80 FR 49237 - Privacy Act of 1974: Report of New System of Records

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services

Federal Register Volume 80, Issue 158 (August 17, 2015)

Page Range		49237-49240
FR Document		2015-20224

In accordance with the requirements of the Privacy Act of 1974, we are proposing to establish a new SOR titled, ``CMS Risk Adjustment Suite of Systems (RASS),'' System No. 09-70-0508. Payments to Medicare Advantage (MA) organizations, Part D sponsors, and Program of All Inclusive Care for the Elderly (PACE) organizations (collectively referred to as ``MA organizations and other entities'') are adjusted based on the health status of enrolled Medicare beneficiaries (``enrollees''). RASS is established to receive, process, and store the data used to risk-adjust payments based on enrollee health status. The data will be used specifically to develop risk adjustment models and to calculate the risk score for each enrollee. Each MA organization and other entity must submit data to CMS in accordance with CMS regulations and instructions. ``Risk adjustment data'' refers to data submitted in two separate formats: comprehensive data equivalent to Medicare fee-for-service data (often referred to as encounter data); and data in abbreviated formats (often referred to as RAPS data). The MA risk adjustment data addressed by this SOR includes RAPS data submitted by a MA organization in an abbreviated format, as referenced at Sec. 422.310(d)(1), and similar abbreviated risk adjustment data submitted by other MA organizations and other entities. Encounter data has a separate SOR (System No. 09-70-0506).

Federal Register, Volume 80 Issue 158 (Monday, August 17, 2015)

[Federal Register Volume 80, Number 158 (Monday, August 17, 2015)]
[Notices]
[Pages 49237-49240]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2015-20224]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974: Report of New System of Records

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS)

ACTION: Notice of New System of Records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to establish a new SOR titled, ``CMS Risk 
Adjustment Suite of Systems (RASS),'' System No. 09-70-0508. Payments 
to Medicare Advantage (MA) organizations, Part D sponsors, and Program 
of All Inclusive Care for the Elderly (PACE) organizations 
(collectively referred to as ``MA organizations and other entities'') 
are adjusted based on the health status of enrolled Medicare 
beneficiaries (``enrollees''). RASS is established to receive, process, 
and store the data used

[[Page 49238]]

to risk-adjust payments based on enrollee health status. The data will 
be used specifically to develop risk adjustment models and to calculate 
the risk score for each enrollee.
    Each MA organization and other entity must submit data to CMS in 
accordance with CMS regulations and instructions. ``Risk adjustment 
data'' refers to data submitted in two separate formats: comprehensive 
data equivalent to Medicare fee-for-service data (often referred to as 
encounter data); and data in abbreviated formats (often referred to as 
RAPS data). The MA risk adjustment data addressed by this SOR includes 
RAPS data submitted by a MA organization in an abbreviated format, as 
referenced at Sec.  422.310(d)(1), and similar abbreviated risk 
adjustment data submitted by other MA organizations and other entities. 
Encounter data has a separate SOR (System No. 09-70-0506).

DATES: Effective 30 days after publication. Written comments should be 
submitted on or before the effective date. HHS/CMS/CM may publish an 
amended system of records notice (SORN) in light of any comments 
received.

ADDRESSES: The public should address comments to: CMS Privacy Officer, 
Division of Security, Privacy Policy & Governance, Information Security 
& Privacy Group, Office of Enterprise Information, CMS, 7500 Security 
Boulevard, Baltimore, MD 21244-1870, Mailstop: N1-24-08, Office: (410) 
786-5357, email: [email protected]. Comments received will be 
available for review at this location, by appointment, during regular 
business hours, Monday through Friday from 9 a.m.-3 p.m., Eastern Time 
zone.

FOR FURTHER INFORMATION CONTACT: Risk Adjustment Mailbox Coordinator, 
Division of Encounter Data and Risk Adjustment Operations, Medicare 
Plan Payment Group, Center for Medicare, CMS, Mail Stop C1-13-07, 7500 
Security Boulevard, Baltimore, Maryland 21244-1850. The email is 
[email protected].

SUPPLEMENTARY INFORMATION: 

I. Background on the Risk Adjustment Suite of Systems (RASS)

    The new RASS system of records is being established to cover data 
used to create risk adjustment scores needed to risk-adjust payments to 
Medicare and Medicaid provider entities, based on beneficiary 
demographics and health status. Risk-adjusted payments will implement 
reformatory provisions of the Social Security Act at sections 1853(a), 
1860D-15(c), and 1894(d)(2) (42 U.S.C. 1395w-23, 1395w-115, and 
1395eee), intended to collect and accurately calculate scores based on 
a beneficiary's demographics and health status. RASS will cover data 
housed in two existing information systems: The Risk Adjustment 
Processing System (RAPS), and the Risk Adjustment System (RAS). RAS 
will contain data extracted from RAPS and from two other IT systems 
(CME and NMUD), as more fully explained below:
    [cir] RAPS will receive abbreviated current risk adjustment data, 
consisting of diagnosis data about each beneficiary and the 
beneficiary's health care provider type, submitted by the relevant 
payee entity through the Front-End Risk Adjustment System (FERAS); RAPS 
will use the data to create an enrollee diagnosis data file for each 
beneficiary (See Categories of Records for data elements).
    [cir] RAS will extract the enrollee diagnosis data files from RAPS 
and will receive current demographic, enrollment and diagnoses data and 
past medical history data for each enrollee from two other CMS systems 
(CME and NMUD); RAS will use the RAPS, CME, and NMUD data to calculate 
risk factors and create a Risk Adjustment Factor (RAF) file, containing 
the risk score of each beneficiary:
    [ssquf] Common Medicare Environment (CME): RAS will extract current 
individual demographic and enrollment data about each enrollee (See 
Categories of Records for data elements).
    [ssquf] National Claims History files housed in the National 
Medicare Utilization Database (NMUD): RAS will extract current Medicare 
Fee-for-service (FFS) diagnoses information submitted on Inpatient, 
Outpatient, and Physician claims for each enrollee (See Categories of 
Records for data elements).
    [cir] RAS will transmit the Risk Adjustment Factor (RAF) file 
created in RAS to CMS' payment processing system for purposes of 
calculating and adjusting payments to payee entities, as follows:
    [ssquf] CMS pays MA organizations on a monthly prospective amount 
for each beneficiary enrolled (enrollee) in a Part C plan.
    [ssquf] CMS pays Part D sponsors a monthly prospective amount that 
reflects the plan sponsor's estimate of the revenue needed to cover a 
plan's costs for the risk portion of basic prescription drug coverage. 
The direct subsidy is adjusted based on the beneficiary's risk score, 
which reflects expected prescription drug expenditures for the coverage 
year (relative to a national average of 1.0), based on demographic and 
health status information for that person.
    [ssquf] CMS pays PACE organizations a monthly capitation amount 
based on the Part A and Part B payment rates established for purposes 
of payment to Medicare Advantage organizations pursuant to 1894(d)(2). 
CMS will ensure that payments take into account the comparative frailty 
of PACE enrollees relative to the general Medicare population.
    In addition to providing the file used to calculate risk adjustment 
payments, the RASS also provides reports for CMS based on the analysis 
of RAF files and other criteria; these reports include MA plan file 
submission transactions (acceptance rates, rejection rates, error 
rates, etc.) on a daily, weekly, monthly, and quarterly basis.

II. The Privacy Act

    The Privacy Act governs the collection, maintenance, use, and 
dissemination of certain information about individuals by agencies of 
the Federal Government.
    A ``SOR'' is a group of any records under the control of a Federal 
agency from which information about individuals is retrieved by name or 
other personal identifier. The Privacy Act requires each agency to 
publish in the Federal Register notice of the existence and character 
of each SOR that the agency maintains. The System of Records Notice 
(SORN) identifies or describes the laws authorizing the system to be 
maintained; the types and sources of records in the system; the 
categories of individuals to whom the records pertain; the purposes for 
which the records are used within the agency; the routine uses for 
which a record maybe disclosed to parties outside the agency without 
the individual's prior, written consent; agency policies and procedures 
for safeguarding, storing, retrieving, accessing, retaining, and 
disposing of the records; the procedures for an individual to follow to 
make notification, access, and amendment requests to the System 
Manager; and whether the SOR is exempt from certain Privacy Act 
requirements.
System Number:
    09-70-0508

System Name:
    CMS Risk Adjustment Suite of Systems (RASS), HHS/CMS/CM.

Security Classification:
    Unclassified.

System Location:
    RASS (RAS/RAPS) Location: CMS Data Center, 7500 Security Boulevard, 
North Building, First Floor, Baltimore, Maryland 21244-1850.

[[Page 49239]]

Categories of Individuals Covered by the System:
    Information collected and maintained in this system pertains to: 
(1) Medicare beneficiaries enrolled in a Part C MA plan, MA-PD plan, 
PDP or PACE organization (``enrollees'') and (2) the health care 
provider(s), supplier(s), physician(s), or other practitioner(s) 
(``Providers'') who provide health care items and services to these 
enrollees.

Categories of Records in the System:
    The MA plans, MA-PDs, PDPs and PACE organizations (``MA 
organizations and other entities'') receive the data from the providers 
which is then submitted to RAPS via FERAS. The data received from the 
MA organizations and other entities are primarily diagnosis data 
extracted from claims information. Additional FFS and utilization data 
regarding those submissions are received from the CME and NCH data 
systems to complete the enrollee data requirements.
    Records will consist of the risk score for each enrollee and the 
data used to calculate the score, contained in Risk Adjustment Factor 
(RAF) files created in CMS' Risk Adjustment System (RAS), using data 
extracted from three other CMS IT systems:
     RAPS data: Diagnosis data files containing abbreviated 
current diagnosis data submitted by payee entities to CMS's Risk 
Adjustment Processing System (RAPS):
    [cir] Health Insurance Claim Number (HICN)
    [cir] Provider Type
    [cir] Service From Date
    [cir] Service Through Date
    [cir] Plan Number (MAO contract number)
    [cir] Diagnosis Code
    [cir] Diagnosis Delete Date
    [cir] RAS Diagnosis Indicator
    [cir] NCH Category Equitable BIC
    [cir] Accrete Data
    [cir] Delete Plan Number
    [cir] Submitter ID
    [cir] Daily File Code, and
    [cir] Delete File Code
     CME data: Current demographic and enrollment data from 
CMS's Common Medicare Environment (CME):
    [cir] Beneficiary Link Key Partition number
    [cir] Beneficiary Link Identifier
    [cir] Health Insurance Claim Number (HICN)
    [cir] Beneficiary Social Security Number
    [cir] Beneficiary Birth Date
    [cir] Beneficiary Death Date
    [cir] Beneficiary Sex Code
    [cir] Beneficiary Race Code
    [cir] Beneficiary First Name
    [cir] Beneficiary Middle Name
    [cir] Beneficiary Last Name
     NCH data: Current diagnosis data [and past medical history 
data] from National Claims History Files in CMS's National Medicare 
Utilization Database (NMUD):
    [cir] Health Insurance Claim Number (HICN)
    [cir] NCH Category Equitable BIC
    [cir] Diagnosis code
    [cir] Service Through Date
    [cir] Service From Date
    [cir] Beneficiary Link Identifier
    [cir] Provider Number

Authority for Maintenance of the System:
    This system was established pursuant to sections 1853(a), 1860D-
15(c), and 1894(d)(2)of the Social Security Act (42 U.S.C. 1395w-23, 
1395w-115, 1395eee).

Purpose(s) of the System:
    Records will be used within the agency to develop risk adjustment 
models and to calculate the risk score for each Medicare beneficiary 
enrolled in the Medicare health plan. The risk score will be reported 
to the system that CMS uses to process payments, and ultimately will be 
used to adjust payments to MA organizations, Part D sponsors, and PACE 
organizations, based on beneficiary health status. (Note that payment 
records are not covered under this system of records.)
    Information retrieved from this SOR will be used for the following 
purposes:
 To determine the risk adjustment factors used to adjust 
payments to MA organizations and other entities, as required under 42 
CFR 422.304(a) and (c), 423.329 and 460.180
 to update risk adjustment models
 to calculate Medicare Disproportionate Share Hospital (DSH) 
percentages
 to conduct quality review and improvement activities for 
Medicare coverage purposes
 to conduct evaluations and other analysis to support the 
Medicare program (including demonstrations)
 to support public health initiatives and other health care-
related research
 for activities to support the administration of the Medicare 
program
 for activities conducted to support program integrity
 for purposes authorized by applicable law

Routine Uses of Records Maintained in the System, Including Categories 
or Users and the Purposes of Such Uses:
    Records may be disclosed to parties outside HHS, without the 
individual record subject's prior, written consent, for the following 
purposes:
    1. To determine the risk adjustment factors used to adjust 
payments, as required under Sec. Sec.  422.304(a) and (c), 423.329, and 
460.180, to update risk adjustment models, to calculate Medicare DSH 
percentages, to conduct quality review and improvement activities, for 
Medicare coverage purposes, to conduct evaluations and other analysis 
to support the Medicare program (including demonstrations) and to 
support public health initiatives, for activities conducted to support 
program integrity, and for purposes authorized by applicable law.
    2. To support CMS contractors, consultants, or grantees that have 
been contracted by the Agency when necessary to assist in 
accomplishment of a CMS function relating to the purposes for this 
system or a purpose listed in paragraph 1.
    3. To support an individual or organization for research to support 
the Medicare program and public health initiatives, and otherwise 
related to health care, such as evaluation or epidemiological projects 
related to the prevention of disease or disability, the restoration or 
maintenance of health, or for understanding and improving payment 
projects.
    4. To provide information to the U.S. Department of Justice (DOJ), 
a court, or an adjudicatory body when (a) the Agency or any component 
thereof, or (b) any employee of the Agency in his or her official 
capacity, or (c) any employee of the Agency in his or her individual 
capacity where the DOJ has agreed to represent the employee, or (d) the 
United State Government, is a party to litigation or has an interest in 
such litigation, and by careful review, CMS determines that the records 
are both relevant and necessary to the litigation and that the use of 
such records by the DOJ, court, or adjudicatory body is compatible with 
the purpose for which the agency collected the records.
    5. To assist a CMS contractor (including, but not limited to 
Medicare Administrative Contractors, fiscal intermediaries, and 
carriers) that assists in the administration of a CMS-administered 
health benefits program, or to a grantee of a CMS-administered grant 
program, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud, waste or abuse in such program.
    6. To assist another Federal agency or an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that

[[Page 49240]]

administers or that has the authority to investigate potential fraud, 
waste or abuse in a health benefits program funded in whole or in part 
by Federal funds, when disclosure is deemed reasonably necessary by CMS 
to prevent, deter, discover, detect, investigate, examine, prosecute, 
sue with respect to, defend against, correct, remedy, or otherwise 
combat fraud, waste or abuse in such programs.
    7. To assist Medicare Advantage organizations, Part D Sponsors and 
PACE organizations with improving the quality of required risk 
adjustment data obtained from the provider that furnished the item or 
service. CMS will be analyzing the data received and advising MA 
organizations, Part D Sponsors and PACE organizations of trends and 
data analysis results to help improve the accuracy and completeness of 
data received from the provider.
    8. To assist appropriate Federal agencies and CMS contractors and 
consultants that have a need to know the information for the purpose of 
assisting CMS' efforts to respond to a suspected or confirmed breach of 
the security or confidentiality of information maintained in this 
system of records, provided that the information disclosed is relevant 
and necessary for that assistance.

    Note:  CMS may disclose information from this system of records, 
without the individual record subject's consent, for any of the 
following purposes referenced directly in the Privacy Act: 5 U.S.C. 
552a(b)(1), (3)-(8), and (12). CMS must also disclose information 
from this system of records, without the individual record subject's 
consent, for any of the following purposes referenced directly in 
the Privacy Act: 5 U.S.C. 552a(b)(2), and (b)(9)-(11).

Additional Provisions Affecting Routine Use Disclosures:
    This system contains Protected Health Information (PHI) as defined 
by HHS regulation ``Standards for Privacy of Individually Identifiable 
Health Information'' (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), 
subparts A and E). Disclosures of PHI authorized by these routine uses 
may only be made if, and as, permitted or required by the ``Standards 
for Privacy of Individually Identifiable Health Information.''
    In addition, our policy will be to prohibit release even of data 
that is not directly identifiable, except if required by law, if we 
determine there is a possibility that an individual can be identified 
through implicit deduction based on small cell sizes (instances where 
the patient population is so small that individuals could, because of 
the small size, use this information to deduce the identity of the 
beneficiary).

    Note: Information collected or obtained under Sec.  1860D-15 
(i.e., risk adjustment data used to pay Part D plan sponsors) will 
be used and disclosed only in accordance with the statutory 
limitations under Sec.  1860D-15(f)(2).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEMStorage:
    Archived records will be stored on magnetic tapes. Data that is 
currently in use is stored in the RAPS database.

Retrievability:
    Records will be retrieved by National Provider Identifier (NPI), 
beneficiary provider name, or beneficiary Health Insurance Claim 
Number.

Safeguards:
    Personnel having access to the system have been trained in the 
Privacy Act and information security requirements. Employees who 
maintain records in this system are instructed not to release data 
until the intended recipient agrees to implement appropriate 
management, operational, and technical safeguards sufficient to protect 
the confidentiality, integrity and availability of the information and 
information systems; and to prevent unauthorized access. Access to 
records in the RASS will be limited to CMS personnel and contractors 
through password security, encryption, firewalls, and secured operating 
system(s).

Retention and Disposal:
    Records (i.e., enrollee diagnosis data files created in RAPS, and 
Risk Adjustment Factor (RAF) files created in RAS) will be maintained 
for a period of up to 10 years after date of creation. Any such records 
that are needed longer, such as to resolve claims and audit exceptions 
or to prosecute fraud, will be retained until such matters are 
resolved. Enrollee claims records are currently subject to a document 
preservation order and will be preserved indefinitely pending further 
notice from the U.S. Department of Justice (DOJ).

System Manager and Address:
    Director, Division of Encounter Data and Risk Adjustment 
Operations, Medicare Plan Payment Group, Center for Medicare, CMS, 7500 
Security Boulevard, Baltimore, Maryland 21244-1850.

Notification Procedure:
    Individuals (i.e., the beneficiary or provider) wishing to know if 
this system contains records about them should write to the system 
manager and include pertinent personally identifiable information 
(encrypted and properly transmitted) to be used for retrieval of their 
records (i.e., NPI or Health Insurance Claim Number).

Record Access Procedure:
    Individuals seeking access to records about them in this system 
should follow the same instructions indicated under ``Notification 
Procedure'' and reasonably specify the record content being sought. 
(These procedures are in accordance with Department regulation 45 CFR 
5b.5(a)(2)).

Contesting Record Procedures:
    Individuals seeking to contest the content of information about 
them in this system should follow the same instructions indicated under 
``Notification Procedure.'' The request should: reasonably identify the 
record and specify the information being contested; state the 
corrective action sought; and provide the reasons for the correction, 
with supporting justification. (These procedures are in accordance with 
Department regulation 45 CFR 5b.7.)

Record Source Categories:
    RASS processes data extracted from RAPS and RAS IT systems to 
calculate the risk scores used to adjust payments to Medicare Advantage 
organizations, Part D plan sponsors and PACE plans. RAS receives the 
most current data for each Medicare Part C and Part D beneficiary from 
the following sources: RAPS, Common Medicare Environment (CME) also 
known as Medicare Beneficiary Database (MBD/CME), and National Medicare 
Utilization Database (NMUD). RAPS receives risk adjustment data from MA 
organizations and other entities defined above.

Systems Exempted from Certain Provisions of the Act:
    None.

Celeste Dade-Vinson,
Health Insurance Specialist, Centers for Medicare & Medicaid Services.
[FR Doc. 2015-20224 Filed 8-14-15; 8:45 am]
 BILLING CODE 4120-03-P

Federal Register / Vol. 80, No. 158 / Monday, August 17, 2015 / Notices 49237

Proposed Project Boston and Cincinnati. In these two younger children with a focus on
The Green Housing Pilot Study (New cities, renovations sponsored by the newborns–3 years. Having a larger age
Orleans)—New—National Center for Department of Housing and Urban range of children in the study will
Environmental Health (NCEH), Centers Development (HUD) had already been improve the estimates of how
for Disease Control and Prevention scheduled. By selecting sites in which environmental exposures inside and
(CDC). renovations were already scheduled to outside of their homes can occur during
occur, CDC has leveraged the different life stages of childhood, a
Background and Brief Description opportunity to collect survey and critical period of life when the immune
The Centers for Disease Control and biomarker data from residents, and to system and other organ systems are still
Prevention (CDC) seeks a new three-year collect environmental measurements in developing.
OMB approval for the Green Housing homes to evaluate associations between The Pilot will be implemented by
Pilot Study (New Orleans) or ‘‘Pilot’’ of green housing and health. incorporating it into the Green Housing
additional components to be tested at Several objectives will be evaluated
study schedule. Data collection methods
the New Orleans site for the main Green during the Pilot:
(1) Identify and characterize factors include: (1) Time-activity pattern
Housing Study (OMB No. 0920–0906,
affecting children’s exposures to questionnaire of children, administered
Expiration 10/31/2017). The goal of the
chemical ingredients from consumer to mothers/primary caregivers; (2)
Pilot is to apply novel approaches to
products found in their everyday collection of air, soil, dust samples from
study exposures to various indoor
environment to support the data and the respondent’s home; and (3)
pollutants in children ranging in age
modeling needs of the exposure collection of blood, urine, toenails
from newborn–12 years. The
information collected will help components of EPA’s national research clippings, and feces from the
scientists better understand time- programs; respondent’s eligible children.
activity patterns of children that affect (2) Evaluate the Pilot data metrics for We hypothesize that a better
exposures to chemical and biological incorporation in and enhancement of estimation of exposure pathways will
agents in their residential environments, CDC’s ability to understand the improve exposure modeling for the
and improve estimates of exposure for relationship between environmental current and the future Green Housing
children. exposures and asthma; Study sites, and influence future
Results from this Pilot will inform (3) Compare multimedia research in environmental health.
future Green Housing Study sites and measurements and survey data between Although children are considered
will potentially reduce participant time pre- and post-renovation time points in participants, the respondents to all
burden by collecting some green and non-green low-income questionnaires are the mothers/primary
questionnaires electronically. This housing to assess exposure related caregivers; no children will fill out
study directly supports the Healthy changes in the residence and questionnaires.
People 2020 Healthy Homes’ health participants due to renovation activities.
Like the other Green Housing Study The respondents are 64 mothers/
protection goal of the CDC. This
sites, data will be collected from 64 primary caregivers of enrolled children;
investigation is consistent with CDC’s
households. Study participants are or approximately 21 respondents each
Health Protection Research Agenda,
which calls for research to identify the children with asthma and their mothers/ year. There is no cost to the respondents
major environmental causes of disease primary caregivers living in HUD- other than their time to participate in
and disability and related risk factors. subsidized housing that has either the study.
In 2011, CDC funded the first two received a green renovation or is a non- The total estimated annual burden
study sites for the Green Housing Study, green home. This Pilot will also enroll hours for the Pilot is 56 hours.

ESTIMATED ANNUALIZED BURDEN HOURS
Average
Number of
Number of burden per
Type of respondents Form name responses per
respondents response
respondent (in hrs.)

Mothers/Primary Caregivers of Enrolled Chil- Time/Activity Questionnaire ........................... 21 4 40/60
dren.

Leroy A. Richardson, DEPARTMENT OF HEALTH AND SUMMARY: In accordance with the
Chief, Information Collection Review Office, HUMAN SERVICES requirements of the Privacy Act of 1974,
Office of Scientific Integrity, Office of the we are proposing to establish a new
Associate Director for Science, Office of the Centers for Medicare & Medicaid SOR titled, ‘‘CMS Risk Adjustment
Director, Centers for Disease Control and Services Suite of Systems (RASS),’’ System No.
Prevention. 09–70–0508. Payments to Medicare
[FR Doc. 2015–20191 Filed 8–14–15; 8:45 am] Privacy Act of 1974: Report of New Advantage (MA) organizations, Part D
BILLING CODE 4163–18–P System of Records sponsors, and Program of All Inclusive
mstockstill on DSK4VPTVN1PROD with NOTICES

Care for the Elderly (PACE)
AGENCY: Centers for Medicare &
organizations (collectively referred to as
Medicaid Services (CMS), Department
‘‘MA organizations and other entities’’)
of Health and Human Services (HHS)
are adjusted based on the health status
ACTION:Notice of New System of of enrolled Medicare beneficiaries
Records (SOR). (‘‘enrollees’’). RASS is established to
receive, process, and store the data used

VerDate Sep<11>2014 16:57 Aug 14, 2015 Jkt 235001 PO 00000 Frm 00040 Fmt 4703 Sfmt 4703 E:\FR\FM\17AUN1.SGM 17AUN1

49240 Federal Register / Vol. 80, No. 158 / Monday, August 17, 2015 / Notices

administers or that has the authority to small size, use this information to pertinent personally identifiable
investigate potential fraud, waste or deduce the identity of the beneficiary). information (encrypted and properly
abuse in a health benefits program Note: Information collected or obtained transmitted) to be used for retrieval of
funded in whole or in part by Federal under § 1860D–15 (i.e., risk adjustment data their records (i.e., NPI or Health
funds, when disclosure is deemed used to pay Part D plan sponsors) will be Insurance Claim Number).
reasonably necessary by CMS to used and disclosed only in accordance with
the statutory limitations under § 1860D– RECORD ACCESS PROCEDURE:
prevent, deter, discover, detect,
investigate, examine, prosecute, sue 15(f)(2). Individuals seeking access to records
with respect to, defend against, correct, about them in this system should follow
remedy, or otherwise combat fraud, POLICIES AND PRACTICES FOR STORING, the same instructions indicated under
RETRIEVING, ACCESSING, RETAINING, AND ‘‘Notification Procedure’’ and
waste or abuse in such programs.
DISPOSING OF RECORDS IN THE SYSTEMSTORAGE: reasonably specify the record content
7. To assist Medicare Advantage
Archived records will be stored on being sought. (These procedures are in
organizations, Part D Sponsors and
magnetic tapes. Data that is currently in accordance with Department regulation
PACE organizations with improving the
use is stored in the RAPS database. 45 CFR 5b.5(a)(2)).
quality of required risk adjustment data
obtained from the provider that RETRIEVABILITY: CONTESTING RECORD PROCEDURES:
furnished the item or service. CMS will Records will be retrieved by National Individuals seeking to contest the
be analyzing the data received and Provider Identifier (NPI), beneficiary content of information about them in
advising MA organizations, Part D provider name, or beneficiary Health this system should follow the same
Sponsors and PACE organizations of Insurance Claim Number. instructions indicated under
trends and data analysis results to help ‘‘Notification Procedure.’’ The request
improve the accuracy and completeness SAFEGUARDS:
should: reasonably identify the record
of data received from the provider. Personnel having access to the system
and specify the information being
8. To assist appropriate Federal have been trained in the Privacy Act
contested; state the corrective action
agencies and CMS contractors and and information security requirements.
sought; and provide the reasons for the
consultants that have a need to know Employees who maintain records in this
correction, with supporting justification.
the information for the purpose of system are instructed not to release data
(These procedures are in accordance
assisting CMS’ efforts to respond to a until the intended recipient agrees to
with Department regulation 45 CFR
suspected or confirmed breach of the implement appropriate management,
5b.7.)
security or confidentiality of operational, and technical safeguards
information maintained in this system sufficient to protect the confidentiality, RECORD SOURCE CATEGORIES:
of records, provided that the integrity and availability of the RASS processes data extracted from
information disclosed is relevant and information and information systems; RAPS and RAS IT systems to calculate
necessary for that assistance. and to prevent unauthorized access. the risk scores used to adjust payments
Access to records in the RASS will be to Medicare Advantage organizations,
Note: CMS may disclose information from
this system of records, without the individual
limited to CMS personnel and Part D plan sponsors and PACE plans.
record subject’s consent, for any of the contractors through password security, RAS receives the most current data for
following purposes referenced directly in the encryption, firewalls, and secured each Medicare Part C and Part D
Privacy Act: 5 U.S.C. 552a(b)(1), (3)–(8), and operating system(s). beneficiary from the following sources:
(12). CMS must also disclose information RAPS, Common Medicare Environment
RETENTION AND DISPOSAL:
from this system of records, without the (CME) also known as Medicare
individual record subject’s consent, for any Records (i.e., enrollee diagnosis data
Beneficiary Database (MBD/CME), and
of the following purposes referenced directly files created in RAPS, and Risk
in the Privacy Act: 5 U.S.C. 552a(b)(2), and National Medicare Utilization Database
Adjustment Factor (RAF) files created in
(b)(9)–(11). (NMUD). RAPS receives risk adjustment
RAS) will be maintained for a period of
data from MA organizations and other
up to 10 years after date of creation. Any
entities defined above.
ADDITIONAL PROVISIONS AFFECTING ROUTINE USE such records that are needed longer,
DISCLOSURES: such as to resolve claims and audit SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
This system contains Protected Health exceptions or to prosecute fraud, will be OF THE ACT:
Information (PHI) as defined by HHS retained until such matters are resolved. None.
regulation ‘‘Standards for Privacy of Enrollee claims records are currently
subject to a document preservation Celeste Dade-Vinson,
Individually Identifiable Health
order and will be preserved indefinitely Health Insurance Specialist, Centers for
Information’’ (45 CFR parts 160 and 164,
pending further notice from the U.S. Medicare & Medicaid Services.
65 FR 82462 (12–28–00), subparts A and
Department of Justice (DOJ). [FR Doc. 2015–20224 Filed 8–14–15; 8:45 am]
E). Disclosures of PHI authorized by
BILLING CODE 4120–03–P
these routine uses may only be made if, SYSTEM MANAGER AND ADDRESS:
and as, permitted or required by the
Director, Division of Encounter Data
‘‘Standards for Privacy of Individually
and Risk Adjustment Operations, DEPARTMENT OF HEALTH AND
Identifiable Health Information.’’
Medicare Plan Payment Group, Center HUMAN SERVICES
In addition, our policy will be to for Medicare, CMS, 7500 Security
mstockstill on DSK4VPTVN1PROD with NOTICES

prohibit release even of data that is not Boulevard, Baltimore, Maryland 21244– Food and Drug Administration
directly identifiable, except if required 1850.
by law, if we determine there is a [Docket No. FDA–2000–D–0103]
possibility that an individual can be NOTIFICATION PROCEDURE:
Botanical Drug Development; Draft
identified through implicit deduction Individuals (i.e., the beneficiary or Guidance for Industry; Availability
based on small cell sizes (instances provider) wishing to know if this system
where the patient population is so small contains records about them should AGENCY: Food and Drug Administration,
that individuals could, because of the write to the system manager and include HHS.

VerDate Sep<11>2014 16:57 Aug 14, 2015 Jkt 235001 PO 00000 Frm 00043 Fmt 4703 Sfmt 4703 E:\FR\FM\17AUN1.SGM 17AUN1

Document Created: 2015-12-15 11:06:39
Document Modified: 2015-12-15 11:06:39

Category		Regulatory Information
Collection		Federal Register
sudoc Class		AE 2.7: GS 4.107: AE 2.106:
Publisher		Office of the Federal Register, National Archives and Records Administration
Section		Notices
Action		Notice of New System of Records (SOR).
Dates		Effective 30 days after publication. Written comments should be submitted on or before the effective date. HHS/CMS/CM may publish an amended system of records notice (SORN) in light of any comments received.
Contact		Risk Adjustment Mailbox Coordinator, Division of Encounter Data and Risk Adjustment Operations, Medicare Plan Payment Group, Center for Medicare, CMS, Mail Stop C1-13-07, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. The email is [email protected]
FR Citation		80 FR 49237

80 FR 49237 - Privacy Act of 1974: Report of New System of Records

DEPARTMENT OF HEALTH AND HUMAN SERVICESCenters for Medicare & Medicaid Services

Federal Register Volume 80, Issue 158 (August 17, 2015)

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services