Source: https://www.federalregister.gov/documents/2006/11/15/E6-19212/privacy-act-of-1974-report-of-modified-or-altered-system
Timestamp: 2018-07-15 21:18:33
Document Index: 71318093

Matched Legal Cases: ['§\u20091842', '§\u20091833', '§\u20091124', '§\u20091124', '§\u20091842', '§\u20091833', '§\u20091842']

A Notice by the Centers for Medicare & Medicaid Services on 11/15/2006
71 FR 66535
66535-66541 (7 pages)
E6-19212
Description of the Modified System of Records
https://www.federalregister.gov/d/E6-19212 https://www.federalregister.gov/d/E6-19212
Start Preamble Start Printed Page 66535
In accordance with the requirements of the Privacy Act of 1974, we are proposing to modify an existing system of records titled, “Unique Physician/Practitioner Identification Number (UPIN),” System No. 09-70-0525, most recently modified at 69 FR 75316 (December 16, 2004). We propose to delete published routine use number 1 that permits the release of the identification of each physician or non-physician practitioner who has been assigned a UPIN and who is participating in the Medicare program. Selected UPIN information to carry out this requirement is available as a public use file, and as such, should not be treated as a routine use disclosure. We will broaden the “Purpose” section of this notice to include this requirement as one of the primary purposes of this system.
We propose to modify existing routine use number 2 that permits disclosure to agency contractors and consultants to include disclosure to CMS grantees who perform a task for the agency. CMS grantees, charges with completing projects or activities that require CMS data to carry out that activity, are classified separate from CMS contractors and/or consultants. The modified routine use will be renumbered as routine use number 1. We will delete routine use number 6 authorizing disclosure to support constituent requests made to a congressional representative. If an authorization for the disclosure has been obtained from the data subject, then no routine use is needed. The Privacy Act allows for disclosures with the “prior written consent” of the data subject.
We will broaden the scope of routine uses number 8 and 9, authorizing disclosures to combat fraud and abuse in the Medicare and Medicaid programs to include combating “waste” which refers to specific beneficiary/recipient practices that result in unnecessary cost to all Federally-funded health benefit programs. We also propose to add a routine use for the release of information to assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment-related projects. The added routine use will be numbered as routine use number 3.
The primary purpose of the SOR is to: (1) Collect and maintain an unique identification of each physician, non-physician practitioner, or medical group practice requesting or receiving Medicare payment, and (2) provide beneficiaries and other interested entities with the identification of each physician or non-physician practitioner assigned an UPIN and who are participating in the Medicare program. Information retrieved from this SOR will be used to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant, or CMS grantee; (2) assist another Federal and/or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (4) assist Quality Improvement Organizations; (5) provide the American Medical Association with information needed for them to assist us in identifying physicians; (6) support litigation involving the Agency; and (7) combat fraud, waste, and abuse in certain health benefits programs. We have provided background information about the modified system in the “Supplementary Information” section below. Although the Privacy Act requires only that CMS provide an opportunity for interested persons to comment on the proposed routine uses, CMS invites comments on all portions of this notice. See Effective Dates section for comment period.
Effective Dates: CMS filed a modified or altered system report with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security & Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on November 7, 2006. To ensure that all parties have adequate time in which to comment, the modified system, including routine uses, will become effective 30 days from the publication of the notice, or 40 days from the date it was submitted to OMB and Congress, whichever is later, unless CMS receives comments that require alterations to this notice.
Kimberly Brandt, Director, Program Integrity Group, Office of Financial Management, CMS, 7500 Security Boulevard, C3-02-17, Baltimore, Maryland 21244-1850. The telephone number is (410) 786-5704.
In 1988, CMS modified an SOR under the authority of §§ 1842 (r)—(42 U.S.C. 1395u) of Public Law 101-508; 1861(s)(1)—(42 U.S.C. 1395x); §§ 1833 (q)(1)—(42 U.S.C. 1395l); 1842(b)(18)—(42 U.S.C. 1395u); (1842 (h)(4) & (5)—(42 U.S.C. 1395u); and 4164 of Omnibus Budget Reconciliation Act of 1990 (OBRA). Section 1871 (a)(1)—(42 U.S.C. 1395hh) provides that the Secretary shall prescribe such regulations as may be necessary to carry out the administration of the insurance program under Title XVIII. Section 1833 (d)—(42 U.S.C. 1395l), prohibits making payment under Part B for services which are payable under Part A. It contains records of all physicians, non-physician practitioners and medical group practice as defined by section 1861(r)—(42 U.S.C. 1395x), 1877(h) (4)—(42 U.S.C. 1395) of Title XVIII of the Act, who provide services for which payment is made under Medicare. By Start Printed Page 66536uniquely identifying all Part B health professional and practitioners and groups, CMS believes we will eliminate the possibility of double payment.
Medicare carriers currently identify physicians, non-physician practitioners and groups using their own systems of assigned numbers. These individualized systems allow for Physician Identification Numbers (PIN) ranging from 4 to 16 alphabetic and or numeric characters. Some carriers assign separate PIN to the same physician providing medical services in more than one locality, office or practice and lack the capability to cross reference the PIN and related physician data (e.g., group affiliation).
Other carriers maintain a single PIN or cross-referenced PIN for each physician practicing within the carrier's geographic area of responsibility. The assignment of a unique identification number will help eliminate the possibility of double billing where physicians, non-physician practitioners, and groups can furnish medical services in, as well as bill for these services from several locations or States which are in different carrier jurisdictions. In addition, independent physicians who have been found to be ineligible for Medicare payments in one area, location or State are prevented from receiving inappropriate or illegal payment in one or more other areas, locations or States.
In order to rectify the problems inherent in these individualized identification systems, CMS proposed to expand the Registry under Congressional mandate (Section 9202 of the Consolidated Omnibus Reconciliation Act of 1985, Pub. L. 99272) that created uniform record system under UPIN. The proposed changes to this national system or Registry of Unique Physician/Practitioner Identification Number will enable CMS to more readily identify all physicians, non-physician practitioners, and group practices deemed ineligible for Medicare payments and maintain more comprehensive data on physician credentials.
The records contain a UPIN for each physician, non-physician practitioner, and medical group practices defined by §§ 1124(A)—(42 U.S.C. 1320A-3), 1861(r), 1842(b)(18)(ii)(iii)(iv)(v)(r), and 1877(h)(4) of the Act who request or receive Medicare reimbursement for medical services. The system contains a UPIN, tax identification, and social security number for each physician, non-physician practitioner and medical group. Also, the system contains information concerning a provider's birth, residence, medical education, and eligibility information necessary for Medicare reimbursement.
A. The Privacy Act permits us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such disclosure of data is known as a “routine use.” The government will only release UPIN information that can be associated with each physician, non-physician practitioner and medical group practices as provided for under “Section III. Proposed Routine Use Disclosures of Data in the System.” Both identifiable and non-identifiable data may be disclosed under a routine use. Identifiable data includes individual records with UPIN information and identifiers. Non-identifiable data includes individual records with UPIN information and masked identifiers or UPIN information with identifiers stripped out of the file.
1. Determines that the use or disclosure is consistent with the reason that the data is being collected; e.g., maintain unique identification of each physician, non-physician practitioner, or medical group practice requesting or receiving Medicare payment.
1. To support Agency contractors, consultants, or grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
CMS occasionally contracts out certain of its functions when doing so would contribute to effective and efficient operations. CMS must be able to give a contractor, consultant, or grantee whatever information is necessary for the contractor or consultant to fulfill its duties. In these situations, safeguards are provided in the contract prohibiting the contractor, consultant, or grantee from using or disclosing the information for any purpose other than that described in the contract and requires the contractor, consultant, or grantee to return or destroy all information at the completion of the contract.
2. To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent pursuant to agreements with CMS to: Start Printed Page 66537
c. Assist Federal/State Medicaid programs within may require UPIN information for purposes related to this system.
The RRB requires UPIN information to enable them to assist in the implementation and maintenance of the Medicare program.
Disclosure under this routine use shall be used by State Medicaid agencies pursuant to agreements with HHS for administration of State supplementation payments for determinations of eligibility for Medicaid, for enrollment of welfare recipients for medical insurance under section 1843 of the Act, for quality control studies, for determining eligibility of recipients of assistance under Titles IV and XIX of the Act, and for the complete administration of the Medicaid program. UPIN data will be released to the State only on those individuals who are patients under the services of a Medicaid program within the State or who are residents of that State.
We also contemplate disclosing information under this routine use in situations in which State auditing agencies require UPIN information for auditing of Medicare eligibility considerations. Disclosure of physicians' customary charge data are made to State audit agencies in order to ascertain the corrections of Title XIX charges and payments. CMS may enter into an agreement with State auditing agencies to assist in accomplishing functions relating to purposes for this SOR.
3. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
The collected data will provide the research, evaluation and epidemiological projects a broader, longitudinal, national perspective of the data. CMS anticipates that many researchers will have legitimate requests to use these data in projects that could ultimately improve the care provided to Medicare patients and the policy that governs the care. CMS understands the concerns about the privacy and confidentiality of the release of data for a research use. Disclosure of data for research and evaluation purposes may involve aggregate data rather than individual-specific data.
4. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
5. To support the American Medical Association (AMA), for the purpose of assisting CMS to identify medical doctors when CMS is unable to establish an identity, provided the AMA agrees to:
6. To assist the Department of Justice (DOJ), court or adjudicatory body when:
7. To assist a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
CMS occasionally contracts out certain of its functions when doing so would contribute to effective and efficient operations. CMS must be able to give a contractor or grantee whatever information is necessary for the contractor or grantee to fulfill its duties. In these situations, safeguards are provided in the contract prohibiting the contractor or grantee from using or disclosing the information for any purpose other than that described in the contract and requiring the contractor or grantee to return or destroy all information. Start Printed Page 66538
8. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
Other agencies may require UPIN information for the purpose of combating fraud, waste or abuse in such federally funded programs.
“Unique Physician/Practitioner Identification Number” (UPIN), HHS/CMS/OFM.
All physicians, non-practitioners and medical groups practices, defined by §§ 1124(A), 1861(r), 1842(b)(I)(ii)(iii)(iv)(v)(r), and 1877(h)(4) of the Social Security Act who request or receive Medicare reimbursement for medical services.
The system contains an UPIN, tax identification, and social security number (SSN) for each physician, non-physician practitioner and medical group. Also, the system contains information concerning a provider's birth, residence, medical education, and eligibility information for Medicare reimbursement.
Authority for the collection and maintenance of this system is given under the provisions of §§ 1842(r)-(42 U.S.C. 1395u) of Pub. L. 101-508; 1861(s)(1)-(42 U.S.C. 1395x); §§ 1833(q)(1)-(42 U.S.C. 1395l); 1842(b)(18)-(42 U.S.C. 1395u); § 1842(h)(4) & (5)-(42 U.S.C. 1395u); and 4164 of Omnibus Budget Reconciliation Act of 1990 (OBRA).
The primary purpose of the SOR is to: (1) Collect and maintain an unique identification of each physician, non-physician practitioner, or medical group practice requesting or receiving Medicare payment, and (2) provide beneficiaries and other interested entities with the identification of each physician or non-physician practitioner assigned an UPIN and who are participating in the Medicare program. Information retrieved from this SOR will be used to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant, or CMS grantee; (2) assist another Federal and/or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (4) assist Quality Improvement Organizations; (5) provide the American Medical Association with Start Printed Page 66539information needed for them to assist us in identifying physicians; (6) support litigation involving the Agency; and (7) combat fraud, waste, and abuse in certain health benefits programs.
2. To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent pursuant to agreements with CMS to:
This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply Start Printed Page 66540but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
CMS and the repository of the National Archive and Records Administration will retain identifiable UPIN assessment data for a total period not to exceed fifteen (15) years.
Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare & Medicaid Services and the Social Security Administration to perform specific tasks in the Medicare program (see section three below for addresses for intermediaries, section four addresses the carriers, and section five addresses the Payment Safeguard Contractors.
Denver Region—Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St.—Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
Medicare Coordinator, Assoc. Hospital Serv. Maine (ME BC), 2 Gannett Drive South, Portland, ME 04106-6911.
Medicare Coordinator, Mississippi B/C MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MS 39225-3035.
Medicare Coordinator, Trailblazer, P.O. Box 660156, Dallas, TX 75266-0156. Start Printed Page 66541
Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463.
United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
Medicare Coordinator, Cahaba GBA, Jackson, Miss, P.O. Box 22545, Jackson, MS 39225-2545.
Medicare Coordinator, Arkansas—New Mexico, 601 Gaines Street, Little Rock, AR 72203.
Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group One, Sansome Street, San Francisco, CA 94104-4448.
[FR Doc. E6-19212 Filed 11-14-06; 8:45 am]