
Officer, Division of Freedom of Information & Privacy, Office of 
Information Services, Health Care Financing Administration, 7500 
Security Boulevard, C2-01-11, Baltimore, Maryland 21244-1850. Comments 
received will be available for review at this location by appointment, 
Monday through Friday 9 a.m.-3 p.m., eastern time zone.

FOR FURTHER INFORMATION CONTACT: Paul Eggers, Office of Strategic 
Planning, Health Care Financing Administration, 7500 Security 
Boulevard, C3-24-07, Baltimore, Maryland 21244-1850. His telephone 
number is (410) 786-6691.

SUPPLEMENTARY INFORMATION: The ESRD Managed Care Demonstration System 
data file contains information on beneficiaries enrolled in the ESRD 
Managed Care Demonstration. This information will be used by HCFA and 
its evaluation contractor to monitor and evaluate the demonstration. 
The system

[[Page 39102]]

will include information on utilization of specific health care 
services, cost and quality of those services, clinical outcomes and 
effectiveness of care, and patient satisfaction.
    Primary data collected by the evaluator and the managed care 
organizations will be linked to HCFA administrative data to provide 
information necessary for monitoring and evaluating the demonstration 
and its interventions. The demonstration is designed to test the 
feasibility and effectiveness of the following:
    <bullet> Removal of the barrier to ESRD enrollment. At present, 
ESRD-eligible beneficiaries cannot enroll in Medicare health 
maintenance organizations (HMOs) (although they may remain enrolled if 
they develop ESRD subsequent to enrollment). Under the demonstration, 
the sites will have year-round open enrollment of ESRD beneficiaries.
    <bullet> ESRD-focused case management, and the potential benefits 
to patient, provider, and payer, with particular emphasis on whether 
outcomes of care are improved.
    <bullet> Preventive and supportive interventions and more 
comprehensive benefit coverage for ESRD patients. Section 2355 of the 
Deficit Reduction Act of 1989, as amended, requires that HCFA pay the 
demonstration sites a capitation rate based on 100 percent of fee-for-
service costs, rather than 95 percent. In order to justify receiving 
the additional 5 percent, the HMO is obliged to offer extra, non-
Medicare-covered benefits beyond those that would have been available 
in the absence of the demonstration.
    <bullet> An ESRD capitation rate that adjusts for patient age, 
cause of renal failure, treatment status, and services as an 
alternative to both fee-for-service and the current capitation rate for 
ESRD patients in HMOs, that is unadjusted for demographic or treatment 
factors.
    Individual patient-level data will be collected and linked from a 
variety of sources, including, but not limited to: Surveys conducted by 
the evaluation contractor, including those using the Kidney Disease 
Quality of Life (KDQOL) instrument; data from the End-Stage Renal 
Disease (ESRD) Program Management and Medical Information System 
(PMMIS) maintained by HCFA; no-pay claims data submitted by the sites 
during the course of the demonstration; claims data on fee-for-service 
comparison patients; and clinical data in regard to dialysis adequacy 
measures, such as those collected by HCFA's core indicators studies.
    The Privacy Act permits us to disclose information without the 
written consent of individuals for ``routine uses''--that is, 
disclosures that are compatible with the purpose for which we collected 
the information. The proposed routine uses in the new system meet the 
compatibility criterion of the statute. We anticipate the disclosures 
under the routine uses will not result in any unwarranted adverse 
effects on personal privacy.

    Dated: July 9, 1998.
Nancy-Ann Min DeParle,
Administrator.
09-70-0067

SYSTEM NAME:
    End-Stage Renal Disease (ESRD) Managed Care Demonstration System, 
HHS/HCFA/OSP.

SECURITY CLASSIFICATION:
    None.

SYSTEM LOCATION:
    Health Care Financing Administration, Office of Information 
Services, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Medicare ESRD beneficiaries enrolled in the ESRD Managed Care 
Demonstration and Medicare ESRD beneficiaries in comparison groups.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Individual-level information on demographics, utilization of 
specific health care services, cost and quality of those services, 
clinical outcomes and effectiveness of care, and patient satisfaction 
will be collected.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for maintenance of the system is section 2355 of the 
Deficit Reduction Act of 1984, Pub. L. 98-369, as amended by section 
4207(b)(4) of the Omnibus Budget Reconciliation Act (OBRA) of 1990, 
Pub. L. 101-508, and as amended by section 13567(b) of OBRA 1993, Pub. 
L. 103-66.

PURPOSE(s):
    To collect and maintain information on beneficiaries enrolled in 
the ESRD Managed Care Demonstration, and ESRD beneficiaries in 
comparison groups, in order to monitor and evaluate the demonstration.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    These routine uses specify additional circumstances under which 
HCFA may release information from the ESRD Managed Care Demonstration 
System without the consent of the individual to whom such information 
pertains. Each proposed disclosure of information under these routine 
uses will be evaluated to ensure that the disclosure is legally 
permissible, including, but not limited to, ensuring that the purpose 
of the disclosure is compatible with the purpose for which the 
information was collected. Also, HCFA will require each prospective 
recipient of such information to agree in writing to certain conditions 
to ensure the continuing confidentiality and physical safeguards of the 
information. More specifically, as a condition of each disclosure under 
these routine uses, HCFA will, as necessary and appropriate:
    (a) Determine that no other Federal statute specifically prohibits 
disclosure of the information;
    (b) Determine that the use or disclosure does not violate legal 
limitations under which the information was provided, collected, or 
obtained;
    (c) Determine that the purpose for which the disclosure is to be 
made:
    (1) Cannot reasonably be accomplished unless the information is 
provided in individually identifiable form,
    (2) Is of sufficient importance to warrant the effect on, or the 
risk to, the privacy of the individual(s) that additional exposure 
of the record(s) might bring, and
    (3) There is a reasonable probability that the purpose of the 
disclosure will be accomplished.
    (d) Require the recipient of the information to:
    (1) Establish reasonable administrative, technical, and physical 
safeguards to prevent unauthorized access, use, or disclosure of the 
record or any part thereof. The physical safeguards shall provide a 
level of security that is at least the equivalent of the level of 
security contemplated in OMB Circular No. A-130 (revised), Appendix 
III--Security of Federal Automated Information Systems which sets forth 
guidelines for security plans for automated information systems in 
Federal agencies;
    (2) Remove or destroy the information that allows subject 
individual(s) to be identified at the earliest time at which removal or 
destruction can be accomplished, consistent with the purpose of the 
request;
    (3) Refrain from using or disclosing the information for any 
purpose other than the stated purpose under which the information was 
disclosed; and
    (4) Make no further uses or disclosure of the information, except:

[[Page 39103]]

    (i) To prevent or address an emergency directly affecting the 
health or safety of an individual;
    (ii) For use on another project under the same conditions, provided 
HCFA has authorized the additional use(s) in writing; or
    (iii) When required by law;
    (e) Secure a written statement or agreement from the prospective 
recipient of the information whereby the prospective recipient attests 
to an understanding of, and willingness to abide by the foregoing 
provisions and any additional provisions that HCFA deems appropriate in 
the particular circumstances; and
    (f) Determine whether the disclosure constitutes a computer 
``matching program'' as defined in 5 U.S.C. 552a(a)(8). If the 
disclosure is determined to be a computer ``matching program,'' the 
procedures for matching agreements as contained in 5 U.S.C. 552a(o) 
must be followed.
    Disclosure may be made:
    1. To a Congressional office, from the record of an individual, in 
response to an inquiry from the Congressional office made at the 
request of that individual;
    2. To the Bureau of Census for use in processing research and 
statistical data directly related to the programs administered in whole 
or in part by HCFA;
    3. To the Department of Justice, to a court or other tribunal, or 
to another party before such tribunal, when:
    (a) HHS, or any component thereof; or
    (b) Any HHS employee in his or her official capacity; or
    (c) Any HHS employee in his or her individual capacity, where the 
Department of Justice (or HHS, where it is authorized to do so) has 
agreed to represent the employee; or
    (d) The United States, or any agency thereof, where HHS determines 
that the litigation is likely to affect HHS or any of its components, 
is a party to litigation or has an interest in such litigation, and HHS 
determines that the use of such records by the Department of Justice, 
the tribunal, or the other party is relevant and necessary to the 
litigation and would help in the effective representation of the 
governmental party or interest, provided, however, that in each case 
HHS determines that such disclosure is compatible with the purpose for 
which the records were collected.
    4. To an individual or organization for a research, demonstration, 
evaluation, or epidemiological project related to the prevention of 
disease or disability, the restoration or maintenance of health, or for 
purposes of determining, evaluating and/or assessing cost, 
effectiveness, and/or the quality of health care services provided.
    5. To a contractor for the purpose of collating, analyzing, 
aggregating or otherwise refining or processing records in this system, 
or for developing, modifying, and/or manipulating automated information 
systems (ADP) software. Data would also be disclosed to contractors 
incidental to consultation, programming, operation, user assistance, or 
maintenance for ADP or telecommunications systems containing or 
supporting records in the system.
    6. To a peer review organization or ESRD network for health care 
quality improvement projects conducted in accordance with its contract 
with HCFA.
    7. To state Medicaid agencies pursuant to agreements with the 
Department of Health and Human Services for determining Medicaid and 
Medicare eligibility of recipients of assistance under titles IV, 
XVIII, and XIX of the Social Security Act, and for the complete 
administration of the Medicaid program.
    8. To an agency of a state Government, or established by state law, 
for purposes of determining, evaluating and/or assessing cost, 
effectiveness, and/or the quality of health care services provided in 
the state.
    9. To another Federal or state agency:
    (a) To contribute to the accuracy of HCFA's proper payment of 
Medicare health benefits, including release to the Social Security 
Administration for its assistance in the implementation of HCFA's 
Medicare and Medicaid programs, or
    (b) As necessary to enable such agency to fulfill a requirement of 
a Federal statute or regulation, or a state statute or regulation that 
implements a program funded in whole or in part with Federal funds.
    10. To a HCFA contractor, including but not limited to, fiscal 
intermediaries and carriers under title XVIII of the Social Security 
Act, to administer some aspect of a HCFA-administered grant program, 
which program is or could be affected by fraud or abuse, for the 
purpose of preventing, deterring, discovering, detecting, 
investigating, examining, prosecuting, suing with respect to, defending 
against, correcting, remedying, or otherwise combating such fraud or 
abuse in such programs.
    11. To another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States, including any state or local government agency, for the purpose 
of preventing, deterring, discovering, detecting, investigating, 
examining, prosecuting, suing with respect to, defending against, 
correcting, remedying, or otherwise combating such fraud or abuse in a 
health benefits program funded in whole or in part by Federal funds.
    12. To any entity that makes payment for, or oversees 
administration of, health services, for the purpose of preventing, 
deterring, discovering, detecting, investigating, examining, 
prosecuting, suing with respect to, defending against, correcting, 
remedying, or otherwise combating such fraud or abuse against such 
entity or the program or services administered by such entity, 
provided:
    (a) Such entity enters into an agreement with HCFA to share 
knowledge and information regarding actual or potential fraudulent or 
abusive practices or activities regarding the delivery or receipt of 
health care services, or regarding securing payment or reimbursement 
for health care services, or any practice or activity that, if directed 
toward a HCFA-administered program, might reasonably be construed as 
actually or potentially fraudulent or abusive;
    (b) Such entity does, on a regular basis, or at such times as HCFA 
may request, fully and freely share such knowledge and information with 
HCFA, or as directed by HCFA, with HCFA's contractors; and
    (c) HCFA determines that it may reasonably conclude that the 
knowledge or information it has received or is likely to receive from 
such entity could lead to preventing, deterring, discovering, 
detecting, investigating, examining, prosecuting, suing with respect 
to, defending against, correcting, remedying, or otherwise combating 
fraud or abuse in the Medicare, Medicaid, or other health benefits 
program administered by HCFA or funded in whole or in part by Federal 
funds.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    The records are stored on magnetic tapes and computer disks.

RETRIEVABILITY:
    The records are retrieved by health insurance claim number.

SAFEGUARDS:
    Access is limited to authorized HCFA personnel and HCFA contractor 
employees in the performance of their duties. HHS contractors and 
collaborating researchers are required to comply with the provisions of 
the Privacy Act, and are required to sign Assurance of Confidentiality 
Forms (or

[[Page 39104]]

Data Security Statements) that are kept on file by the contractor. For 
computerized records, safeguards established in accordance with 
Department standards and National Institute of Standards and Technology 
guidelines (e.g., security codes) will be used, limiting access to 
authorized personnel. System securities are established in accordance 
with HHS, Information Resource Management (IRM) Circular #10, Automated 
Information Systems Security Program; and HCFA Automated Information 
Systems (AIS) Guide, Systems Securities Policies, and OMB Circular No. 
A-130 (revised), Appendix III.

RETENTION AND DISPOSAL:
    Records are maintained with identifiers as long as needed for 
program research.

SYSTEM MANAGER(S) AND ADDRESS:
    Director, Office of Strategic Planning (OSP), Health Care Financing 
Administration, 7500 Security Boulevard, Baltimore, Maryland 21244-
1850.

NOTIFICATION PROCEDURE:
    The subject individual should write the system manager, who will 
require the system name, health insurance claim number, and, for 
verification purposes, name, address, date of birth, and sex to 
ascertain whether or not the individual's record is in the system.

RECORD ACCESS PROCEDURE:
    Same as notification procedures. Requestors should also reasonably 
specify the record contents being sought. (These access procedures are 
in accordance with the Department Regulation 45 CFR 5b.5(a)(2).)

CONTESTING RECORD PROCEDURES:
    Contact the system manager named above, and reasonably identify the 
record and specify the information to be contested. State the 
corrective action sought and the reasons for the correction with 
supporting justification. (These procedures are in accordance with 
Department Regulation 45 CFR 5b.7.)

RECORD SOURCE CATEGORIES:
    The identifying information contained in these records is obtained 
from demonstration enrollees, and from the group health plans operating 
the demonstration and their participating providers. These data will be 
linked with HCFA administrative data, such as claims and enrollment 
data.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    None.

[FR Doc. 98-19376 Filed 7-20-98; 8:45 am]
BILLING CODE 4120-03-P