9858 Federal Register / Vol. 66, No. 29 / Monday, February 12, 2001 / Notices

Information Line (1–877–449–5659 toll

free)/(410–786–9379 local), or the

Internet (http://www.hcfa.gov/fac/

apcpage.htm) for additional information

and updates on committee activities.

SUPPLEMENTARY INFORMATION: The

Secretary is required by section

1833(t)(9)(A) of the Social Security Act,

as added by section 201(h)(1)(B) and

redesignated by section 202(a)(2) of the

Balanced Budget Refinement Act of

1999, to consult with an APC advisory

panel. The panel will meet once

annually to review the APC groups and

provide technical advice to the

Secretary and the Administrator of

HCFA concerning the clinical integrity

of the groups and their associated

weights. The technical advice provided

by the panel at its annual meeting will

be considered as HCFA prepares the

annual Notice of Proposed Rulemaking

that will propose changes to the OPPS

for the next calendar year.

The panel consists of 15

representatives of Medicare providers

that are subject to the OPPS. The

members were selected by the

Administrator of HCFA based upon

either self-nominations or nominations

submitted by providers or organizations.

The current members of the panel are:

Michelle Burke, R.N.; Leslie Jane

Collins, R.N.; Geneva Craig, R.N.; Lora

A. DeWald, M.Ed; Gretchen M. Evans,

R.N.; Robert E. Henkin, M.D.; Lee H.

Hilborne, M.D.; Stephen T. House, M.D.;

Kathleen P. Kinslow, CRNA, Ed.D; Mike

Metro, R.N.; Gerald V. Naccarelli, M.D.;

Beverly K. Philip, M.D.; Karen L.

Rutledge, B.S.; William A. Van Decker,

M.D.; and Paul E. Wallner, D.O. The

panel Chairperson is Paul M. Rudolf,

M.D., J.D., a HCFA medical officer.

The agenda will provide for

discussion and comment on the

following topics:

• Reconfiguration of APCs, such as

splitting of an APC and moving CPT

codes from one APC to another.

• Removal of specific surgical

procedures from the inpatient list.

• Specific clinical issues regarding

observation care.

• Other technical issues concerning

APC structure.

For more detailed information on the

agenda topics see our website at http:/

/www.hcfa.gov/fac/apcpage.htm. We are

soliciting comments from the public on

specific proposed items falling within

the agenda topics for this meeting of the

panel. We will consider proposed items

for this meeting only if they fall within

the agenda topics listed above. In order

to be considered as a potential agenda

topic for this meeting, comments must

be in writing. We urge commenters to

send comments as soon as possible.

Comments relating to this meeting must

be received no later than 5 p.m. on

Tuesday, February 20, 2001. Send

comments to the following address:

Health Care Financing Administration,

Department of Health and Human

Services, Attn: Paul J. Olenick, Mail

Stop C4–01–26, 7500 Security

Boulevard, Baltimore, MD 21244–1850.

Comments may also be sent via

electronic mail to

outpatientpps@hcfa.gov. Because of

staffing and resource limitations, we

cannot accept comments by facsimile

(FAX) transmission and cannot

acknowledge or respond individually to

comments we receive. Comments that

are included in the agenda topics will

be addressed in the proposed rule that

will be published in the spring of 2001.

Comments on agenda topics for future

meetings will also be accepted at the

above addresses.

The meeting is open to the public, but

attendance is limited to the space

available. Individuals or organizations

wishing to make oral presentations on

the agenda items should submit a copy

of the presentation and the name,

address and telephone number of the

proposed presenter. In order to be

scheduled to speak, this information

must be received no later than 5 p.m.,

Tuesday, February 20, 2001 at the above

address. Alternatively, the information

may be sent electronically to the email

address specified above. Because of

staffing and resource limitations, we

cannot accept this information by

facsimile (FAX).

Presentations are limited to no more

than 5 minutes and must be on the

listed agenda topics only. The number

of presentations may be limited by the

time available.

• In addition to formal presentations,

there will be an opportunity during the

meeting for public comment, limited to

one minute for each individual or

organization. The number of speakers

may be limited by the time available.

Individuals requiring sign language

interpretation for the hearing impaired

or other special accommodations should

contact Paul Olenick at (410) 786–0282

at least 10 days before the meeting.

(Section 1833 of the Social Security Act (42

U.S.C. 1395l) and section 10(a) of Pub. L. 92–

463 (5 U.S.C. App. 2, section 10(a)); 45 CFR

part 11)

(Catalog of Federal Domestic Assistance

Program No. 93.773, Medicare-Hospital

Insurance; and Program No. 93.774,

Medicare-Supplementary Medical Insurance

Program)

Dated: January 30, 2001.

Michael McMullan,

Acting Deputy Administrator, Health Care

Financing Administration.

[FR Doc. 01–3122 Filed 2–9–01; 8:45 am]

BILLING CODE 4120–01–P

DEPARTMENT OF HEALTH AND

HUMAN SERVICES

Health Care Financing Administration

Privacy Act of 1974; Report of New

System

AGENCY: Department of Health and

Human Services (HHS), Health Care

Financing Administration (HCFA).

ACTION: Notice of new system of records.

SUMMARY: In accordance with the

requirements of the Privacy Act of 1974,

we are proposing to establish a new

system of records, ‘‘Complaints Against

Health Insurance Issuers and Health

Plans (CAHII)’’ HHS/HCFA/CMSO,

System No. 09–70–9005. The CAHII will

enable HCFA to fulfill its statutory

charge to enforce four Federal Acts,

which is mandated by the Public Health

Service (PHS) Act at sections 2722 and

2761 (42 U.S.C. 300gg–22 and 300gg–

61). Specifically, Section 2722 requires

HCFA to enforce Title I of the Health

Insurance Portability and

Accountability Act of 1996 (HIPAA), the

Mental Health Parity Act of 1996

(MHPA), the Newborns’ and Mothers’

Health Protection Act of 1996

(NMHPA), and the Women’s Health and

Cancer Rights Act of 1998 (WHCRA)

with respect to non-Federal

governmental plans. Section 2722 also

requires HCFA to enforce these

provisions with respect to health

insurance issuers in the group market in

States that fail to substantially do so.

Section 2761 requires HCFA to enforce

certain HIPAA Title I requirements with

respect to health insurance issuers in

the individual market in States that

substantially fail to do so and fail to

submit an acceptable alternative

mechanism. Section 2761 also requires

HCFA to enforce NMHPA and WHCRA

with respect to health insurance issuers

in the individual market in States that

substantially fail to do so.

We have provided background

information about the proposed system

in the SUPPLEMENTARY INFORMATION

section below. Although the Privacy Act

requires only that the ‘‘routine use’’

portion of the system be published for

comment, HCFA invites comments on

all portions of this notice. See EFFECTIVE

DATES section for comment period.

Federal Register / Vol. 66, No. 29 / Monday, February 12, 2001 / Notices 9859

EFFECTIVE DATES: HCFA filed a new

system report with the Chair of the

House Committee on Government

Reform and Oversight, the Chair of the

Senate Committee on Governmental

Affairs, and the Administrator, Office of

Information and Regulatory Affairs,

Office of Management and Budget

(OMB) on February 6, 2001. To ensure

that all parties have adequate time in

which to comment, the new system of

records, including routine uses, will

become effective 40 days from the

publication of the notice, or from the

date it was submitted to OMB and the

Congress, whichever is later, unless

HCFA receives comments that require

alterations to this notice.

ADDRESSES: The public should address

comments to: Director, Division of Data

Liaison and Distribution (DDLD), HCFA,

Room N2–04–27, 7500 Security

Boulevard, Baltimore, Maryland 21244–

1850. Comments received will be

available for review at this location, by

appointment, during regular business

hours, Monday through Friday from 9

a.m.–3 p.m., Eastern Time zone.

FOR FURTHER INFORMATION CONTACT: Mr.

Dave Mlawsky, 410–786–6851, Health

Insurance Specialist, Private Health

Insurance Group, HCFA, 7500 Security

Boulevard, Mail Stop S3–16–26,

Baltimore, Maryland 21244–1850.

SUPPLEMENTARY INFORMATION:

I. Description of the New System of

Records

Statutory and Regulatory Basis for

System of Records

HCFA proposes a new system of

records to collect, retrieve and act on

information obtained when consumers

contact HCFA and inform the agency

that their health insurance issuer and/or

non-Federal governmental health plan

allegedly has violated Title I of the

Health Insurance Portability and

Accountability Act of 1996 (HIPAA), the

Mental Health Parity Act of 1996

(MHPA), the Newborns’ and Mothers’

Health Protection Act of 1996

(NMHPA), and the Women’s Health and

Cancer Rights Act of 1998 (WHCRA).

HIPAA aims to ensure the availability of

health coverage for certain people who

change or lose their jobs, and to small

businesses, by imposing a number of

requirements on health insurance

issuers and certain types of group health

plans. MHPA generally prohibits health

insurance issuers in the large group

market and certain types of health plans

from setting lower annual and lifetime

dollar coverage limits for mental health

benefits than for medical/surgical

benefits. NMHPA generally prohibits

health insurers and certain types of

health plans from covering postchildbirth maternity stays of less than

48 hours following a normal delivery

and 96 hours following a cesarean

section. WHCRA generally requires

health insurance issuers and certain

types of health plans that provide

mastectomy benefits to also provide

certain follow-up care. The portions of

these Acts that apply to non-Federal

governmental health plans and to health

insurance issuers have been codified in

the PHS Act. This system of records is

necessary for HCFA to fulfill its

statutory charge to enforce these four

Federal Acts, which is mandated by the

PHS Act at sections 2722 and 2761 (42

U.S.C. 300gg–22 and 300gg–61).

Specifically, section 2722 requires

HCFA to enforce Title I of HIPAA,

MHPA, NMHPA and WHCRA with

respect to non-Federal governmental

plans. Section 2722 also requires HCFA

to enforce these provisions with respect

to health insurance issuers in the group

market in States that fail to substantially

do so. Section 2761 requires HCFA to

enforce certain HIPAA requirements

with respect to health insurance issuers

in the individual market in States that

substantially fail to do so and fail to

submit an acceptable alternative

mechanism. Section 2761 also requires

HCFA to enforce NMHPA and WHCRA

with respect to health insurance issuers

in the individual market in States that

substantially fail to do so.

II. Collection and Maintenance of Data

in the System

Scope of the Data Collected

The collected information will

include a consumer’s name, address,

phone number, the name and address of

their health plan or health insurance

issuer, their plan ID number or social

security number, the nature of their

complaint/inquiry against their health

plan or issuer, and any medical and

other additional information that is

necessary for HCFA to help resolve the

consumer’s complaint.

Agency Policies, Procedures, and

Restrictions on the Routine Use

The Privacy Act permits us to disclose

information without an individual’s

consent if the information is to be used

for a purpose, which is compatible with

the purpose(s) for which the

information was collected. Any such

disclosure of data is known as a

‘‘routine use.’’ The government will

only release information contained in

this system of records as provided for

under Section III ‘‘Proposed Routine

Use Disclosures of Data in the System’’.

We will only disclose the minimum

personal data necessary to achieve the

purpose of the system of records. HCFA

has the following policies and

procedures concerning disclosures of

information, which will be maintained

in the system. Disclosure of information

from the system of records will be

approved only for the minimum

information necessary to accomplish the

purpose of the disclosure after HCFA:

(a) Determines that the use or

disclosure is consistent with the reason

that the data is being collected; i.e.,

assisting consumers to resolve their

complaints and/or inquiries regarding

their rights under Title I of HIPAA,

MHPA, NMHPA and/or WHCRA,

(b) Determines:

(1) That the purpose for which the

disclosure is to be made can only be

accomplished if the record is provided

in individually identifiable form;

(2) That the purpose for which the

disclosure is to be made is of sufficient

importance to warrant the effect and/or

risk on the privacy of the individual that

additional exposure of the record might

bring; and

(3) That there is a strong probability

that the proposed use of the data would

in fact accomplish the stated purpose(s).

(c) Determines that the data are valid

and reliable.

III. Proposed Routine Use Disclosures

of Data in the System

The routine use disclosures in this

system may occur only to the following

categories of entities (i.e., the entities,

which can get identifiable data only if

we apply the policies and procedures in

Section II. B. above). Disclosures may be

made:

1. To agency contractors, or

consultants who have been engaged by

the agency to assist in accomplishment

of an HCFA function relating to the

purposes for this system of records and

who need to have access to the records

in order to assist the HCFA.

We contemplate disclosing

information under this routine use only

in situations in which HCFA may enter

a contractual or similar agreement with

a third party to assist in accomplishing

HCFA functions relating to purposes for

this system of records. HCFA

occasionally contracts out certain of its

functions when this would contribute to

effective and efficient operations. HCFA

must be able to give a contractor

whatever information is necessary for

the contractor to fulfill its duties. In

these situations, safeguards are provided

in the contract prohibiting the

contractor from using or disclosing the

information for any purpose other than

that described in the contract and to

9860 Federal Register / Vol. 66, No. 29 / Monday, February 12, 2001 / Notices

return or destroy all information at the

completion of the contract.

2. To a Member of Congress or to a

congressional staff member in response

to an inquiry of the Congressional Office

made at the written request of the

constituent about whom the record is

maintained.

Beneficiaries sometimes request the

help of a member of Congress in

resolving some issue relating to a matter

before HCFA. The member of Congress

then writes HCFA, and HCFA must be

able to give sufficient information to be

responsive to the inquiry.

3. To the Department of Justice (DOJ),

court or adjudicatory body when:

(a) The agency or any component

thereof; or

(b) Any employee of the agency in his

or her official capacity; or

(c) Any employee of the agency in his

or her individual capacity where the

DOJ has agreed to represent the

employee; or

(d) The United States Government;

Is a party to litigation or has an interest

in such litigation, and by careful review,

HCFA determines that the records are

both relevant and necessary to the

litigation.

Whenever HCFA is involved in

litigation, or occasionally when another

party is involved in litigation and

HCFA’s policies or operations could be

affected by the outcome of the litigation,

HCFA would be able to disclose

information to the DOJ, court or

adjudicatory body involved. A

determination would be made in each

instance that, under the circumstances

involved, the purposes served by the

use of the information in the particular

litigation is compatible with a purpose

for which HCFA collects the

information.

4. To a health insurance issuer and/

or health plan, who has been named in

a complaint and is believed to be

potentially in violation of relevant

portions of the PHS Act.

When individuals file complaints or

inquiries asking HCFA to clarify or

enforce their rights under Title I of

HIPAA, MHPA, NMHPA and/or

WHCRA, HCFA often must disclose

information maintained in this system

of records to the individual’s health

insurance issuer or health plan in order

for HCFA to satisfy its statutory charge

to enforce these Federal Acts with

respect to non-Federal governmental

health plans in all States and health

insurance issuers in some States.

5. To another Federal or State agency:

(a) To refer a complaint or inquiry

with respect to Title I of HIPAA, MHPA,

NMHPA and WHCRA or

(b) To enable such agency to

administer a Federal health benefits

program, or as necessary to enable such

agency to fulfill a requirement of a

Federal statute or regulation that

implements a health benefits program

funded in whole or in part with Federal

funds.

HCFA shares enforcement

responsibilities with the U.S.

Department of Labor, the U.S.

Department of Treasury and State

regulatory bodies with respect to Title I

of HIPAA, MHPA, NMHPA and

WHCRA. HCFA’s enforcement

responsibilities are discussed in the

‘‘Description of the New System of

Records’’ section above. The

Department of Labor enforces Title I of

HIPAA, MHPA, NMHPA and WHCRA

with respect to private group health

plans. The Department of Treasury may

levy excise taxes against private group

health plans that do not comply with

these Acts, except for WHCRA. In States

that are substantially enforcing Title I of

HIPAA, MHPA, NMHPA and WHCRA,

the appropriate State agency enforces

these provisions with respect to health

insurance issuers. Occasionally, HCFA

will receive an inquiry or complaint

related to one of these four Acts in

situations where it is within Labor’s or

Treasury’s or a State’s, and not HCFA’s,

jurisdiction to resolve. In such cases,

HCFA must disclose information from

the system of records to the appropriate

agency so they can perform their

enforcement function.

6. To third party contacts when the

party to be contacted has, or is expected

to have, information relating to the

individual’s complaint against a health

insurance issuer and/or health plan,

when:

(a) The individual is unable to

provide the information being sought.

An individual is considered unable to

provide certain types of information

when:

(1) He or she is incapable or of

questionable mental capability;

(2) He or she cannot read or write;

(3) He or she has a hearing

impairment; and is contacting HCFA by

telephone through a

telecommunications relay system

operator;

(4) He or she cannot afford the cost of

obtaining the information;

(5) A language barrier exists; or

(6) The custodian of the information

will not; as a matter of policy, provide

it to the individual; or

(b) The data are needed to establish

the validity of evidence or to verify the

accuracy of information presented by

the individual concerning his or her

complaint against a health insurance

issuer and/or health plan; or HCFA is

reviewing the information as a result of

suspected violation of the PHS Act.

Although most of the information that

will be maintained in this system will

already be in HCFA’s files, HCFA will

occasionally need to obtain additional

information from other sources. When

an individual has difficulty

communicating with HCFA or obtaining

needed information because of a

physical handicap, a language barrier, or

other reason, HCFA helps the individual

as needed. There can also be other

situations in which HCFA requests

information from a source other than the

subject individual. To request needed

information from such other sources,

HCFA must disclose minimal

information about the individual to

them, for example, information

identifying the individual and the fact

that the subject individual is making a

complaint against an health insurance

or health plan.

IV. Safeguards

A. Authorized users: Personnel having

access to the system have been trained

in Privacy Act requirements. Records

are used in a designated work area and

system location is attended at all times

during working hours.

• To ensure security of the data, the

proper level of class user is assigned for

each individual user level. This

prevents unauthorized users from

accessing and modifying critical data.

B. Physical Safeguards: All server

sites have implemented the following

minimum requirements to assist in

reducing the exposure of computer

equipment and thus achieve an

optimum level of protection and

security for the CAHII system:

Access to all servers is controlled,

with access limited to only those

support personnel with a demonstrated

need for access. Servers are to be kept

in a locked room accessible only by

specified management and system

support personnel. Each server requires

a specific log-on process. All entrance

doors are identified and marked. A log

is kept of all personnel who were issued

a security card, key and/or combination,

which grants access to the room housing

the server, and all visitors are escorted

while in this room. All servers are

housed in an area where appropriate

environmental security controls are

implemented, which include measures

implemented to mitigate damage to

Automated Information Systems (AIS)

resources caused by fire, electricity,

water and inadequate climate controls.

Protection applied to the

workstations, servers and databases

include:

Federal Register / Vol. 66, No. 29 / Monday, February 12, 2001 / Notices 9861

• User Log-on—Authentication is

performed by the Primary Domain

Controller/Backup Domain Controller of

the log-on domain.

• Workstation Names—Workstation

naming conventions may be defined and

implemented at the agency level.

• Hours of Operation—May be

restricted by Windows NT. When

activated all applicable processes will

automatically shut down at a specific

time and not be permitted to resume

until the predetermined time. The

appropriate hours of operation are

determined and implemented at the

agency level.

• Inactivity Lockout—Access to the

NT workstation is automatically locked

after a specified period of inactivity.

• Warnings—Legal notices and

security warnings display on all servers

and workstations.

• Remote Access Security—Windows

NT Remote Access Service (RAS)

security handles resource access

control. Access to NT resources is

controlled for remote users in the same

manner as local users, by utilizing

Windows NT file and sharing

permissions. Dial-in access can be

granted or restricted on a user-by-user

basis through the Windows NT RAS

administration tool.

There are several levels of security

found in the CAHII system. Windows

NT provides much of the overall system

security. The Windows NT security

model is designed to meet the C2-level

criteria as defined by the U.S.

Department of Defense’s Trusted

Computer System Evaluation Criteria

document (DoD 5200.28–STD,

December 1985). Netscape Enterprise

Server is the security mechanism for all

CAHII transmission connections to the

system. As a result, Netscape controls

all CAHII information access requests.

Anti-virus software is applied at both

the workstation and NT server levels.

Access to different areas on the

Windows NT server are maintained

through the use of file, directory and

share level permissions. These different

levels of access control provide security

that is managed at the user and group

level within the NT domain. The file

and directory level access controls rely

on the presence of an NT File System

(NTFS) hard drive partition. This

provides the most robust security and is

tied directly to the file system. Windows

NT security is applied at both the

workstation and NT server levels.

C. Procedural Safeguards: All

automated systems must comply with

Federal laws, guidance, and policies for

information systems security. These

include, but are not limited to: the

Privacy Act of 1974; the Computer

Security Act of 1987; OMB Circular A–

130, revised; Information Resource

Management (IRM) Circular #10; HHS

Automated Information Systems

Security Program; the HCFA

Information Systems Security Policy

and Program Handbook; and other

HCFA systems security policies. Each

automated information system should

ensure a level of security commensurate

with the level of sensitivity of the data,

risk, and magnitude of the harm that

may result from the loss, misuse,

disclosure, or modification of the

information contained in the system.

V. Effect of the Proposed System of

Records on Individual Rights

HCFA proposes to establish this

system in accordance with the

principles and requirements of the

Privacy Act and will collect, use, and

disseminate information only as

prescribed therein. Data in this system

will be subject to the authorized releases

in accordance with the routine uses

identified in this system of records.

HCFA will monitor the collection and

reporting of data. HCFA will collect

only that information necessary to

perform the system’s functions. In

addition, HCFA will make disclosure

from the proposed system only with

consent of the subject individual or his/

her legal representative, in accordance

with an applicable exception provision

of the Privacy Act, or in accordance

with the routine uses enumerated in

Section III.

HCFA, therefore, does not anticipate

an unfavorable effect on individual

privacy as a result of maintaining this

system of records.

Dated: February 6, 2001.

Michael McMullan,

Acting Deputy Administrator, Health Care

Financing Administration.

No. 09–70–9005

SYSTEM NAME:

Complaints Against Health Insurance

Issuers and Health Plans (CAHII), HHS/

HCFA/CMSO.

SECURITY CLASSIFICATION:

Level 3, Privacy Act Sensitive Data.

SYSTEM LOCATION:

7500 Security Boulevard, South

Building, Third Floor, Baltimore,

Maryland 21244–1850. Portions of the

system of records will be maintained at

various HCFA regional offices.

CATEGORIES OF INDIVIDUALS COVERED BY THE

SYSTEM:

Consumers who contact HCFA with

complaints that their health insurance

issuer or health plan is violating Title I

of the Health Insurance Portability and

Accountability Act of 1996 (HIPAA), the

Mental Health Parity Act of 1996

(MHPA), the Newborns’ and Mothers’

Health Protection Act of 1996

(NMHPA), and the Women’s Health and

Cancer Rights Act of 1998 (WHCRA); as

well as consumers who contact HCFA

with inquiries about the consumer

protections offered by one or more of

these Acts.

CATEGORIES OF RECORDS IN THE SYSTEM:

This system will contain the

consumer’s name, social security

number or health plan ID number,

address, phone number, the name and

address of their health insurance issuer

or health plan, the nature of their

complaint or inquiry, and any relevant

medical or other information necessary

to resolve their complaint against their

health insurance issuer or health plan.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 2722 of the PHS Act (42

U.S.C. 300gg–22) and section 2761 (42

U.S.C. section 300gg–61).

PURPOSE(S):

The primary purpose of the system of

records is to enable HCFA to collect,

retrieve and act on information obtained

when consumers contact HCFA and

inform the agency that their health

insurance issuer and/or health plan has

violated Title I of HIPAA, MHPA,

NMHPA, or WHCRA. Consumers will

direct these complaints to HCFA’s

central office, and to HCFA’s regional

offices. Relevant information about each

complaint is documented on paper at

each HCFA location that receives

complaints. The system of records will

be maintained at several locations.

HCFA will use information retrieved

from this system of records to enforce

these four Acts by assisting individuals

in securing their rights under them.

HCFA also will use information

retrieved from this system of records to

identify any patterns of violations that

will help HCFA determine whether

targeted outreach and education efforts

are needed.

ROUTINE USES OF RECORDS MAINTAINED IN THE

SYSTEM, INCLUDING CATEGORIES OF USERS AND

THE PURPOSES OF SUCH USES:

The Privacy Act permits us to disclose

information without an individual’s

consent if the information is to be used

for a purpose that is compatible with the

purpose(s) for which the information

was collected. Any such compatible use

of data is known as a ‘‘routine use.’’ The

proposed routine uses in this system

meet the compatibility requirement of

the Privacy Act. We are proposing to

establish the following routine use

9862 Federal Register / Vol. 66, No. 29 / Monday, February 12, 2001 / Notices

disclosures of information, which will

be maintained in the system. These

routine uses are discussed in detail in

the attached Preamble.

1. To agency contractors, or

consultants who have been engaged by

the agency to assist in accomplishment

of an HCFA function relating to the

purposes for this system of records and

who need to have access to the records

in order to assist the HCFA.

2. To a Member of Congress or to a

congressional staff member in response

to an inquiry of the Congressional Office

made at the written request of the

constituent about whom the record is

maintained.

3. To the Department of Justice (DOJ),

court or adjudicatory body when:

(a) The agency or any component

thereof; or

(b) Any employee of the agency in his

or her official capacity; or

(c) Any employee of the agency in his

or her individual capacity where the

DOJ has agreed to represent the

employee; or

(d) the United States Government;

Is a party to litigation or has an

interest in such litigation, and by careful

review, HCFA determines that the

records are both relevant and necessary

to the litigation.

4. To a health insurance issuer and/

or health plan, that has been named in

a complaint and is believed to be in

violation of relevant portions of the PHS

Act.

5. To another Federal or State agency:

(a) To refer a complaint or inquiry

with respect to Title I of HIPAA, MHPA,

NMHPA or WHCRA or

(b) To enable such agency to

administer a Federal health benefits

program, or as necessary to enable such

agency to fulfill a requirement of a

Federal statute or regulation that

implements a health benefits program

funded in whole or in part with Federal

funds.

6. To third party contacts when the

party to be contacted has, or is expected

to have, information relating to the

individual’s complaint against a health

insurance issuer and/or health plan,

when:

(a) The individual is unable to

provide the information being sought.

An individual is considered unable to

provide certain types of information

when:

(1) He or she is incapable or of

questionable mental capability;

(2) He or she cannot read or write;

(3) He or she has a hearing

impairment, and is contacting HCFA by

telephone through a

telecommunications relay system

operator;

(4) He or she cannot afford the cost of

obtaining the information;

(5) A language barrier exists; or

(6) The custodian of the information

will not, as a matter of policy, provide

it to the individual; or

(b) The data are needed to establish

the validity of evidence or to verify the

accuracy of information presented by

the individual concerning his or her

complaint against a health insurance

issuer and/or health plan; or HCFA is

reviewing the information as a result of

suspected violation of the PHS Act.

POLICIES AND PRACTICES FOR STORING,

RETRIEVING, ACCESSING, RETAINING, AND

DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Information is maintained on paper.

RETRIEVABILITY:

The records are retrieved by name and

social security number.

SAFEGUARDS:

HCFA has safeguards for authorized

users and monitors such users to ensure

against excessive or unauthorized use.

Personnel having access to the system

have been trained in the Privacy Act

and systems security requirements.

In addition, HCFA has physical

safeguards in place to reduce the

exposure of computer equipment and

thus achieve an optimum level of

protection and security for the CAHII

system. Safeguards have been

established in accordance with HHS

standards and National Institute of

Standards and Technology guidelines;

e.g., limiting access to authorized

personnel. System securities are

established in accordance with HHS,

Information Resource Management

(IRM) Circular #10, Automated

Information Systems Security Program;

HCFA Automated Information Systems

(AIS) Guide, Systems Securities

Policies; and OMB Circular No. A–130

(revised) Appendix III.

RETENTION AND DISPOSAL:

HCFA will retain CAHII data for a

total period of seven (7) years after

resolution of the inquiry/complaint.

SYSTEM MANAGERS AND ADDRESS:

Director, Private Health Insurance

Group, HCFA, 7500 Security Boulevard,

Baltimore, Maryland 21244–1850.

NOTIFICATION PROCEDURE:

For purpose of access, the subject

individual should write to the system

manager who will require the system

name, the subject individual’s name,

social security number (SSN)

(furnishing the SSN is voluntary, but it

may make searching for a record easier

and prevent delay), address, date of

birth, and sex.

RECORD ACCESS PROCEDURE:

For purpose of access, use the same

procedures outlined in Notification

Procedures above. Requestors should

also reasonably specify the record

contents being sought. (These

procedures are in accordance with

Department regulation 45 CFR

5b.5(a)(2).)

CONTESTING RECORD PROCEDURES:

The subject individual should contact

the system manager named above, and

reasonably identify the record and

specify the information to be contested.

State the corrective action sought and

the reasons for the correction with

supporting justification. (These

procedures are in accordance with

Department regulation 45 CFR 5b.7.)

RECORD SOURCE CATEGORIES:

Sources of information contained in

this records system include data

collected from the individuals

themselves, and information collected

from their health insurance issuer or

health plan.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS

OF THE ACT:

None.

[FR Doc. 01–3511 Filed 2–9–01; 8:45 am]

BILLING CODE 4120–03–P

DEPARTMENT OF HEALTH AND

HUMAN SERVICES

Health Resources And Services

Administration

Agency Information Collection

Activities: Proposed Collection:

Comment Request

In compliance with the requirement

for opportunity for public comment on

proposed data collection projects

(section 3506(c)(2)(A) of Title 44, United

States Code, as amended by the

Paperwork Reduction Act of 1995,

Public Law 104–13), the Health

Resources and Services Administration

(HRSA) publishes periodic summaries

of proposed projects being developed

for submission to OMB under the

Paperwork Reduction Act of 1995. To

request more information on the

proposed project or to obtain a copy of

the data collection plans and draft

instruments, call the HRSA Reports

Clearance Officer on (301) 443–1129.

Comments are invited on: (a) Whether

the proposed collection of information