58442 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

System No. Title System 

manager 

09–70–0063 Evaluation of the Medicaid Demonstration for Improving Access to Care for Substance Abusing Pregnant 

Women.

HHS/CMS/ORDI 

09–70–0066 Evaluation of and External Quality Assurance for the Community Nursing Organization Demonstration ......... HHS/CMS/ORDI 

Dated: September 27, 2005. 

Charlene Brown, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

[FR Doc. 05–19906 Filed 10–5–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a New 

System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a new System of 

Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to establish a new 

SOR titled ‘‘Medicare Care Management 

Performance Demonstration (MCMP),’’

System No. 09–70–0562. MCMP 

demonstration tests a payment 

methodology for physician practices 

that combines Medicare fee-for-service 

payments with performance-based 

payments for improvements in 

information technology systems, patient 

education, care management, and 

quality of care. Improvements in these 

areas are expected to generate savings to 

the Medicare program to offset the costs 

of the performance payments. Mandated 

by Section 649 of the Medicare 

Prescription Drug, Improvement, and 

Modernization Act of 2003 (MMA), the 

MCMP Demonstration seeks to provide 

incentives for physicians to adopt and 

integrate information technology 

systems into their practices, and to 

improve quality as defined by key 

measurable outcomes. 

The primary purpose of the system is 

to establish a pay-for-performance three 

year pilot with physicians to promote 

the adoption and use of health 

information technology to improve the 

quality of patient care for chronically ill 

Medicare patients. Information retrieved 

from this system will also be disclosed 

to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the agency or by a 

contractor or consultant; (2) assist 

another Federal or state agency with 

information to enable such agency to 

administer a Federal health benefits 

program, or to enable such agency to 

fulfill a requirement of Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; (3) assist an 

individual or organization for a research 

project or in support of an evaluation 

project related to the prevention of 

disease or disability, the restoration or 

maintenance of health, or payment 

related projects; (4) support constituent 

requests made to a congressional 

representative; (5) support litigation 

involving the agency; and (6) combat 

fraud and abuse in certain health 

benefits programs. We have provided 

background information about the new 

system in the ‘‘Supplementary 

Information’’ section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See ‘‘Effective 

Dates’’ section for comment period. 

EFFECTIVE DATES: CMS filed a new 

system report with the Chair of the 

House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on September 27, 2005. In any 

event, we will not disclose any 

information under a routine use until 40 

days after publication. We may defer 

implementation of this system or one or 

more of the routine use statements listed 

below if we receive comments that 

persuade us to defer implementation. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance Data 

Development, CMS, Mail Stop N2–04–

27, 7500 Security Boulevard, Baltimore, 

Maryland 21244–1850. Comments 

received will be available for review at 

this location, by appointment, during 

regular business hours, Monday through 

Friday from 9 a.m.–3 p.m., eastern time 

zone. 

FOR FURTHER INFORMATION CONTACT: Jody 

Blatt, Research Analyst, Division of 

Payment Policy, Medicare 

Demonstration Programs Group, Office 

of Research Development and 

Information, CMS, Mail Stop C4–17–27, 

7500 Security Boulevard, Baltimore, 

Maryland 21244–1850. The telephone 

number is (410) 786–6921 or e-mail 

jody.blatt@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: Section 

649 of (MMA) requires the Secretary of 

Health and Human Services to 

‘‘establish a pay-for-performance 

demonstration program with physicians 

to meet the needs of eligible 

beneficiaries through the adoption and 

use of health information technology 

and evidence-based outcomes 

measures.’’ The resulting 

demonstration, known as MCMP 

Demonstration, provides incentives to 

primary care physician practices for (1) 

clinical systems, which encompasses 

the implementation and use of 

information technology, patient 

education, and care management, and 

(2) clinical quality, which encompasses 

using evidence-based outcome 

measures. The objectives of the 

demonstration are to: (1) Promote 

continuity of care, (2) stabilize medical 

conditions, (3) reduce adverse health 

outcomes, and (4) prevent or minimize 

acute episodes of chronic conditions 

that require an emergency room visit or 

hospitalization. 

In the demonstration, payments will 

be made to physician practices that 

meet or exceed performance standards 

established by CMS. There will be two 

categories of performance payments. 

One payment will be made for clinical 

systems based on the number of patients 

who are Medicare beneficiaries with a 

chronic condition; and the other will be 

made for clinical quality based on the 

number of beneficiaries with the 

specific diseases of diabetes, congestive 

heart failure, or coronary artery disease. 

Payment for clinical quality will also be 

made for meeting standards on various 

screening measures. Payments can vary 

based on performance. 

The three year demonstration project 

will be launched in four states, with up 

to 2,800 physicians from solo and small 

to medium-sized group practices 

participating, including practices in 

both urban and rural areas. The project 

is expected to become operational in 

2006, with physicians being paid in 

2006, 2007, and 2008. It will operate in 

the same four states as initiated the 

Doctor’s Office Quality—Information 

Technology project (California, Utah, 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58443 

Arkansas, and Massachusetts), thus 

allowing the Quality Improvement 

Organizations (QIOs) in those states to 

provide support to participating 

physicians. 

I. Description of the New System of 

Records 

A. Statutory and Regulatory Basis for 

System 

The authority for maintenance of this 

system is given under the provisions of 

Section 649 of the Medicare 

Prescription Drug, Improvement, and 

Modernization Act of 2003 (MMA) 

(Public Law 108–173). 

B. Collection and Maintenance of Data 

in the System 

This system will maintain 

individually identifiable data collected 

on the Medicare expenditures of 

beneficiaries assigned to the 

participating physician practices. The 

data will consist of clinical quality 

measures collected from the individual 

physician practices participating in the 

demonstration. The collected 

information will contain: provider 

name, unique provider identification 

number, unique demonstration practice 

identification number, beneficiary 

health insurance claim number, and 

whether the beneficiary received the 

services described by the clinical 

measure and was counted in either the 

numerator and/or the denominator of 

the performance measure calculation for 

the physician. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The government will 

only release MCMP information that can 

be associated with an individual as 

provided for under ‘‘Section III. 

Proposed Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of MCMP. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the 

system will be approved only to the 

extent necessary to accomplish the 

purpose of the disclosure and only after 

CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected, e.g., to 

collect and maintain data on Medicare 

expenditures of the beneficiaries 

assigned to participating physician 

practices that is relevant to calculating 

physician based performance on clinical 

quality measures and making 

performance payments to participating 

physician practices. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable information 

form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all individually identifiable 

information; and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use 

The Privacy Act allows us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such compatible use 

of data is known as a ‘‘routine use.’’ The 

proposed routine uses in this system 

meet the compatibility requirement of 

the Privacy Act. We are proposing to 

establish the following routine use 

disclosures of information maintained 

in the system: 

1. To agency contractors or 

consultants who have been engaged by 

the agency to assist in the performance 

of a service related to this system and 

who need to have access to the records 

in order to perform the activity. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing CMS function relating to 

purposes for this system. CMS 

occasionally contracts out certain of its 

functions when doing so would 

contribute to effective and efficient 

operations. CMS must be able to give a 

contractor or consultant whatever 

information is necessary for the 

contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To another Federal or state agency 

to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require MCMP 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

3. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

The MCMP data will provide for 

research or in support of evaluation 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

4. To a member of Congress or to a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries sometimes request the 

help of a member of Congress in 

resolving an issue relating to a matter 

before CMS. The member of Congress 

then writes CMS, and CMS must be able 

58444 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

to give sufficient information to be 

responsive to the inquiry. 

5. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, and occasionally when 

another party is involved in litigation 

and CMS’ policies or operations could 

be affected by the outcome of the 

litigation, CMS would be able to 

disclose information to the DOJ, court or 

adjudicatory body involved. 

6. To a CMS contractor (including, but 

not necessarily limited to fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such program. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual relationship or grant 

with a third party to assist in 

accomplishing CMS functions relating 

to the purpose of combating fraud and 

abuse. 

CMS occasionally contracts out 

certain of its functions and makes grants 

when doing so would contribute to 

effective and efficient operations. CMS 

must be able to give a contractor or 

grantee whatever information is 

necessary for the contractor or grantee to 

fulfill its duties. In these situations, 

safeguards are provided in the contract 

prohibiting the contractor or grantee 

from using or disclosing the information 

for any purpose other than that 

described in the contract and requiring 

the contractor or grantee to return or 

destroy all information. 

7. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require 

information for the purpose of 

combating fraud and abuse in such 

Federally-funded programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information (PHI) as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 Code of Federal 

Regulation Parts 160 and 164, 65 Fed. 

Reg. 82462 (12–28–00), Subparts A and 

E. Disclosures of PHI authorized by 

these routine uses may only be made if, 

and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even of not directly 

identifiable information, except 

pursuant to one of the routine uses or 

if required by law, if we determine there 

is a possibility that an individual can be 

identified through implicit deduction 

based on small cell sizes (instances 

where the patient population is so small 

that individuals who are familiar with 

the enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the E–

Government Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the New System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

Data in this system will be subject to the 

authorized releases in accordance with 

the routine uses identified in this 

system. 

CMS will take precautionary 

measures (see item IV. above) to 

minimize the risks of unauthorized 

access to the records and the potential 

harm to individual privacy or other 

personal or property rights of patients 

whose data is maintained in the system. 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of maintaining this system. 

Dated: September 27, 2005. 

Charlene Brown, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

System No.: 09–70–0562 

SYSTEM NAME: 

‘‘Medicare Care Management 

Performance Demonstration (MCMP)’’

HHS/CMS/ORDI. 

SECURITY CLASSIFICATION: 

Level 3 Privacy Act Sensitive. 

SYSTEM LOCATION: 

This system is maintained at the 

Centers for Medicare & Medicaid 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58445 

Services (CMS) Data Center, 7500 

Security Boulevard, North Building, 

First Floor, Baltimore, Maryland 21244–

1850, and CMS contractors and agents at 

various locations. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

The data will be maintained on 

individual physicians participating in 

the demonstration. In order to collect 

this data and use it to determine 

incentive payments to physicians, the 

system will also maintain individually 

identifiable information on Medicare 

beneficiaries assigned to physicians 

participating in the demonstration. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The data will consist of clinical 

quality measures collected from 

physician participating in the 

demonstration. The collected 

information will contain provider name, 

unique provider identification number, 

unique demonstration practice 

identification number, beneficiary 

health insurance claim number (HICN), 

beneficiary demographic and diagnostic 

information relevant to the measure, 

and whether the beneficiary received 

the services described by the clinical 

measure and was counted in either the 

numerator and/or the denominator of 

the performance measure calculation for 

the physician. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

The authority for maintenance of this 

system is given under the provisions of 

Section 649 of the Medicare 

Prescription Drug, Improvement, and 

Modernization Act of 2003 (Public Law 

108–173). 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the system is 

to establish a pay-for-performance three 

year pilot with physicians to promote 

the adoption and use of health 

information technology to improve the 

quality of patient care for chronically ill 

Medicare patients. Information retrieved 

from this system will also be disclosed 

to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the agency or by a 

contractor or consultant; (2) assist 

another Federal or state agency with 

information to enable such agency to 

administer a Federal health benefits 

program, or to enable such agency to 

fulfill a requirement of Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; (3) assist an 

individual or organization for a research 

project or in support of an evaluation 

project related to the prevention of 

disease or disability, the restoration or 

maintenance of health, or payment 

related projects; (4) support constituent 

requests made to a congressional 

representative; (5) support litigation 

involving the agency; and (6) combat 

fraud and abuse in certain health 

benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. Entities Who May Receive 

Disclosures Under Routine Use 

The Privacy Act allows us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such compatible use 

of data is known as a ‘‘routine use.’’ The 

proposed routine uses in this system 

meet the compatibility requirement of 

the Privacy Act. We are proposing to 

establish the following routine use 

disclosures of information maintained 

in the system: 

1. To agency contractors or 

consultants who have been engaged by 

the agency to assist in the performance 

of a service related to this system and 

who need to have access to the records 

in order to perform the activity. 

2. To another Federal or state agency 

to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

3. To an individual or organization for 

a research project or in support of an 

evaluation project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment related projects. 

4. To a member of Congress or to a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

5. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The agency or any component 

thereof, or 

b. Any employee of the agency in his 

or her official capacity, or 

c. Any employee of the agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government is a 

party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

6. To a CMS contractor (including, but 

not necessarily limited to fiscal 

intermediaries and carriers) that assists 

in the administration of a CMSadministered health benefits program, 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such program. 

7. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

B. Additional Provisions Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information (PHI) as defined by 

Department of Health and Human 

Services (HHS) regulation ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information’’ (45 Code of Federal 

Regulations (CFR) Parts 160 and 164, 65 

FR 82462 (12–28–00), Subparts A and E. 

Disclosures of PHI authorized by these 

routine uses may only be made if, and 

as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even of not directly 

identifiable information, except 

pursuant to one of the routine uses or 

if required by law, if we determine there 

is a possibility that an individual can be 

identified through implicit deduction 

based on small cell sizes (instances 

where the patient population is so small 

that individuals who are familiar with 

the enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

58446 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on magnetic 

media. 

RETRIEVABILITY: 

Information collected will be 

retrieved by the name or other 

identifying information of the 

participating provider, and may also be 

retrievable by HICN at the individual 

beneficiary record level. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the E–

Government Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. Office of Management and 

Budget Circular A–130, Management of 

Federal Resources, Appendix III, 

Security of Federal Automated 

Information Resources also applies. 

Federal, HHS, and CMS policies and 

standards include but are not limited to: 

all pertinent National Institute of 

Standards and Technology publications; 

the HHS Information Systems Program 

Handbook and the CMS Information 

Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain identifiable 

information maintained in the MCMP 

system of records for a period of 6 years. 

Data residing with the designated claims 

payment contractor shall be returned to 

CMS at the end of the project, with all 

data then being the responsibility of 

CMS for adequate storage and security. 

All claims-related records are 

encompassed by the document 

preservation order and will be retained 

until notification is received from the 

DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Medicare Demonstration 

Program Group, Office of Research 

Development and Information, CMS, 

7500 Security Boulevard, Mail stop C4–

17–27, Baltimore, Maryland, 21244–

1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, and for verification purposes, the 

subject individual’s name, provider 

identification number, and the patient’s 

medical record number. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 (a) 

(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Information maintained in this system 

will be collected from physicians 

volunteering to participate in the MCMP 

Demonstration. Additional data will be 

collected from Medicare claims 

payment records. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–19907 Filed 10–5–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

The Essentials of Food and Drug 

Administration Device Regulations: A 

Primer for Manufacturers and 

Suppliers; Public Workshop 

AGENCY: Food and Drug Administration, 

HHS. 

ACTION: Notice of public workshop. 

SUMMARY: The Food and Drug 

Administration (FDA) Philadelphia 

District, in cooperation with AdvaMed’s 

Medical Technology Learning Institute, 

is announcing a public workshop on 

FDA device regulations. This 1 1/2-day 

public workshop for start up and small 

device manufacturers and their 

suppliers will include both industry and 

FDA perspectives and a question and 

answer period. 

Date and Time: The public workshop 

will be held on Tuesday, October 11, 

2005, from 8:30 a.m. to 5:30 p.m. and 

Wednesday, October 12, 2005, from 8:30 

a.m. to 12 noon. 

Location: The public workshop will 

be held at The Wyndham Philadelphia 

at Franklin Plaza, 17th and Race St., 

Philadelphia, PA 19103, 215–448–2000. 

For further hotel information and 

driving directions, go to http:// 

www.wyndham.com/hotels/PHLFP. 

(FDA has verified the Web site address, 

but is not responsible for subsequent 

changes to the Web site after this 

document publishes in the Federal 

Register.) 

Contact: 

For FDA: Judy Summers-Gates, Food 

and Drug Administration, rm. 900, 

U.S. Customhouse, 200 Chestnut 

St., Philadelphia, PA 19106, 215–

717–3008, FAX: 215–597–4660, email: judith.summersgates@fda.gov. 

For AdvaMed: Krystine McGrath, 

202–434–7237, FAX: 202–783–

8750, kmcgrath@advamed.org; or 

Dia Black, 202–434–7231, FAX: 

202–783–8750, e-mail: 

dblack@avamed.org. 

Registration: Send registration 

information (including name, title, firm 

name, address, telephone, and fax 

number), and the registration fee of $350 

per person to the AdvaMed contacts (see 

Contact). The registration fee for FDA 

employees is waived. To register via the 

Internet go to http://www.advamed.org/ 

philadelphia. (FDA has verified the Web 

site address, but is not responsible for 

subsequent changes to the Web site after 

this document publishes in the Federal 

Register.)