58432 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

Health and Human Services, and 

represents CDC on related scientific and 

policy committees; (12) establishes 

external advisory capacity and internal 

advisory and action capacity; (13) 

coordinates CDC-wide minority health 

and health disparities elimination 

initiatives; (14) synthesizes, 

disseminates, and encourages use of 

scientific evidence regarding effective 

interventions to achieve health 

disparities elimination outcomes; (15) 

stimulates innovation in science and 

practice; and (16) provides decision 

support to the Executive Leadership 

Board in allocating CDC resources to 

agency-wide programs of surveillance, 

research, intervention, and evaluation. 

Office of Women’s Health (CAMG). 

The Office of Women’s Health (OWH) 

aims to promote and improve the 

health, safety, and quality of life of 

women. As a leader for women’s health 

issues at CDC, the Office of Women’s 

Health: (1) Advises the CDC Director on 

matters relating to women’s health 

research, programs and strategies; (2) 

promotes the health and well-being of 

women; (3) communicates health 

information, research findings, and 

prevention strategies to a diverse group 

of providers, consumers, and 

organizations; (4) advances sound 

scientific knowledge for public health 

action, promotes the role of prevention, 

and works to improve the 

understanding of women’s health 

priorities; (5) fosters partnerships and 

collaborations within CDC and with 

other public and private organizations, 

agencies, institutions, and others to 

improve the health and safety of 

women; (6) publishes newsletters and 

other documents that highlight 

prevention programs, research findings, 

publications, health campaigns, health 

promotion strategies, and other 

information available at CDC; (7) leads 

CDC Women’s Health Committee by 

facilitating and coordinating agencywide efforts and enhancing channels for 

communication and cooperation; (8) 

supports the development of future 

women’s health and public health 

professionals through various training 

and student positions within the office; 

(9) prepares agency reports, briefing 

documents, and other materials 

addressing women’s health issues; (10) 

stimulates and supports prevention 

research, programs, and other activities 

through funding; (11) represents the 

agencies at meetings, committees, 

workgroups, conferences, and briefings; 

(12) serves as liaison for women’s health 

between CDC and other agencies and 

organizations; (13) develops 

opportunities for, promotes, and 

supports the agency as a resource for 

women’s health issues; and (14) 

provides assistance to state and local 

programs on women’s health issues. 

Dated: September 23, 2005. 

William H. Gimson, 

Chief Operating Officer, Centers for Disease 

Control and Prevention (CDC). 

[FR Doc. 05–20057 Filed 10–5–05; 8:45 am] 

BILLING CODE 4160–18–M 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a New 

System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a New System of 

Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to establish a new 

system titled ‘‘Medicare Physician 

Group Practice Demonstration (PGPD),’’

System No. 09–70–0559. The PGPD tests 

a payment methodology for physician 

practices that combines Medicare feefor-service payments with performancebased payments for improvements in 

patient management and quality of care. 

Improvements in these areas are 

expected to generate savings to the 

Medicare program to offset the costs of 

the performance payments. Mandated 

by Section 412 of the Benefits 

Improvement & Protection Act of 2000, 

the PGPD seeks to provide incentives for 

physicians to adopt care management 

strategies and to improve quality as 

defined by key measurable processes 

and outcomes. 

The primary purpose of the system is 

to establish a pay-for-performance three 

year pilot with physicians to encourage 

the coordination of care, promote 

investment in administrative structure 

and process, and reward physicians for 

improving health care processes and 

outcomes. Information retrieved from 

this system will also be disclosed to: (1) 

Support regulatory, reimbursement, and 

policy functions performed within the 

agency or by a contractor or consultant; 

(2) assist another Federal or state agency 

with information to enable such agency 

to administer a Federal health benefits 

program, or to enable such agency to 

fulfill a requirement of Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; (3) assist an 

individual or organization for a research 

project or in support of an evaluation 

project related to the prevention of 

disease or disability, the restoration or 

maintenance of health, or payment 

related projects; (4) support constituent 

requests made to a congressional 

representative; (5) support litigation 

involving the agency; and (6) combat 

fraud and abuse in certain health 

benefits programs. We have provided 

background information about the new 

system in the ‘‘Supplementary 

Information’’ section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See EFFECTIVE

DATES section for comment period. 

EFFECTIVE DATES: CMS filed a new 

system report with the Chair of the 

House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on September 27, 2005. In any 

event, we will not disclose any 

information under a routine use until 40 

days after publication. We may defer 

implementation of this system or one or 

more of the routine use statements listed 

below if we receive comments that 

persuade us to defer implementation. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance Data 

Development, CMS, Mail Stop N2–04–

27, 7500 Security Boulevard, Baltimore, 

Maryland 21244–1850. Comments 

received will be available for review at 

this location, by appointment, during 

regular business hours, Monday through 

Friday from 9 a.m.–3 p.m., eastern time 

zone. 

FOR FURTHER INFORMATION CONTACT: John 

Pilotte, Research Analyst, Division of 

Payment Policy, Medicare 

Demonstration Programs Group, Office 

of Research Development and 

Information, CMS, Mail Stop C4–17–27, 

7500 Security Boulevard, Baltimore, 

Maryland 21244–1850. The telephone 

number is (410) 786–6558 or e-mail 

john.pilotte@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: The PGPD 

rewards physicians for improving the 

quality and efficiency of health care 

services delivered to Medicare fee-forservice beneficiaries. Mandated by 

Section 412 of the Benefits 

Improvement and Protection Act of 

2000, the PGPD seeks to: (1) Encourage 

coordination of Part A and Part B 

services, (2) promote efficiency through 

investment in administrative structure 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58433 

and process, and (3) reward physicians 

for improving health outcomes. 

During the three-year project, CMS 

will reward physician groups that 

improve patient outcomes by 

coordinating care for chronically ill and 

high cost beneficiaries in an efficient 

manner. The Demonstration enables 

CMS the ability to test physician groups’

responses to financial incentives for 

improving care coordination, delivery 

processes and patient outcomes, and the 

effect on access, cost, and quality of care 

to Medicare beneficiaries. 

Physician groups participating in the 

demonstration will continue to be paid 

on a fee-for-service basis. Physician 

groups will implement care 

management strategies designed to 

anticipate patient needs, prevent 

chronic disease complications and 

avoidable hospitalizations, and improve 

quality of care. 

Performance payments will be 

derived from savings expected through 

improvements in care coordination for 

an assigned beneficiary population. 

Performance payments will be allocated 

between efficiency and quality, with an 

increasing emphasis placed on quality 

during the demonstration. The 

demonstration will use a total of 32 

measures that focus on common chronic 

illnesses and preventive services for 

measuring and rewarding quality. 

CMS selected ten physician groups on 

a competitive basis to participate in the 

demonstration. The groups were 

selected based on a variety of factors 

including technical review panel 

findings, organizational structure, 

operational feasibility, geographic 

location, and demonstration 

implementation strategy. 

I. Description of the New System of 

Records 

A. Statutory and Regulatory Basis for 

System 

The statutory authority for this system 

is given under the provisions of Section 

412 of the Benefits Improvement & 

Protection Act of 2000. 

B. Collection and Maintenance of Data 

in the System 

This system will maintain 

individually identifiable data collected 

on the Medicare expenditures of 

beneficiaries assigned to the 

participating physician practices. In 

addition, data will be collected from the 

physician practices on their 

performance based on a series of quality 

measures. The collected information 

will include: provider name, unique 

provider identification number, clinic 

name, medical record number, health 

insurance claim number, first name, last 

name, gender type, birth date, as well 

as, background information relating to 

Medicare or Medicaid issues. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

The Privacy Act permits us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such disclosure of 

data is known as a ‘‘routine use.’’ The 

government will only release PGPD 

information that can be associated with 

an individual as provided for under 

‘‘Section III. Proposed Routine Use 

Disclosures of Data in the System.’’ Both 

identifiable and non-identifiable data 

may be disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of the PGPD. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the 

system will be approved only to the 

extent necessary to accomplish the 

purpose of the disclosure and only after 

CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected, e.g., to 

collect and maintain data on the 

Medicare expenditures of the 

beneficiaries assigned to participating 

physician practices and making 

performance payments to participating 

physician practices. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all patient-identifiable information; 

and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use 

The Privacy Act allows us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such compatible use 

of data is known as a ‘‘routine use.’’ The 

proposed routine uses in this system 

meet the compatibility requirement of 

the Privacy Act. We are proposing to 

establish the following routine use 

disclosures of information maintained 

in the system: 

1. To agency contractors or 

consultants who have been engaged by 

the agency to assist in the performance 

of a service related to this system of 

records and who need to have access to 

the records in order to perform the 

activity. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing CMS function relating to 

purposes for this system or records. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or consultant 

whatever information is necessary for 

the contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To another Federal or state agency 

to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require PGPD information 

in order to support evaluations and 

monitoring of Medicare claims 

58434 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

3. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

The PGPD data will provide for 

research or in support of evaluation 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

4. To a member of congress or to a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries sometimes request the 

help of a member of congress in 

resolving an issue relating to a matter 

before CMS. The member of congress 

then writes CMS, and CMS must be able 

to give sufficient information to be 

responsive to the inquiry. 

5. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. the United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body incompatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, and occasionally when 

another party is involved in litigation 

and CMS’ policies or operations could 

be affected by the outcome of the 

litigation, CMS would be able to 

disclose information to the DOJ, court or 

adjudicatory body involved. 

6. To a CMS contractor (including, but 

not necessarily limited to fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such program. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual relationship or grant 

with a third party to assist in 

accomplishing CMS functions relating 

to the purpose of combating fraud and 

abuse. 

CMS occasionally contracts out 

certain of its functions and makes grants 

when doing so would contribute to 

effective and efficient operations. CMS 

must be able to give a contractor or 

grantee whatever information is 

necessary for the contractor or grantee to 

fulfill its duties. In these situations, 

safeguards are provided in the contract 

prohibiting the contractor or grantee 

from using or disclosing the information 

for any purpose other than that 

described in the contract and requiring 

the contractor or grantee to return or 

destroy all information. 

7. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any State 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require PGPD 

information for the purpose of 

combating fraud and abuse in such 

Federally-funded programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information (PHI) as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (12–28–00), Subparts A 

and E. Disclosures of PHI authorized by 

these routine uses may only be made if, 

and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even of not directly 

identifiable information, except 

pursuant to one of the routine uses or 

if required by law, if we determine there 

is a possibility that an individual can be 

identified through implicit deduction 

based on small cell sizes (instances 

where the patient population is so small 

that individuals who are familiar with 

the enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include, but are 

not limited to, all pertinent National 

Institute of Standards and Technology 

publications, the HHS Information 

Systems Program Handbook, and the 

CMS Information Security Handbook. 

V. Effects of the New System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system of records. 

CMS will take precautionary 

measures (see item IV. above) to 

minimize the risks of unauthorized 

access to the records and the potential 

harm to individual privacy or other 

personal or property rights of patients 

whose data is maintained in the system. 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58435 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of maintaining this system of 

records. 

Dated: September 27, 2005. 

Charlene Brown, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

System No.: 09–70–0559. 

SYSTEM NAME: 

‘‘Medicare Physician Group Practice 

Demonstration (PGPD)’’ HHS/CMS/ 

ORDI. 

SECURITY CLASSIFICATION: 

Level 3 Privacy Act Sensitive. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850 and 

CMS contractors and agents at various 

locations. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

This system will maintain 

individually identifiable data collected 

on the Medicare expenditures and 

quality of care of beneficiaries assigned 

to the participating physician practices. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

This system will maintain 

individually identifiable data collected 

on the Medicare expenditures of 

beneficiaries assigned to the 

participating physician practices. In 

addition, data will be collected from the 

physician practices on their 

performance based on a series of quality 

measures. The collected information 

will include: provider name, unique 

provider identification number, clinic 

name, medical record number, health 

insurance claim number (HICN), first 

name, last name, gender type, birth date, 

as well as, background information 

relating to Medicare or Medicaid issues. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

The statutory authority for this system 

is given under the provisions of Section 

412 of the Benefits Improvement & 

Protection Act of 2000. 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the system is 

to establish a pay-for-performance three 

year pilot with physicians to encourage 

the coordination of care, promote 

investment in administrative structure 

and process, and reward physicians for 

improving health care processes and 

outcomes. Information retrieved from 

this system will also be disclosed to: (1) 

Support regulatory, reimbursement, and 

policy functions performed within the 

agency or by a contractor or consultant; 

(2) assist another Federal or state agency 

with information to enable such agency 

to administer a Federal health benefits 

program, or to enable such agency to 

fulfill a requirement of Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; (3) assist an 

individual or organization for a research 

project or in support of an evaluation 

project related to the prevention of 

disease or disability, the restoration or 

maintenance of health, or payment 

related projects; (4) support constituent 

requests made to a congressional 

representative; (5) support litigation 

involving the agency; and (6) combat 

fraud and abuse in certain health 

benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OF USERS AND

THE PURPOSES OF SUCH USES: 

A. Entities Who May Receive 

Disclosures Under Routine Use 

The Privacy Act allows us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such compatible use 

of data is known as a ‘‘routine use.’’ The 

proposed routine uses in this system 

meet the compatibility requirement of 

the Privacy Act. We are proposing to 

establish the following routine use 

disclosures of information maintained 

in the system: 

1. To agency contractors or 

consultants who have been engaged by 

the agency to assist in the performance 

of a service related to this system and 

who need to have access to the records 

in order to perform the activity. 

2. To another Federal or state agency 

to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

3. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

4. To a member of Congress or to a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

5. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government 

is a party to litigation or has an interest 

in such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is incompatible with 

the purpose for which the agency 

collected the records. 

6. To a CMS contractor (including, but 

not necessarily limited to fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such program. 

7. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any State 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information (PHI) as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 Code of Federal 

Regulations (CFR)) Parts 160 and 164, 

65 Fed. Reg. 82462 (12–28–00), Subparts 

A and E. Disclosures of PHI authorized 

58436 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

by these routine uses may only be made 

if, and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even if not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on magnetic 

media. 

RETRIEVABILITY: 

Information collected will be 

retrieved by the name or other 

identifying information of the 

participating provider, and may also be 

retrievable by HICN at the individual 

beneficiary record level. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include, but are 

not limited to, all pertinent National 

Institute of Standards and Technology 

publications, the HHS Information 

Systems Program Handbook, and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain identifiable 

information maintained in the PGPD 

system of records for a period of 6 years. 

Data residing with the designated claims 

payment contractor shall be returned to 

CMS at the end of the project, with all 

data then being the responsibility of 

CMS for adequate storage and security. 

All claims-related records are 

encompassed by the document 

preservation order and will be retained 

until notification is received from the 

DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Medicare Demonstration 

Programs Group, CMS, 7500 Security 

Boulevard, Mail stop C4–17–27, 

Baltimore, Maryland, 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, and for verification purposes, the 

subject individual’s name, provider 

identification number, and the patient’s 

Medicare number. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 

(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Information maintained in this system 

will be collected from physicians 

voluntarily participating through claims 

data requesting payment for services. 

The PGPD information will also be 

collected from the reporting of 

ambulatory care data by participating 

physician groups. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–19904 Filed 10–5–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of New 

System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a new system of 

records. 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

CMS is proposing to establish a new 

system of records (SOR) titled 

‘‘Medicare Drug Data Processing System 

(DDPS),’’ System No. 09–70–0553. On 

December 8, 2003, Congress passed the 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Public Law (Pub. L.) 108–

173). MMA amends the Social Security 

Act (the Act) by adding the Medicare 

Part D Program under Title XVIII and 

mandate that CMS establish a voluntary 

Medicare prescription drug benefit 

program effective January 1, 2006. 

Under the new Medicare Part D benefit, 

the Act allows Medicare payment to 

plans that contract with CMS to provide 

qualified Part D prescription drug 

coverage as described in 42 Code of 

Federal Regulations (CFR) § 423.401. As 

a condition of payment, all Part D plans 

must submit data and information 

necessary for CMS to carry out payment 

provisions (§ 1860D–15(c)(1)(C) and 

(d)(2) of the Act, and 42 CFR 423.322). 

The primary purpose of this system is 

to collect, maintain, and process 

information on all Medicare covered 

and non-covered drug events, including 

non-Medicare drug events, for Medicare 

beneficiaries participating in the Part D 

voluntary prescription drug coverage 

under the Medicare program. The 

system will process drug event 

transactions and other drug events as 

necessary for CMS to help determine 

appropriate payment of covered drugs. 

The DDPS will consist of the transaction 

validation processing, storing and 

maintaining the drug event data in a 

large-scale database, and staging the 

data into data marts to support 

beneficiary and plan analysis of 

incurred payment. Information in this 

system will also be disclosed to: (1)