58436 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

by these routine uses may only be made 

if, and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even if not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored on magnetic 

media. 

RETRIEVABILITY: 

Information collected will be 

retrieved by the name or other 

identifying information of the 

participating provider, and may also be 

retrievable by HICN at the individual 

beneficiary record level. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include, but are 

not limited to, all pertinent National 

Institute of Standards and Technology 

publications, the HHS Information 

Systems Program Handbook, and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain identifiable 

information maintained in the PGPD 

system of records for a period of 6 years. 

Data residing with the designated claims 

payment contractor shall be returned to 

CMS at the end of the project, with all 

data then being the responsibility of 

CMS for adequate storage and security. 

All claims-related records are 

encompassed by the document 

preservation order and will be retained 

until notification is received from the 

DOJ. 

SYSTEM MANAGER AND ADDRESS: 

Director, Medicare Demonstration 

Programs Group, CMS, 7500 Security 

Boulevard, Mail stop C4–17–27, 

Baltimore, Maryland, 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, and for verification purposes, the 

subject individual’s name, provider 

identification number, and the patient’s 

Medicare number. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 

(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Information maintained in this system 

will be collected from physicians 

voluntarily participating through claims 

data requesting payment for services. 

The PGPD information will also be 

collected from the reporting of 

ambulatory care data by participating 

physician groups. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–19904 Filed 10–5–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of New 

System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of a new system of 

records. 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

CMS is proposing to establish a new 

system of records (SOR) titled 

‘‘Medicare Drug Data Processing System 

(DDPS),’’ System No. 09–70–0553. On 

December 8, 2003, Congress passed the 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Public Law (Pub. L.) 108–

173). MMA amends the Social Security 

Act (the Act) by adding the Medicare 

Part D Program under Title XVIII and 

mandate that CMS establish a voluntary 

Medicare prescription drug benefit 

program effective January 1, 2006. 

Under the new Medicare Part D benefit, 

the Act allows Medicare payment to 

plans that contract with CMS to provide 

qualified Part D prescription drug 

coverage as described in 42 Code of 

Federal Regulations (CFR) § 423.401. As 

a condition of payment, all Part D plans 

must submit data and information 

necessary for CMS to carry out payment 

provisions (§ 1860D–15(c)(1)(C) and 

(d)(2) of the Act, and 42 CFR 423.322). 

The primary purpose of this system is 

to collect, maintain, and process 

information on all Medicare covered 

and non-covered drug events, including 

non-Medicare drug events, for Medicare 

beneficiaries participating in the Part D 

voluntary prescription drug coverage 

under the Medicare program. The 

system will process drug event 

transactions and other drug events as 

necessary for CMS to help determine 

appropriate payment of covered drugs. 

The DDPS will consist of the transaction 

validation processing, storing and 

maintaining the drug event data in a 

large-scale database, and staging the 

data into data marts to support 

beneficiary and plan analysis of 

incurred payment. Information in this 

system will also be disclosed to: (1) 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58437 

Support regulatory, reimbursement, and 

policy functions performed within the 

agency or by a contractor or consultant; 

(2) assist Quality Improvement 

Organizations; (3) assist Part D 

prescription drug plans; (4) support an 

individual or organization for a 

research, evaluation or epidemiological 

project; (5) support constituent requests 

made to a congressional representative; 

(6) support litigation involving the 

agency; and (7) combat fraud and abuse 

in certain health benefits programs. We 

have provided background information 

about the new system in the 

‘‘Supplementary Information’’ section 

below. Although the Privacy Act 

requires only that CMS provide an 

opportunity for interested persons to 

comment on the proposed routine uses, 

CMS invites comments on all portions 

of this notice. See ‘‘Effective Dates’’

section for comment period. 

EFFECTIVE DATES: CMS filed a new 

system report with the Chair of the 

House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on September 28, 2005. To 

ensure that all parties have adequate 

time in which to comment, the new 

system will become effective 30 days 

from the publication of the notice, or 

from the date it was submitted to OMB 

and the Congress, whichever is later, 

unless CMS receives comments that 

require alterations to this notice. 

ADDRESSES: The public should address 

comments to the CMS Privacy Officer, 

Division of Privacy Compliance Data 

Development, CMS, Room N2–04–27, 

7500 Security Boulevard, Baltimore, 

Maryland 21244–1850. Comments 

received will be available for review at 

this location, by appointment, during 

regular business hours, Monday through 

Friday from 9 a.m.–3 p.m., eastern 

daylight time. 

FOR FURTHER INFORMATION CONTACT: 

Harvey Hull, Health Insurance 

Specialist Division of Program Analysis 

and Performance, Medicare Drug Benefit 

Group, Centers for Beneficiary Choices, 

CMS, Room C1–25–05, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. The telephone number is 410–

786–4036 or contact 

harvey.hull@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: In 

December 2003, Congress passed the 

Medicare Prescription Drug, 

Improvement, and Modernization Act, 

amending the Act by adding Part D 

under Title XVIII. Under the new 

Medicare benefit, the Act allows 

Medicare payment to plans that contract 

with CMS to provide qualified Part D 

prescription drug coverage as described 

in 42 CFR 423.401. For simplicity, we 

use the term ‘‘plans’’ to refer to these 

entities that provide Part D prescription 

drug benefits and that must submit 

claims data to CMS for payment 

calculations. The Act provides four 

summary mechanisms for paying plans: 

1. Direct subsidies; 2. premium and 

cost-sharing subsidies for qualifying 

low-income individuals (low-income 

subsidy); 3. federal reinsurance 

subsidies; and 4. risk-sharing. 

As a condition of payment, all Part D 

plans must submit data and information 

necessary for CMS to carry out payment 

provisions (§ 1860D–15(c) (1) (C) and (d) 

(2) of the Act, and 42 CFR § 423.322). 

This document describes how CMS will 

implement the statutory payment 

mechanisms by collecting a limited 

subset of data elements on 100 percent 

of prescription drug ‘‘claims’’ or events. 

Much of the data, especially dollar 

fields, will be used primarily for 

payment. However, some of the other 

data elements such as pharmacy and 

prescriber identifiers will be used for 

validation of the claims as well as for 

other legislated functions such as 

quality monitoring, program integrity, 

and oversight. In addition, we note that 

this paper only covers data collected on 

claims and does not cover data CMS 

may collect from plans through other 

mechanisms, for example monitoring 

plan formularies and beneficiary 

appeals. 

Every time a beneficiary fills a 

prescription covered under Part D, plans 

must submit a summary record called 

the prescription drug event (PDE) record 

to CMS. The PDE record contains 

prescription drug cost and payment data 

that will enable CMS to make payment 

to plans and otherwise administer the 

Part D benefit. Specifically, the PDE 

record will include covered drug costs 

above and below the out-of-pocket 

threshold; distinguish enhanced 

alternative costs from the costs of drugs 

provided under the standard benefit; 

and will record payments made by Part 

D plan sponsors, other payers, and by or 

on behalf of beneficiaries. Plans must 

also identify costs that contribute 

towards a beneficiary’s true-out-ofpocket or TrOOP limit, separated into 

three categories: low-income costsharing subsidy amounts paid by the 

plan at the point of sale (POS), 

beneficiary payments, and all TrOOPeligible payments made by qualified 

entities on behalf of a beneficiary. Much 

of the data, especially dollar fields, will 

be used primarily for payment. 

However, some of the other data 

elements such as pharmacy and 

prescriber identifiers will be used for 

validation of the claims as well as for 

other legislated functions such as 

quality monitoring, program integrity, 

and oversight. 

I. Description of the Proposed System of 

Records 

A. Statutory and Regulatory Basis for 

System 

Authority for maintenance of this 

system is given under provisions of the 

Medicare Prescription Drug, 

Improvement, and Modernization Act, 

amending the Social Security Act (the 

Act) by adding Part D under Title XVIII 

(§ 1860D–15(c)(1)(C) and (d)(2), as 

described in 42 Code of Federal 

Regulation (CFR) 423.401. 

B. Collection and Maintenance of Data 

in the System 

The system contains summary 

prescription drug claim information on 

all Medicare covered and non-covered 

drug events, including non-Medicare 

drug events, for Medicare beneficiaries 

of the Medicare program. This system 

contains summary prescription drug 

claim data, health insurance claim 

number, card holder identification 

number, date of service, gender, and 

optionally, the date of birth. The system 

contains provider characteristics, 

prescriber identification number, 

assigned provider number (facility, 

referring/servicing physician), and 

national drug code, total charges, 

Medicare payment amount, and 

beneficiary’s liability. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The government will 

only release DDPS information that can 

be associated with an individual as 

provided for under ‘‘Section III. 

Proposed Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. 

We will only disclose the minimum 

personal data necessary to achieve the 

purpose of DDPS. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

In general, disclosure of information 

from the system will be approved only 

for the minimum information necessary 

58438 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

to accomplish the purpose of the 

disclosure and only after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected, e.g., to 

assist in a variety of health care 

initiatives with other entities related to 

the evaluation and study of the 

operation and effectiveness of the 

Medicare program. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all individually-identifiable 

information; and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the DDPS without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. We propose to establish or 

modify the following routine use 

disclosures of information maintained 

in the system: 

1. To Agency contractors or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or consultant 

whatever information is necessary for 

the contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To Quality Improvement 

Organization (QIO) in connection with 

review of claims, or in connection with 

studies or other review activities 

conducted pursuant to Part B of Title XI 

of the Act and in performing affirmative 

outreach activities to individuals for the 

purpose of establishing and maintaining 

their entitlement to Medicare benefits or 

health insurance plans. 

QIOs will work to implement quality 

improvement programs, provide 

consultation to CMS, its contractors, 

and to state agencies. QIOs will assist 

the state agencies in related monitoring 

and enforcement efforts, assist CMS and 

intermediaries in program integrity 

assessment, and prepare summary 

information for release to CMS. 

3. To Part D Prescription Drug Plans 

and their Prescription Drug Event 

submitters, providing protection against 

medical expenses of their enrollees 

without the beneficiary’s authorization, 

and having knowledge of the occurrence 

of any event affecting (a) an individual’s 

right to any such benefit or payment, or 

(b) the initial right to any such benefit 

or payment, for the purpose of 

coordination of benefits with the 

Medicare program and implementation 

of the Medicare Secondary Payer 

provision at 42 U.S.C. 1395y (b). 

Information to be disclosed shall be 

limited to Medicare utilization data 

necessary to perform that specific 

function. In order to receive the 

information, they must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a Third 

Party Administrator; 

b. Utilize the information solely for 

the purpose of processing the 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

Other insurers may require DDPS 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

4. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

DDPS data will provide for research, 

evaluation, and epidemiological 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

5. To a Member of Congress or 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries often request the help of 

a Member of Congress in resolving an 

issue relating to a matter before CMS. 

The Member of Congress then writes 

CMS, and CMS must be able to give 

sufficient information to be responsive 

to the inquiry. 

6. To the Department of Justice (DOJ), 

court, or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

7. To a CMS contractor (including, but 

not limited to fiscal intermediaries and 

carriers) that assists in the 

administration of a CMS-administered 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58439 

health benefits program, or to a grantee 

of a CMS-administered grant program, 

when disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such program. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud and abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

8. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require DDPS 

information for the purpose of 

combating fraud and abuse in such 

Federally funded programs. 

B. Additional Circumstances Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (Dec. 28, 00), as amended 

by 66 FR 12434 (Feb. 26, 01)). 

Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of non-identifiable 

information, except pursuant to one of 

the routine uses, if there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effect of the Modified System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

We will only disclose the minimum 

personal data necessary to achieve the 

purpose of DDPS. Disclosure of 

information from the system will be 

approved only to the extent necessary to 

accomplish the purpose of the 

disclosure. CMS has assigned a higher 

level of security clearance for the 

information maintained in this system 

in an effort to provide added security 

and protection of data in this system. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights. 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of the disclosure of 

information relating to individuals. 

Dated: September 28, 2005. 

John R. Dyer, 

Chief Operating Officer, Centers for Medicare 

& Medicaid Services. 

System No. 09–70–0553 

SYSTEM NAME: 

Medicare Drug Data Processing 

System (DDPS), HHS/CMS/CBC. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850 and at 

various contractor sites. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

The system contains summary 

prescription drug claim information on 

all Medicare covered and non-covered 

drug events, including non-Medicare 

drug events, for Medicare beneficiaries 

of the Medicare program. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

This system contains summary 

prescription drug claim data, health 

insurance claim number (HICN), card 

holder identification number, date of 

service, gender, and optionally, the date 

of birth. The system contains provider 

characteristics, prescriber identification 

number, assigned provider number 

(facility, referring/servicing physician), 

and national drug code, total charges, 

Medicare payment amount, and 

beneficiary’s liability. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of this 

system is given under provisions of the 

Medicare Prescription Drug, 

Improvement, and Modernization Act, 

amending the Social Security Act (the 

58440 Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 

Act) by adding Part D under Title XVIII 

(§ 1860D–15(c)(1)(C) and (d)(2), as 

described in 42 Code of Federal 

Regulation (CFR) § 423.401. 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of this system is 

to collect, maintain, and process 

information on all Medicare covered 

and non-covered drug events, including 

non-Medicare drug events, for Medicare 

beneficiaries participating in the Part D 

voluntary prescription drug coverage 

under the Medicare program. The 

system will process drug event 

transactions and other drug events as 

necessary for CMS to help determine 

appropriate payment of covered drugs. 

The DDPS will consist of the transaction 

validation processing, storing and 

maintaining the drug event data in a 

large-scale database, and staging the 

data into data marts to support 

beneficiary and plan analysis of 

incurred payment. Information in this 

system will also be disclosed to: (1) 

Support regulatory, reimbursement, and 

policy functions performed within the 

agency or by a contractor or consultant; 

(2) assist Quality Improvement 

Organizations; (3) assist Part D 

prescription drug plans; (4) support an 

individual or organization for a 

research, evaluation or epidemiological 

project; (5) support constituent requests 

made to a congressional representative; 

(6) support litigation involving the 

agency; and (7) combat fraud and abuse 

in certain health benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. Entities Who May Receive 

Disclosures Under Routine Use 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the DDPS without the 

consent of the individual to whom such 

information pertains. Each proposed 

disclosure of information under these 

routine uses will be evaluated to ensure 

that the disclosure is legally 

permissible, including but not limited to 

ensuring that the purpose of the 

disclosure is compatible with the 

purpose for which the information was 

collected. We propose to establish or 

modify the following routine use 

disclosures of information maintained 

in the system: 

1. To Agency contractors or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

2. To Quality Improvement 

Organization (QIO) in connection with 

review of claims, or in connection with 

studies or other review activities 

conducted pursuant to Part B of Title XI 

of the Act and in performing affirmative 

outreach activities to individuals for the 

purpose of establishing and maintaining 

their entitlement to Medicare benefits or 

health insurance plans. 

3. To Part D Prescription Drug Plans 

and their Prescription Drug Event 

submitters, providing protection against 

medical expenses of their enrollees 

without the beneficiary’s authorization, 

and having knowledge of the occurrence 

of any event affecting (a) an individual’s 

right to any such benefit or payment, or 

(b) the initial right to any such benefit 

or payment, for the purpose of 

coordination of benefits with the 

Medicare program and implementation 

of the Medicare Secondary Payer 

provision at 42 U.S.C. 1395y (b). 

Information to be disclosed shall be 

limited to Medicare utilization data 

necessary to perform that specific 

function. In order to receive the 

information, they must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a Third 

Party Administrator; 

b. Utilize the information solely for 

the purpose of processing the 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

4. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

5. To a Member of Congress or 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

6. To the Department of Justice (DOJ), 

court, or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, 

is a party to litigation or has an interest 

in such litigation, and by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation. 

7. To a CMS contractor (including, but 

not limited to fiscal intermediaries and 

carriers) that assists in the 

administration of a CMS-administered 

health benefits program, or to a grantee 

of a CMS-administered grant program, 

when disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such program. 

8. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

B. Additional Circumstances Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (Dec. 28, 00), as amended 

by 66 FR 12434 (Feb. 26, 01)). 

Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of non-identifiable 

information, except pursuant to one of 

the routine uses, if there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

Records are stored on both tape 

cartridges (magnetic storage media) and 

in a DB2 relational database 

management environment (DASD data 

storage media). 

Federal Register / Vol. 70, No. 193 / Thursday, October 6, 2005 / Notices 58441 

RETRIEVABILITY: 

Information is most frequently 

retrieved by HICN, provider number 

(facility, physician, IDs), service dates, 

and beneficiary state code. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

Records are maintained with 

identifiers for all transactions after they 

are entered into the system for a period 

of 20 years. Records are housed in both 

active and archival files. All claimsrelated records are encompassed by the 

document preservation order and will 

be retained until notification is received 

from the Department of Justice. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of Program 

Analysis and Performance, Medicare 

Drug Benefit Group, Centers for 

Beneficiary Choices, CMS, Room S1–

06–14, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of notification, the 

subject individual should write to the 

system manager who will require the 

system name, and the retrieval selection 

criteria (e.g., HICN, facility/pharmacy 

number, service dates, etc.). 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 

5b.5(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Summary prescription drug claim 

information contained in this system is 

obtained from the Prescription Benefit 

Package (PBP) Plans and Medicare 

Advantage (MA-PBP) Plans daily and 

monthly drug event transaction reports, 

Medicare Beneficiary Database (09–70–

0530), and other payer information to be 

provided by the TROOP Facilitator. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–19905 Filed 10–5–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Deletion of 

System of Records 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice to delete 14 systems of 

records. 

SUMMARY: CMS proposes to delete 14 

systems of records from its inventory 

subject to the Privacy Act of 1974 (Title 

5 United States Code 552a). 

DATES: Effective Date: The deletions will 

be effective on September 27, 2005. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance Data 

Development, Enterprise Databases 

Group, Office of Information Services, 

CMS, Room N2–04–27, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. The telephone number is (410) 

786–5357. Comments received will be 

available for review at this location, by 

appointment, during regular business 

hours, Monday through Friday from 9 

a.m.–3 p.m., eastern time zone. 

SUPPLEMENTARY INFORMATION: CMS is 

reorganizing its databases because of the 

amount of information it collects to 

administer the Medicare program. 

Retention and destruction of the data 

contained in these systems will follow 

the schedules listed in the system 

notice. CMS is deleting the following 

systems of records. 

Deletions 

System No. Title System 

manager 

09–70–0030 National Long-Term Care Study Follow-up ......................................................................................................... HHS/CMS/ORDI 

09–70–0039 Evaluation of the Medicare Alzheimer’s Disease Demonstration ....................................................................... HHS/CMS/ORDI 

09–70–0040 Health Care Financing Administration Medicare Heart Transplant Data File ..................................................... HHS/CMS/ORDI 

09–70–0045 Evaluation of the Arizona Health Care Cost Containment and Long Term Care Systems Demonstration ....... HHS/CMS/ORDI 

09–70–0046 Home Health Quality Indicator System ............................................................................................................... HHS/CMS/ORDI 

09–70–0049 Evaluation of the Home Health Agency Prospective Payment Demonstration .................................................. HHS/CMS/ORDI 

09–70–0050 The Medicare/Medicaid Multi-State Case Mix and Quality Data Base for Nursing Home Residents ................ HHS/CMS/ORDI 

09–70–0051 Quality Assurance for the Home Health Agency Prospective Payment Demonstration .................................... HHS/CMS/ORDI 

09–70–0052 Post-Hospitalization Outcomes Studies .............................................................................................................. HHS/CMS/ORDI 

09–70–0057 Evaluation of the Medicaid Extension of Eligibility to Certain Low Income Families Not Otherwise Qualified 

to Receive Medicaid Benefits Demonstration.

HHS/CMS/ORDI 

09–70–0058 Evaluation of the Medicare SELECT Program .................................................................................................... HHS/CMS/ORDI 

09–70–0059 The Medicaid Necessity Appropriateness and Outcomes of Care Study ........................................................... HHS/CMS/ORDI