60530 Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of Modified 

or Altered System 

AGENCY: Department of Health and 

Human Services (HHS), Centers for 

Medicare & Medicaid Services (CMS). 

ACTION: Notice of Modified or Altered 

System of Records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we are proposing to modify or alter a 

SOR titled, ‘‘Medicare Managed Care 

System (MMCS), No. 09–70–4001.’’

MMCS processes beneficiary enrollment 

and creates beneficiary level payments 

for the Managed Care Organizations 

(MCO). We propose to broaden the 

scope of this system by adding the 

Medicare Part D Program under Title 

XVIII. The Medicare+Choices Program 

has been changed to the Medicare 

Advantage (MA) Program. The MA was 

mandated by the Balance Budget Act 

(BBA) of 1997 (Public Law (Pub. L.) 

105–33). To more accurately reflect the 

changes proposed for this system, we 

will modify the name to read: 

‘‘Medicare Advantage Prescription Drug 

(MARx) System.’’ The enhanced system 

will continue to perform all current 

MMCS processing requirements. In 

addition, MARx will be a stand alone 

system that will include the processing 

of all enrollment/disenrollment 

transactions associated with the Part D 

Program. MARx will include the 

following: Health Maintenance 

Organizations (HMO), Health Care 

Prepayment Plan (HCPP), Medicare 

Advantage Organizations (MAO), 

Medicare Advantage Prescription Drug 

(MAPD) Plans and Prescription Drug 

Plans (PDP). 

On December 8, 2003, Congress 

passed the Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173). MMA 

amends the Social Security Act (the Act) 

by adding the Medicare Part D Program 

under Title XVIII and mandate that CMS 

establish a voluntary Medicare 

prescription drug benefit program 

effective January 1, 2006. Under the new 

Medicare Part D benefit, the Act allows 

Medicare payment to MA plans that 

contract with CMS to provide qualified 

Part D prescription drug coverage as 

described in 42 Code of Federal 

Regulations (CFR) 417 and 422. 

We are modifying the language in 

some of the routine uses to provide 

clarity to CMS’s intention to disclose 

individual-specific information 

contained in this system. The routine 

uses will remain prioritized according 

to their proposed usage. Information 

previously retrieved from the 

Enrollment Database (System No. 09–

70–0502) will now be retrieved by the 

Medicare Beneficiary Database (MBD) 

(System No. 09–70–0536). We will also 

take the opportunity to update any 

sections of the system that were affected 

by the recent reorganization and to 

update language in the administrative 

sections to correspond with language 

used in other CMS SORs. 

The primary purpose of the SOR is to 

maintain a master file of MA and MAPD 

plan members for accounting and 

payment control; expedite the exchange 

of data with MA and MAPD; control the 

posting of pro-rata amounts to the Part 

B deductible of currently enrolled MA 

members; and track participation of the 

prescription drug benefits provided 

under private prescription drug plans 

and Medicare employer plans. 

Information in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed by a contractor or consultant 

contracted by the Agency; (2) support 

another Federal or State agency, agency 

of a state government, an agency 

established by state law, or its fiscal 

agent; (3) assist provider and suppliers 

of service directly or dealing through 

contractors, fiscal intermediaries (FI) or 

carriers for the administration of Title 

XVIII; (4) assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs; (5) 

assist insurance companies, third party 

administrators, employers, self-insurers, 

managed care organizations, and other 

supplemental insurers; (6) facilitate 

research on the quality and effectiveness 

of care provided, as well as paymentrelated projects; (7) support constituent 

requests made to a congressional 

representative; (8) support litigation 

involving the Agency, and (9) combat 

fraud and abuse in certain health 

benefits programs. We have provided 

background information about the 

modified system in the SUPPLEMENTARY

INFORMATION section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See EFFECTIVE

DATES section for comment period. 

EFFECTIVE DATES: CMS filed a modified 

or altered system report with the Chair 

of the House Committee on Government 

Reform and Oversight, the Chair of the 

Senate Committee on Governmental 

Affairs, and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on October 14, 2005. To ensure 

that all parties have adequate time in 

which to comment, the modified or 

altered SOR, including routine uses, 

will become effective 40 days from the 

publication of the notice, or from the 

date it was submitted to OMB and the 

Congress, whichever is later, unless 

CMS receives comments that require 

alterations to this notice. 

ADDRESSES: The public should address 

comments to: CMS Privacy Officer, 

Division of Privacy Compliance Data 

Development (DPCDD), CMS, Room N2–

04–27, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

Comments received will be available for 

review at this location, by appointment, 

during regular business hours, Monday 

through Friday from 9 a.m.–3 p.m., 

Eastern daylight time. 

FOR FURTHER INFORMATION CONTACT: 

Mary Sincavage, Division Director, 

Division of Medicare Advantage 

Appeals and Payment Systems, 

Information Services Modernization 

Group, Office of Information Services, 

CMS, Room N3–16–24, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. The telephone number is 410–

786–1163. 

SUPPLEMENTARY INFORMATION: The 

Medicare Managed Care System 

(MMCS) is the redesign of the legacy 

system Group Health Plan (GHP) 

system. MMCS processes beneficiary 

enrollment and creates beneficiary level 

payments for the Managed Care 

Organizations (MCO). The beneficiary 

level payments are aggregated to the 

MCO level and sent to the Automated 

Plan Payment System (APPS) for 

additional organization level 

adjustments before payments are sent to 

the MCOs. An independent technical 

evaluation of CMS’ managed care 

system found that without major 

enhancements, MA provisions could not 

be supported by existing Medicare 

systems. Also, the comprehensive 

review of existing systems was 

necessary in order to proceed with a 

development effort that would ensure 

those future customer service and 

program management objectives were 

met. 

The CMS has long realized that the 

Medicare program is in the middle of 

rapidly changing health insurance 

industry characterized by an expansion 

of service delivery models and payment 

options. The MA provisions of the BBA 

of 1997 (Pub. L. 105–33) has made the 

challenge of managing beneficiary 

Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 60531 

health choices one of the most critical 

challenges facing CMS and the health 

industry at large. To be of maximum 

use, the data must be organized and 

categorized into a comprehensive 

system. CMS sought to identify key 

sources, including both organizations 

and systems that could provide valid 

and reliable information. Medicare will 

no longer exist within an environment 

characterized by limited health 

insurance options and standard delivery 

models. 

MARx will recalculate payments due 

to Part D risk adjustment factor 

reconciliation. MARx will receive low 

income subsidy status information from 

the MBD, including notification of any 

changes. MARx will calculate 

adjustments due to any retroactive 

changes to low income subsidy status. 

MARx is not responsible for sending 

Social Security Administration (SSA) 

the Part D plan data. It is assumed that 

this will come from the Health Plan 

Management System (HPMS) (System 

No. 09–70–4004). Fallback plans will 

not be paid by MARx. MARx 

enrollments may be rejected if a 

beneficiary is currently enrolled in a 

plan that is part of the retiree drug 

subsidy (RDS). MARx will notify the 

RDS of any rejected enrollments due to 

this situation. Plans will be notified on 

a weekly basis, if MARx has adjusted 

the premium or if SSA/Railroad 

Retirement Board/Office of Personnel 

Management cannot deduct the 

premium. Additionally, MARx is a 

stand alone system that will be 

processing all enrollment/disenrollment 

transactions associated with the Part D 

program. 

I. Description of the Modified System of 

Records 

A. Statutory and Regulatory Basis for 

the System. Authority for maintenance 

of the system is given under Section 101 

of the Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173) amended 

the Title XVIII of the Social Security 

Act. Authority for maintenance of the 

system is also given under the 

provisions of §§ 1833(a)(1)(A), 1860, 

1866, and 1876 of Title XVIII of the Act 

(42 CFR 417 and 422). 

B. Collection and Maintenance of Data 

in the System. The system will include 

information on recipients of Medicare 

hospital insurance (Part A) and 

Medicare medical insurance (Part B) 

and recipients of the Prescription Drug 

Benefits Program (Part D) enrolled in the 

MA Program. The system will also 

include information about a 

beneficiary’s entitlement to Medicare 

benefits and enrollment in Medicare 

Programs, prescription drug coverage 

and supplementary medical claims 

information. The system will contact 

identifying information such as 

beneficiary name, health insurance 

claim number, social security number, 

and other demographic information. 

II. Agency Policies, Procedures, and 

Restrictions on Routine Uses 

A. The Privacy Act permits us to 

disclose information without an 

individual’s consent if the information 

is to be used for a purpose that is 

compatible with the purpose(s) for 

which the information was collected. 

Any such disclosure of data is known as 

a ‘‘routine use.’’ The government will 

only release MARx information that can 

be associated with an individual as 

provided for under ‘‘Section III. 

Modified Routine Use Disclosures of 

Data in the System.’’ Both identifiable 

and non-identifiable data may be 

disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of MARx. CMS has the 

following policies and procedures 

concerning disclosures of information 

that will be maintained in the system. 

Disclosure of information from the SOR 

will be approved only to the extent 

necessary to accomplish the purpose of 

the disclosure and only after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

data is being collected; e.g., to maintain 

a master file of MA and MAPD plan 

members for accounting and payment 

control; expedite the exchange of data 

with MA and MAPD; control the posting 

of pro-rata amounts to the Part B 

deductible of currently enrolled MA 

members; and track participation of the 

prescription drug benefits provided 

under private prescription drug plans 

and Medicare employer plans. 

2. Determines that the purpose for 

which the disclosure is to be made can 

only be accomplished if the record is 

provided in individually identifiable 

form; 

a. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

b. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy at the earliest 

time all patient-identifiable information; 

and; 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Modified Routine Use Disclosures of 

Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use. These 

routine uses specify circumstances, in 

addition to those provided by statute in 

the Privacy Act of 1974, under which 

CMS may release information from the 

MARx without the consent of the 

individual to whom such information 

pertains. Each proposed disclosure of 

information under these routine uses 

will be evaluated to ensure that the 

disclosure is legally permissible, 

including but not limited to ensuring 

that the purpose of the disclosure is 

compatible with the purpose for which 

the information was collected. We are 

proposing to establish or modify the 

following routine use disclosures of 

information maintained in the system: 

1. To Agency contractors, or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this system. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or consultant 

whatever information is necessary for 

the contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

60532 Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require MARx information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

Disclosure under this routine use 

shall be used by state Medicaid agencies 

pursuant to agreements with the HHS 

for determining Medicaid and Medicare 

eligibility, for quality control studies, 

for determining eligibility of recipients 

of assistance under Titles IV, XVIII, and 

XIX of the Act, and for the 

administration of the Medicaid program. 

Data will be released to the state only on 

those individuals who are patients 

under the services of a Medicaid 

program within the state or who are 

residents of that state. 

We also contemplate disclosing 

information under this routine use in 

situations in which state auditing 

agencies require MARx information for 

auditing state Medicaid eligibility 

considerations. CMS may enter into an 

agreement with state auditing agencies 

to assist in accomplishing functions 

relating to purposes for this system to 

providers and suppliers of services 

directly or through fiscal intermediaries 

or carriers for the administration of Title 

XVIII of the Act. 

3. To providers and suppliers of 

services directly or dealing through 

fiscal intermediaries or carriers for the 

administration of Title XVIII of the Act. 

Providers and suppliers of services 

require MARx information in order to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, as it 

concerns the individual’s entitlement to 

benefits under the Medicare program, 

including proper reimbursement for 

services provided. 

4. To third party contacts in situations 

where the party to be contacted has, or 

is expected to have information relating 

to the individual’s capacity to manage 

his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: The individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exist, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: The individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

Third party contacts require MARx 

information in order to provide support 

for the individual’s entitlement to 

benefits under the Medicare program; to 

establish the validity of evidence or to 

verify the accuracy of information 

presented by the individual, and assist 

in the monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement of services 

provided. 

5. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations or a competitive medical 

plan with a Medicare contract, or a 

Medicare-approved health care 

prepayment plan), directly or through a 

contractor, and other groups providing 

protection for their enrollees. 

Information to be disclosed shall be 

limited to Medicare entitlement data. In 

order to receive the information, they 

must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

Other insurers, TPAs, HMOs, and 

HCPPs may require MARx information 

in order to support evaluations and 

monitoring of Medicare claims 

information of beneficiaries, including 

proper reimbursement for services 

provided. 

6. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

MARx data will provide for research, 

evaluation, and epidemiological 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

7. To a Member of Congress or a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries often request the help of 

a Member of Congress in resolving some 

issue relating to a matter before CMS. 

The Member of Congress then writes 

CMS, and CMS must be able to give 

sufficient information tin response to 

the inquiry. 

8. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

9. To a CMS contractor (including, but 

not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 60533 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud and abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

10. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any State 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require MARx 

information for the purpose of 

combating fraud and abuse in such 

Federally-funded programs. 

B. Additional Circumstances 

Affecting Routine Use Disclosures. This 

system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR Parts 160 and 164, 

65 FR 82462 (12–28–00), Subparts A 

and E. The protected health information 

is collected from the Plan during the 

enrollment process and passed onto the 

Medicare Beneficiary Database. These 

elements include the Beneficiary Name, 

Sex, Date of Birth, and Health Insurance 

Claim Number. Disclosures of Protected 

Health Information authorized by these 

routine uses may only be made if, and 

as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable information, except 

pursuant to one of the routine uses or 

if required by law, if we determine there 

is a possibility that an individual can be 

identified through implicit deduction 

based on small cell sizes (instances 

where the patient population is so small 

that individuals who are familiar with 

the enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: The Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: All pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effects of the Modified System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

We will only disclose the minimum 

personal data necessary to achieve the 

purpose of MARx. Disclosure of 

information from the system will be 

approved only to the extent necessary to 

accomplish the purpose of the 

disclosure. CMS has assigned a higher 

level of security clearance for the 

information maintained in this system 

in an effort to provide added security 

and protection of data in this system. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights. 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of the disclosure of 

information relating to individuals. 

Dated: October 12, 2005. 

Lori Davis, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

SYSTEM NO. 09–70–4001. 

SYSTEM NAME: 

‘‘Medicare Advantage Prescription 

Drug (MARx)’’ System HHS/CMS/OIS. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

The system will include information 

on recipients of Medicare hospital 

insurance (Part A) and Medicare 

medical insurance (Part B) and 

recipients of the Prescription Drug 

Benefits Program (Part D) enrolled in the 

Medicare Advantage (MA) Program. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The system will also include 

information about a beneficiary’s 

entitlement to Medicare benefits and 

enrollment in Medicare Programs, 

prescription drug coverage and 

supplementary medical claims 

information. The system will contain 

identifying information such as 

beneficiary name, health insurance 

claim number, social security number, 

and other demographic information. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

Authority for maintenance of the 

system is given under Section 101 of the 

60534 Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 

Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173) amended 

the Title XVIII of the Social Security 

Act. Authority for maintenance of the 

system is also given under the 

provisions of §§ 1833(a)(1)(A), 1860, 

1866, and 1876 of Title XVIII of the Act 

(42 CFR 417 and 422). 

PURPOSE(S) OF THE SYSTEM: 

The primary purpose of the SOR is to 

maintain a master file of MA and MAPD 

plan members for accounting and 

payment control; expedite the exchange 

of data with MA and MAPD; control the 

posting of pro-rata amounts to the Part 

B deductible of currently enrolled MA 

members; and track participation of the 

prescription drug benefits provided 

under private prescription drug plans 

and Medicare employer plans. 

Information in this system will also be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed by a contractor or consultant 

contracted by the Agency; (2) support 

another Federal or State agency, agency 

of a state government, an agency 

established by state law, or its fiscal 

agent; (3) assist provider and suppliers 

of service directly or dealing through 

contractors, fiscal intermediaries (FI) or 

carriers for the administration of Title 

XVIII; (4) assist third party contacts in 

situations where the party to be 

contacted has, or is expected to have 

information relating to the individual’s 

capacity to manage his or her affairs; (5) 

assist insurance companies, third party 

administrators, employers, self-insurers, 

managed care organizations, and other 

supplemental insurers; (6) facilitate 

research on the quality and effectiveness 

of care provided, as well as paymentrelated projects; (7) support constituent 

requests made to a congressional 

representative; (8) support litigation 

involving the Agency, and (9) combat 

fraud and abuse in certain health 

benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

A. Entities Who May Receive 

Disclosures Under Routine Use. These 

routine uses specify circumstances, in 

addition to those provided by statute in 

the Privacy Act of 1974, under which 

CMS may release information from the 

MARx without the consent of the 

individual to whom such information 

pertains. Each proposed disclosure of 

information under these routine uses 

will be evaluated to ensure that the 

disclosure is legally permissible, 

including but not limited to ensuring 

that the purpose of the disclosure is 

compatible with the purpose for which 

the information was collected. We are 

proposing to establish or modify the 

following routine use disclosures of 

information maintained in the system: 

1. To Agency contractors, or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this system 

and who need to have access to the 

records in order to assist CMS. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits, 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds, and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

3. To providers and suppliers of 

services directly or through fiscal 

intermediaries or carriers for the 

administration of Title XVIII of the Act. 

4. To third party contacts in situations 

where the party to be contacted has, or 

is expected to have information relating 

to the individual’s capacity to manage 

his or her affairs or to his or her 

eligibility for, or an entitlement to, 

benefits under the Medicare program 

and, 

a. The individual is unable to provide 

the information being sought (an 

individual is considered to be unable to 

provide certain types of information 

when any of the following conditions 

exists: the individual is confined to a 

mental institution, a court of competent 

jurisdiction has appointed a guardian to 

manage the affairs of that individual, a 

court of competent jurisdiction has 

declared the individual to be mentally 

incompetent, or the individual’s 

attending physician has certified that 

the individual is not sufficiently 

mentally competent to manage his or 

her own affairs or to provide the 

information being sought, the individual 

cannot read or write, cannot afford the 

cost of obtaining the information, a 

language barrier exist, or the custodian 

of the information will not, as a matter 

of policy, provide it to the individual), 

or 

b. The data are needed to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, and it concerns one or 

more of the following: the individual’s 

entitlement to benefits under the 

Medicare program, the amount of 

reimbursement, and in cases in which 

the evidence is being reviewed as a 

result of suspected fraud and abuse, 

program integrity, quality appraisal, or 

evaluation and measurement of 

activities. 

5. To insurance companies, third 

party administrators (TPA), employers, 

self-insurers, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, group health 

plans (i.e., health maintenance 

organizations or a competitive medical 

plan with a Medicare contract, or a 

Medicare-approved health care 

prepayment plan), directly or through a 

contractor, and other groups providing 

protection for their enrollees. 

Information to be disclosed shall be 

limited to Medicare entitlement data. In 

order to receive the information, they 

must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the identified 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

6. To an individual or organization for 

a research, evaluation, or 

epidemiological project related to the 

prevention of disease or disability, the 

restoration or maintenance of health, or 

payment-related projects. 

7. To a Member of Congress or a 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

8. To the Department of Justice (DOJ), 

court or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

9. To a CMS contractor (including, but 

not limited to FIs and carriers) that 

assists in the administration of a CMSadministered health benefits program, 

Federal Register / Vol. 70, No. 200 / Tuesday, October 18, 2005 / Notices 60535 

or to a grantee of a CMS-administered 

grant program, when disclosure is 

deemed reasonably necessary by CMS to 

prevent, deter, discover, detect, 

investigate, examine, prosecute, sue 

with respect to, defend against, correct, 

remedy, or otherwise combat fraud or 

abuse in such programs. 

10. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

B. Additional Circumstances 

Affecting Routine Use Disclosures. This 

system contains Protected Health 

Information as defined by the 

Department of Health and Human 

Services (HHS) regulation ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information’’ (45 CFR Parts 160 

and 164, 65 Fed. Reg. 82462 (12–28–00), 

Subparts A and E. Disclosures of 

Protected Health Information authorized 

by these routine uses may only be made 

if, and as, permitted or required by the 

‘‘Standards for Privacy of Individually 

Identifiable Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable information, except 

pursuant to one of the routine uses or 

if required by law, if we determine there 

is a possibility that an individual can be 

identified through implicit deduction 

based on small cell sizes (instances 

where the patient population is so small 

that individuals who are familiar with 

the enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

Computer diskette and on magnetic 

storage media. 

RETRIEVABILITY: 

Information can be retrieved by name 

and health insurance claim number of 

the beneficiary. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. Office of Management and 

Budget Circular A–130, Management of 

Federal Resources, Appendix III, 

Security of Federal Automated 

Information Resources also applies. 

Federal, HHS, and CMS policies and 

standards include but are not limited to: 

all pertinent National Institute of 

Standards and Technology publications; 

the HHS Information Systems Program 

Handbook and the CMS Information 

Security Handbook. 

RETENTION AND DISPOSAL: 

Records are maintained with 

identifiers for all transactions after they 

are entered into the system for a period 

of 6 years and 3 months. Records are 

housed in both active and archival files. 

All claims-related records are 

encompassed by the document 

preservation order and will be retained 

until notification is received from the 

Department of Justice. 

SYSTEM MANAGER AND ADDRESS: 

Director, Division of Medicare 

Advantage Appeals and Payment 

Systems, Information Services 

Modernization Group, Office of 

Information Services, CMS, Room N3–

16–24, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For purpose of access, the subject 

individual should write to the systems 

manager who will require the system 

name, SSN, address, date of birth, sex, 

and for verification purposes, the 

subject individual’s name (woman’s 

maiden name, if applicable). Furnishing 

the SSN is voluntary, but it may make 

searching for a record easier and prevent 

delay. 

RECORD ACCESS PROCEDURE: 

For purpose of access, use the same 

procedures outlined in Notification 

Procedures above. Requestors should 

also reasonably specify the record 

contents being sought. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.5 

(a)(2)). 

CONTESTING RECORD PROCEDURES: 

The subject individual should contact 

the system manager named above, and 

reasonably identify the record and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

RECORD SOURCE CATEGORIES: 

Data for this system is collected from 

MAs and MAPDs (which obtained the 

data from the individuals concerned), 

Social Security Administration, and the 

Medicare Beneficiary Database system 

of records. 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–20909 Filed 10–17–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Administration for Children and 

Families 

Office of Planning, Research and 

Evaluation; Notice of Secretary’s 

Advisory Committee Meeting 

AGENCY: OPRE, ACF, HHS. 

ACTION: Notice of Meeting—Advisory 

Committee on Head Start Accountability 

and Educational Performance Measures. 

SUMMARY: The Secretary of Health and 

Human Services, by authority of 42 

U.S.C. 9836A, Section 641A(b) of the 

Head Start Act, as amended (5 U.S.C. 

Appendix 2), has formed the Advisory 

Committee on Head Start Accountability 

and Educational Performance Measures 

(the Committee). The Committee is 

governed by the provisions of Public 

Law 92–463, as amended (5 U.S.C. 

Appendix 2). 

The function of the Committee is to 

help assess the progress of HHS in 

developing and implementing