Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 69569 

ESTIMATE OF ANNUALIZED BURDEN HOURS

Respondents Number of 

respondents 

Number of responses per 

respondent 

Average 

burden per 

response 

(in hours) 

Students ....................................................................................................................................... 24,500 1 45/60 

State and School Education Officials .......................................................................................... 537 1 30/60 

Dated: November 8, 2005. 

Betsey Dunaway, 

Acting Reports Clearance Officer, Centers for 

Disease Control and Prevention. 

[FR Doc. 05–22714 Filed 11–15–05; 8:45 am] 

BILLING CODE 4163–18–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

Privacy Act of 1974; Report of a New 

System of Records 

AGENCY: Centers for Medicare & 

Medicaid Services (CMS), HHS. 

ACTION: Notice of a new system of 

records (SOR). 

SUMMARY: In accordance with the 

requirements of the Privacy Act of 1974, 

we propose to create a new system of 

records titled, ‘‘Medicare True Out-ofPocket (TrOOP) Expenditures System,’’

HHS/CMS/OIS, System No. 09–70–

0557. The TrOOP facilitation process is 

mandated by the Medicare Prescription 

Drug Benefit Program enacted into law 

December 8, 2003 under provisions of 

Section 101 of Title 1 of the Medicare 

Prescription Drug, Improvement, and 

Modernization Act of 2003 (MMA) (Pub. 

L. 108–173). MMA amends Title XVIII, 

Section 1860D of the Social Security Act 

(the Act). Section 1860D–2 of the Act 

requires the tracking of beneficiaries’

TrOOP expenditures. TrOOP costs are 

treated as ‘‘incurred’’ only if they were 

paid by the individual (or by another 

person, such as a family member, on 

behalf of the individual), paid on behalf 

of a low-income subsidy-eligible 

individual under the § 1860D–14 

provisions, or paid under a State 

Pharmaceutical Assistance Program 

(SPAP) as defined in § 1860D–23. 

Section 1860D–2(b)(4)(D)(i) of the MMA 

authorizes CMS to establish procedures 

for determining whether costs for Part D 

enrollees are being reimbursed by 

excluded payers and alerting Part D 

plans about the existence of such 

payers. 

The purpose of this system is to 

collect and maintain a master file to 

establish a ‘‘TrOOP’’ facilitation 

process, maintain information on 

individuals and entities that make 

payments on covered drugs under the 

Medicare Part D Program, and 

coordinate TrOOP relevant data from 

State Pharmaceutical Programs (SPAPs) 

and other health insurers. Information 

retrieved from this system may be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the agency or by a 

contractor, grantee, consultant or other 

legal agent; (2) support Medicare 

Prescription Drug Plans (PDP) and 

Medicare Advantage Prescription Drug 

Plans (MAPD) directly or through a 

CMS contractor for the administration of 

Title XVIII of the Act; (3) assist another 

Federal or state agency with information 

to enable such agency to administer a 

Federal health benefits program, or to 

enable such agency to fulfill a 

requirement of Federal statute or 

regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; (4) assist 

Quality Improvement Organization 

(QIO) in connection with review of 

claims; (5) assist insurance companies 

and other groups providing protection 

against medical expenses of their 

enrollees; (6) assist an individual or 

organization engaged in the 

performance activities of the 

demonstration or in a research project or 

in support of an evaluation project 

related to the prevention of disease or 

disability, the restoration or 

maintenance of health, or payment 

related projects; (7) support constituent 

requests made to a congressional 

representative; (8) support litigation 

involving the agency; and (9) combat 

fraud and abuse in certain health 

benefits programs. We have provided 

background information about the new 

system in the SUPPLEMENTARY

INFORMATION section below. Although 

the Privacy Act requires only that CMS 

provide an opportunity for interested 

persons to comment on the proposed 

routine uses, CMS invites comments on 

all portions of this notice. See EFFECTIVE

DATE section for comment period. 

EFFECTIVE DATE: CMS filed a new SOR 

report with the Chair of the House 

Committee on Government Reform and 

Oversight, the Chair of the Senate 

Committee on Governmental Affairs, 

and the Administrator, Office of 

Information and Regulatory Affairs, 

Office of Management and Budget 

(OMB) on 11/07/2005. In any event, we 

will not disclose any information under 

a routine use until 40 days after 

publication. We may defer 

implementation of this system or one or 

more of the routine use statements listed 

below if we receive comments that 

persuade us to defer implementation. 

ADDRESSES: The public should address 

comment to the CMS Privacy Officer, 

Room N2–04–27, 7500 Security 

Boulevard, Baltimore, Maryland 21244–

1850. Comments received will be 

available for review at this location by 

appointment during regular business 

hours, Monday through Friday from 9 

a.m.–3 p.m., eastern time. 

FOR FURTHER INFORMATION CONTACT: 

Henry Chao, Manager, Immediate Office 

of the Director, Office of Information 

Services, CMS, Room N3–19–23, 7500 

Security Boulevard, Baltimore, 

Maryland 21244–1849, telephone 

number (410) 786–7811, e-mail 

Henry.Chao@cms.hhs.gov. 

SUPPLEMENTARY INFORMATION: In order to 

calculate TrOOP, Medicare Part D plans 

will have to determine if other entities 

have made payments on covered drugs, 

and whether such payments fall under 

the legal definition of incurred costs. If 

the payments by alternate payers, such 

as retiree prescription drug coverage, do 

not count toward the TrOOP threshold, 

then Part D plans must reduce the outof-pocket amounts accumulated in their 

claims processing systems. 

Alternatively, if the payments by 

alternate payers, such as SPAPs, do 

count toward the TrOOP threshold, then 

the Part D plan will maintain the level 

of beneficiary out-of-pocket spending in 

their systems. 

All Part D Plans will have to correctly 

calculate the TrOOP amount in order to 

properly adjudicate beneficiary claims, 

as well as to communicate to 

beneficiaries where they are in their 

benefits. Beneficiaries will expect that 

pharmacies will have all the 

information they need to determine 

their eligibility and to bill the 

appropriate payers and that plans will 

69570 Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 

have accurate real-time TrOOP 

calculations on demand. 

The process, along with coordination 

of benefits (COB) is logistically complex 

because there may be multiple payers 

(e.g., SPAPs or employer or union 

retiree plans, etc.). True COB, in which 

the order of payment among multiple 

payers with responsibility for paying 

prescription drug claims on behalf of an 

individual is established and 

programmed into the systems of the 

alternate payers, does not take place in 

pharmacy benefit management today. In 

the absence of significant change, this 

would mean that Part D plans would 

have to separately set up procedures to 

coordinate benefits with every other 

payer with responsibility for drug 

coverage for one of their Part D 

enrollees. 

Importantly, this process will enable 

Part D Plans to track and calculate a 

beneficiary’s TrOOP expenditures in as 

near to real time as possible, so that 

when a beneficiary calls, they can 

retrieve accurate TrOOP information. In 

addition, the TrOOP level will be 

available on-line to correctly process the 

beneficiary’s next claim. This will mean 

that beneficiaries will know when they 

have reached certain coverage limits or 

when they can expect even greater 

financial relief in the case of 

catastrophic coverage, and will have 

their claims processed correctly without 

the need for bringing in receipts or 

submitting other documentation from 

other coverage. 

I. Description of the Proposed System of 

Records 

A. Statutory and Regulatory Basis for 

SOR 

The statutory authority for this system 

is given under Part D of Title XVIII of 

the Social Security Act, as amended by 

the Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003. 

B. Collection and Maintenance of Data 

in the System 

This system will maintain 

individually identifiable information on 

individuals and entities that make 

payments on covered drugs under the 

Medicare Part D Program. The collected 

information will contain name, address, 

health insurance claim number (HICN), 

gender type, and date of birth. 

II. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

A. Agency Policies, Procedures, and 

Restrictions on the Routine Use 

The Privacy Act permits us to disclose 

information without an individual’s 

consent if the information is to be used 

for a purpose that is compatible with the 

purpose(s) for which the information 

was collected. Any such disclosure of 

data is known as a ‘‘routine use.’’ The 

Government will only release TrOOP 

information that can be associated with 

an individual as provided for under 

‘‘Section III. Proposed Routine Use 

Disclosures of Data in the System.’’ Both 

identifiable and non-identifiable data 

may be disclosed under a routine use. 

We will only collect the minimum 

personal data necessary to achieve the 

purpose of TrOOP. 

CMS has the following policies and 

procedures concerning disclosures of 

information that will be maintained in 

the system. Disclosure of information 

from the system will be approved only 

to the extent necessary to accomplish 

the purpose of the disclosure and only 

after CMS: 

1. Determines that the use or 

disclosure is consistent with the reason 

that the data is being collected; e.g., to 

collect and maintain a master file to 

establish a ‘‘TrOOP’’ facilitation 

process, maintain information on 

individuals and entities that make 

payments on covered drugs under the 

Medicare Part D Program, and 

coordinate TrOOP relevant data from 

SPAPs and other health insurers. 

2. Determines that: 

a. The purpose for which the 

disclosure is to be made can only be 

accomplished if the record is provided 

in individually identifiable form; 

b. The purpose for which the 

disclosure is to be made is of sufficient 

importance to warrant the effect and/or 

risk on the privacy of the individual that 

additional exposure of the record might 

bring; and 

c. There is a strong probability that 

the proposed use of the data would in 

fact accomplish the stated purpose(s). 

3. Requires the information recipient 

to: 

a. Establish administrative, technical, 

and physical safeguards to prevent 

unauthorized use of disclosure of the 

record; 

b. Remove or destroy, at the earliest 

time, all patient-identifiable 

information; and 

c. Agree to not use or disclose the 

information for any purpose other than 

the stated purpose under which the 

information was disclosed. 

4. Determines that the data are valid 

and reliable. 

III. Proposed Routine Use Disclosures 

of Data in the System 

A. Entities Who May Receive 

Disclosures Under Routine Use 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the TrOOP facilitator 

without the consent of the individual to 

whom such information pertains. Each 

proposed disclosure of information 

under these routine uses will be 

evaluated to ensure that the disclosure 

is legally permissible, including but not 

limited to ensuring that the purpose of 

the disclosure is compatible with the 

purpose for which the information was 

collected. We propose to establish or 

modify the following routine use 

disclosures of information maintained 

in the system: 

1. To Agency contractors or 

consultants who have been contracted 

by the Agency to assist in 

accomplishment of a CMS function 

relating to the purposes for this SOR 

and who need to have access to the 

records in order to assist CMS. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contractual or similar agreement 

with a third party to assist in 

accomplishing a CMS function relating 

to purposes for this SOR. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or consultant 

whatever information is necessary for 

the contractor or consultant to fulfill its 

duties. In these situations, safeguards 

are provided in the contract prohibiting 

the contractor or consultant from using 

or disclosing the information for any 

purpose other than that described in the 

contract and requires the contractor or 

consultant to return or destroy all 

information at the completion of the 

contract. 

2. To Medicare Prescription Drug 

Plans (PDP) and Medicare Advantage 

Prescription Drug Plans (MAPD) 

directly or through a CMS contractor for 

the administration of Title XVIII of the 

Act. 

PDPs and MAPDs require TrOOP 

information in order to establish the 

validity of evidence or to verify the 

accuracy of information presented by 

the individual, as it concerns the 

individual’s entitlement to Part D 

benefits under the Medicare 

Prescription Drug Benefit Program. 

3. To another Federal or state agency, 

agency of a state government, an agency 

Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 69571 

established by state law, or its fiscal 

agent pursuant to agreements with CMS 

to: 

a. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits; 

b. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; and/or 

c. Assist Federal/state Medicaid 

programs within the state. 

Other Federal or state agencies in 

their administration of a Federal health 

program may require TrOOP 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

The Internal Revenue Service may 

require TrOOP data for the application 

of tax penalties against employers and 

employee organizations that contribute 

to Employer Group Health Plan or Large 

Group Health Plans that are not in 

compliance with 42 U.S.C. 1395y(b). 

In addition, state agencies in their 

administration of a Federal health 

program may require TrOOP 

information for the purposes of 

determining, evaluating and/or 

assessing cost, effectiveness, and/or the 

quality of health care services provided 

in the state. 

Disclosure under this routine use 

shall be used by state Medicaid agencies 

pursuant to agreements with the HHS 

for determining Medicaid and Medicare 

eligibility, for quality control studies, 

for determining eligibility of recipients 

of assistance under Titles IV, XVIII, and 

XIX of the Act, and for the 

administration of the Medicaid program. 

Data will be released to the state only on 

those individuals who are patients 

under the services of a Medicaid 

program within the state or who are 

residents of that state. 

We also contemplate disclosing 

information under this routine use in 

situations in which state auditing 

agencies require TrOOP information for 

auditing state Medicaid eligibility 

considerations. CMS may enter into an 

agreement with state auditing agencies 

to assist in accomplishing functions 

relating to purposes for this SOR. 

4. To Quality Improvement 

Organization (QIO) in connection with 

review of claims, or in connection with 

studies or other review activities 

conducted pursuant to Part D of Title 

XVIII of the Act and in performing 

affirmative outreach activities to 

individuals for the purpose of 

establishing and maintaining their 

entitlement to Medicare Prescription 

Drug Program benefits or other drug 

plan benefits. 

QIOs will work to implement quality 

improvement programs, provide 

consultation to CMS, its contractors, 

and to state agencies. QIOs will assist 

the state agencies in related monitoring 

and enforcement efforts, assist CMS and 

intermediaries in program integrity 

assessment, and prepare summary 

information for release to CMS. 

5. To insurance companies, 

underwriters, third party administrators 

(TPA), employers, self-insurers, group 

health plans, health maintenance 

organizations (HMO), health and 

welfare benefit funds, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, other groups 

providing protection against medical 

expenses of their enrollees without the 

beneficiary’s authorization, and any 

entity having knowledge of the 

occurrence of any event affecting: (a) An 

individual’s right to any such benefit or 

payment, or (b) the initial right to any 

such benefit or payment, for the purpose 

of coordination of benefits with the 

Medicare program and implementation 

of the Medicare Secondary Payer (MSP) 

provision at 42 U.S.C. 1395y(b). 

Information to be disclosed shall be 

limited to Medicare utilization data 

necessary to perform that specific 

function. In order to receive the 

information, they must agree to: 

a. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

b. Utilize the information solely for 

the purpose of processing the 

individual’s insurance claims; and 

c. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

Other insurers may require TrOOP 

information in order to support 

evaluations and monitoring of Medicare 

claims information of beneficiaries, 

including proper reimbursement for 

services provided. 

6. To an individual or organization for 

research, evaluation, or epidemiological 

projects related to the prevention of 

disease or disability, and the restoration 

or maintenance of health, or payment 

related projects. 

TrOOP data will provide for research, 

evaluations and epidemiological 

projects, a broader, longitudinal, 

national perspective of the status of 

Medicare beneficiaries. CMS anticipates 

that many researchers will have 

legitimate requests to use these data in 

projects that could ultimately improve 

the care provided to Medicare 

beneficiaries and the policy that governs 

the care. 

7. To a Member of Congress or 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

Beneficiaries often request the help of 

a Member of Congress in resolving an 

issue relating to a matter before CMS. 

The Member of Congress then writes 

CMS, and CMS must be able to give 

sufficient information to be responsive 

to the inquiry. 

8. To the Department of Justice (DOJ), 

court, or adjudicatory body when: 

a. The Agency or any component 

thereof, or 

b. Any employee of the Agency in his 

or her official capacity, or 

c. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

d. The United States Government, is 

a party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

Whenever CMS is involved in 

litigation, or occasionally when another 

party is involved in litigation and CMS’s 

policies or operations could be affected 

by the outcome of the litigation, CMS 

would be able to disclose information to 

the DOJ, court, or adjudicatory body 

involved. 

9. To a CMS contractor (including, but 

not limited to fiscal intermediaries and 

carriers) that assists in the 

administration of a CMS-administered 

health benefits program, or to a grantee 

of a CMS-administered grant program, 

when disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such program. 

We contemplate disclosing 

information under this routine use only 

in situations in which CMS may enter 

into a contract or grant with a third 

party to assist in accomplishing CMS 

functions relating to the purpose of 

combating fraud and abuse. 

CMS occasionally contracts out 

certain of its functions when doing so 

would contribute to effective and 

efficient operations. CMS must be able 

to give a contractor or grantee whatever 

information is necessary for the 

contractor or grantee to fulfill its duties. 

69572 Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 

In these situations, safeguards are 

provided in the contract prohibiting the 

contractor or grantee from using or 

disclosing the information for any 

purpose other than that described in the 

contract and requiring the contractor or 

grantee to return or destroy all 

information. 

10. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

Other agencies may require TrOOP 

information for the purpose of 

combating fraud and abuse in such 

Federally-funded programs. 

B. Additional Circumstances Affecting 

Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR parts 160 and 164, 

subparts A and E, 65 FR 82462 (12–28–

00). Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

IV. Safeguards 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: The Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

V. Effect of the Proposed System on 

Individual Rights 

CMS proposes to establish this system 

in accordance with the principles and 

requirements of the Privacy Act and will 

collect, use, and disseminate 

information only as prescribed therein. 

We will only disclose the minimum 

personal data necessary to achieve the 

purpose of TrOOP. Disclosure of 

information from the system will be 

approved only to the extent necessary to 

accomplish the purpose of the 

disclosure. CMS has assigned a higher 

level of security clearance for the 

information maintained in this system 

in an effort to provide added security 

and protection of data in this system. 

CMS will take precautionary 

measures to minimize the risks of 

unauthorized access to the records and 

the potential harm to individual privacy 

or other personal or property rights. 

CMS will collect only that information 

necessary to perform the system’s 

functions. In addition, CMS will make 

disclosure from the proposed system 

only with consent of the subject 

individual, or his/her legal 

representative, or in accordance with an 

applicable exception provision of the 

Privacy Act. 

CMS, therefore, does not anticipate an 

unfavorable effect on individual privacy 

as a result of the disclosure of 

information relating to individuals. 

Dated: October 27, 2005. 

Charlene Frizzera, 

Acting Chief Operating Officer, Centers for 

Medicare & Medicaid Services. 

SYSTEM NO. 09–70–0557 

SYSTEM NAME: 

‘‘True Out-of-Pocket (TrOOP) 

Expenditures System,’’ HHS/CMS/OIS. 

SECURITY CLASSIFICATION: 

Level Three Privacy Act Sensitive 

Data. 

SYSTEM LOCATION: 

CMS Data Center, 7500 Security 

Boulevard, North Building, First Floor, 

Baltimore, Maryland 21244–1850 and at 

various co-locations of CMS contractors. 

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM: 

This system will maintain 

individually identifiable information on 

individuals and entities that make 

payments on covered drugs under the 

Medicare Part D Program. 

CATEGORIES OF RECORDS IN THE SYSTEM: 

The collected information will 

contain name, address, telephone 

number, health insurance claim number 

(HICN), gender type, and date of birth. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 

The statutory authority for this system 

is given under Part D of Title XVIII of 

the Social Security Act, as amended by 

the Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003. 

PURPOSE(S) OF THE SYSTEM: 

The purpose of this system is to 

collect and maintain a master file to 

establish a ‘‘TrOOP’’ facilitation 

process, maintain information on 

individuals and entities that make 

payments on covered drugs under the 

Medicare Part D Program, and 

coordinate TrOOP relevant data from 

State Pharmaceutical Programs (SPAPs) 

and other health insurers. Information 

retrieved from this system may be 

disclosed to: (1) Support regulatory, 

reimbursement, and policy functions 

performed within the agency or by a 

contractor, grantee, consultant or other 

legal agent; (2) support Medicare 

Prescription Drug Plans (PDP) and 

Medicare Advantage Prescription Drug 

Plans (MAPD) directly or through a 

CMS contractor for the administration of 

Title XVIII of the Act; (3) assist another 

Federal or state agency with information 

to enable such agency to administer a 

Federal health benefits program, or to 

enable such agency to fulfill a 

requirement of Federal statute or 

regulation that implements a health 

Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 69573 

benefits program funded in whole or in 

part with Federal funds; (4) assist 

Quality Improvement Organization 

(QIO) in connection with review of 

claims; (5) assist insurance companies 

and other groups providing protection 

against medical expenses of their 

enrollees; (6) assist an individual or 

organization engaged in the 

performance activities of the 

demonstration or in a research project or 

in support of an evaluation project 

related to the prevention of disease or 

disability, the restoration or 

maintenance of health, or payment 

related projects; (7) support constituent 

requests made to a congressional 

representative; (8) support litigation 

involving the agency; and (9) combat 

fraud and abuse in certain health 

benefits programs. 

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OR USERS AND

THE PURPOSES OF SUCH USES: 

C. Entities Who May Receive 

Disclosures Under Routine Use 

These routine uses specify 

circumstances, in addition to those 

provided by statute in the Privacy Act 

of 1974, under which CMS may release 

information from the TrOOP facilitator 

without the consent of the individual to 

whom such information pertains. Each 

proposed disclosure of information 

under these routine uses will be 

evaluated to ensure that the disclosure 

is legally permissible, including but not 

limited to ensuring that the purpose of 

the disclosure is compatible with the 

purpose for which the information was 

collected. We propose to establish or 

modify the following routine use 

disclosures of information maintained 

in the system: 

To Agency contractors or consultants 

who have been contracted by the 

Agency to assist in accomplishment of 

a CMS function relating to the purposes 

for this SOR and who need to have 

access to the records in order to assist 

CMS. 

1. To Medicare Prescription Drug 

Plans (PDP) and Medicare Advantage 

Prescription Drug Plans (MAPD) 

directly or through the Enterprise 

Business Services, a CMS intermediary 

for the administration of Title XVIII of 

the Act. 

2. To another Federal or state agency, 

agency of a state government, an agency 

established by state law, or its fiscal 

agent pursuant to agreements with CMS 

to: 

d. Contribute to the accuracy of CMS’s 

proper payment of Medicare benefits; 

e. Enable such agency to administer a 

Federal health benefits program, or as 

necessary to enable such agency to 

fulfill a requirement of a Federal statute 

or regulation that implements a health 

benefits program funded in whole or in 

part with Federal funds; and/or 

f. Assist Federal/state Medicaid 

programs within the state. 

3. To Quality Improvement 

Organization (QIO) in connection with 

review of claims, or in connection with 

studies or other review activities 

conducted pursuant to Part D of Title 

XVIII of the Act and in performing 

affirmative outreach activities to 

individuals for the purpose of 

establishing and maintaining their 

entitlement to Medicare Prescription 

Drug Program benefits or other drug 

plan benefits. 

4. To insurance companies, 

underwriters, third party administrators 

(TPA), employers, self-insurers, group 

health plans, health maintenance 

organizations (HMO), health and 

welfare benefit funds, managed care 

organizations, other supplemental 

insurers, non-coordinating insurers, 

multiple employer trusts, other groups 

providing protection against medical 

expenses of their enrollees without the 

beneficiary’s authorization, and any 

entity having knowledge of the 

occurrence of any event affecting: (a) An 

individual’s right to any such benefit or 

payment, or (b) the initial right to any 

such benefit or payment, for the purpose 

of coordination of benefits with the 

Medicare program and implementation 

of the Medicare Secondary Payer (MSP) 

provision at 42 U.S.C. 1395y (b). 

Information to be disclosed shall be 

limited to Medicare utilization data 

necessary to perform that specific 

function. In order to receive the 

information, they must agree to: 

b. Certify that the individual about 

whom the information is being provided 

is one of its insured or employees, or is 

insured and/or employed by another 

entity for whom they serve as a TPA; 

c. Utilize the information solely for 

the purpose of processing the 

individual’s insurance claims; and 

d. Safeguard the confidentiality of the 

data and prevent unauthorized access. 

5. To an individual or organization for 

research, evaluation, or epidemiological 

projects related to the prevention of 

disease or disability, and the restoration 

or maintenance of health, or payment 

related projects. 

6. To a Member of Congress or 

congressional staff member in response 

to an inquiry of the congressional office 

made at the written request of the 

constituent about whom the record is 

maintained. 

7. To the Department of Justice (DOJ), 

court, or adjudicatory body when: 

d. The Agency or any component 

thereof, or 

e. Any employee of the Agency in his 

or her official capacity, or 

f. Any employee of the Agency in his 

or her individual capacity where the 

DOJ has agreed to represent the 

employee, or 

g. The United States Government, is a 

party to litigation or has an interest in 

such litigation, and, by careful review, 

CMS determines that the records are 

both relevant and necessary to the 

litigation and that the use of such 

records by the DOJ, court or 

adjudicatory body is compatible with 

the purpose for which the agency 

collected the records. 

8. To a CMS contractor (including, but 

not limited to fiscal intermediaries and 

carriers) that assists in the 

administration of a CMS-administered 

health benefits program, or to a grantee 

of a CMS-administered grant program, 

when disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such program. 

9. To another Federal agency or to an 

instrumentality of any governmental 

jurisdiction within or under the control 

of the United States (including any state 

or local governmental agency), that 

administers, or that has the authority to 

investigate potential fraud or abuse in, 

a health benefits program funded in 

whole or in part by Federal funds, when 

disclosure is deemed reasonably 

necessary by CMS to prevent, deter, 

discover, detect, investigate, examine, 

prosecute, sue with respect to, defend 

against, correct, remedy, or otherwise 

combat fraud or abuse in such programs. 

D. Additional Circumstances 

Affecting Routine Use Disclosures 

This system contains Protected Health 

Information as defined by HHS 

regulation ‘‘Standards for Privacy of 

Individually Identifiable Health 

Information’’ (45 CFR parts 160 and 164, 

subparts A and E, 65 FR 82462 (12–28–

00). Disclosures of Protected Health 

Information authorized by these routine 

uses may only be made if, and as, 

permitted or required by the ‘‘Standards 

for Privacy of Individually Identifiable 

Health Information.’’

In addition, our policy will be to 

prohibit release even of data not directly 

identifiable, except pursuant to one of 

the routine uses or if required by law, 

if we determine there is a possibility 

that an individual can be identified 

through implicit deduction based on 

small cell sizes (instances where the 

patient population is so small that 

individuals who are familiar with the 

69574 Federal Register / Vol. 70, No. 220 / Wednesday, November 16, 2005 / Notices 

enrollees could, because of the small 

size, use this information to deduce the 

identity of the beneficiary). 

POLICIES AND PRACTICES FOR STORING, 

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM: 

STORAGE: 

All records are stored electronically. 

Some input may be generated in 

hardcopy, such as eligibility, 

enrollment, or other health insurance 

information before transcription to 

electronic media. 

RETRIEVABILITY: 

The collected data are retrieved by an 

individual identifier; e.g., beneficiary 

name or HIC number. 

SAFEGUARDS: 

CMS has safeguards in place for 

authorized users and monitors such 

users to ensure against excessive or 

unauthorized use. Personnel having 

access to the system have been trained 

in the Privacy Act and information 

security requirements. Employees who 

maintain records in this system are 

instructed not to release data until the 

intended recipient agrees to implement 

appropriate management, operational 

and technical safeguards sufficient to 

protect the confidentiality, integrity and 

availability of the information and 

information systems and to prevent 

unauthorized access. 

This system will conform to all 

applicable Federal laws and regulations 

and Federal, HHS, and CMS policies 

and standards as they relate to 

information security and data privacy. 

These laws and regulations include but 

are not limited to: the Privacy Act of 

1974; the Federal Information Security 

Management Act of 2002; the Computer 

Fraud and Abuse Act of 1986; the 

Health Insurance Portability and 

Accountability Act of 1996; the EGovernment Act of 2002, the ClingerCohen Act of 1996; the Medicare 

Modernization Act of 2003, and the 

corresponding implementing 

regulations. OMB Circular A–130, 

Management of Federal Resources, 

Appendix III, Security of Federal 

Automated Information Resources also 

applies. Federal, HHS, and CMS 

policies and standards include but are 

not limited to: all pertinent National 

Institute of Standards and Technology 

publications; the HHS Information 

Systems Program Handbook and the 

CMS Information Security Handbook. 

RETENTION AND DISPOSAL: 

CMS will retain information for a total 

period not to exceed 25 years. Data 

residing with the TrOOP facilitation 

contractor site agent shall be returned to 

CMS at the end of the contract period, 

with all data then being the 

responsibility of CMS for adequate 

storage and security. 

SYSTEM MANAGER AND ADDRESS: 

Henry Chao, Manager, Immediate 

Office of the Director, Office of 

Information Services, CMS, Room N3–

19–23, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

NOTIFICATION PROCEDURE: 

For the purpose of access, the subject 

individual should write to the system 

manager who will require the system 

name, address, age, gender type, and, for 

verification purposes, the subject 

individual’s name (woman’s maiden 

name, if applicable). 

RECORD ACCESS PROCEDURE: 

For the purpose of access, use the 

same procedures outlined in 

Notification Procedures above. 

Requestors should also reasonably 

specify the record contents being 

sought. (These procedures are in 

accordance with Department regulation 

45 CFR, parts 160, 162, and 164.) 

CONTESTING RECORDS PROCEDURES: 

The subject individual should contact 

the system manager named above and 

reasonably identify the records and 

specify the information to be contested. 

State the corrective action sought and 

the reasons for the correction with 

supporting justification. (These 

procedures are in accordance with 

Department regulation 45 CFR 5b.7). 

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT: 

None. 

[FR Doc. 05–22657 Filed 11–15–05; 8:45 am] 

BILLING CODE 4120–03–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

[Docket No. 2005N–0425] 

Agency Information Collection 

Activities; Proposed Collection; 

Comment Request; General 

Administrative Procedures: Citizen 

Petitions; Petition for Reconsideration 

or Stay of Action; Advisory Opinions 

AGENCY: Food and Drug Administration, 

HHS. 

ACTION: Notice. 

SUMMARY: The Food and Drug 

Administration (FDA) is announcing an 

opportunity for public comment on the 

proposed collection of certain 

information by the agency. Under the 

Paperwork Reduction Act of 1995 (the 

PRA), Federal agencies are required to 

publish notice in the Federal Register 

concerning each proposed collection of 

information, including each proposed 

extension of an existing collection of 

information, and to allow 60 days for 

public comment in response to the 

notice. This notice solicits comments on 

the reporting requirements contained in 

existing FDA regulations regarding the 

general administrative procedures for a 

person to take the following actions: 

Petition the Commissioner of Food and 

Drugs (the Commissioner) to issue, 

amend, or revoke a rule; file a petition 

for an administrative reconsideration or 

an administrative stay of action; and 

request an advisory opinion from the 

Commissioner. 

DATES: Submit written or electronic 

comments on the collection of 

information by January 17, 2006. 

ADDRESSES: Submit electronic 

comments on the collection of 

information to: http://www.fda.gov/ 

dockets/ecomments. Submit written 

comments on the collection of 

information to the Division of Dockets 

Management (HFA–305), Food and Drug 

Administration, 5630 Fishers Lane, rm. 

1061, Rockville, MD 20852. All 

comments should be identified with the 

docket number found in brackets in the 

heading of this document. 

FOR FURTHER INFORMATION CONTACT: 

Jonna Capezzuto, Office of Management 

Programs (HFA–250), Food and Drug 

Administration, 5600 Fishers Lane, 

Rockville, MD 20857, 301–827–4659. 

SUPPLEMENTARY INFORMATION: Under the 

PRA (44 U.S.C. 3501–3520), Federal 

agencies must obtain approval from the 

Office of Management and Budget 

(OMB) for each collection of 

information they conduct or sponsor. 

‘‘Collection of information’’ is defined 

in 44 U.S.C. 3502(3) and 5 CFR 

1320.3(c) and includes agency requests 

or requirements that members of the 

public submit reports, keep records, or 

provide information to a third party. 

Section 3506(c)(2)(A) of the PRA (44 

U.S.C. 3506(c)(2)(A)) requires Federal 

agencies to provide a 60-day notice in 

the Federal Register concerning each 

proposed collection of information, 

including each proposed extension of an 

existing collection of information, 

before submitting the collection to OMB 

for approval. To comply with this 

requirement, FDA is publishing notice 

of the proposed collection of 

information set forth in this document. 

With respect to the following 

collection of information, FDA invites