81_FR_26651 81 FR 26566 - Privacy Act of 1974; Report of New System of Records

81 FR 26566 - Privacy Act of 1974; Report of New System of Records

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services

Federal Register Volume 81, Issue 85 (May 3, 2016)

Page Range26566-26569
FR Document2016-10253

In accordance with the requirements of the Privacy Act of 1974, we are proposing to establish a new SOR titled, ``CMS Risk Adjustment Data Validation System (RAD-V),'' System No. 09-70-0511. Under Sec. 1343 of the Patient Protection and Affordable Care Act (Pub. L. 111-148) as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152), (hereinafter, the ACA), and the implementing regulations at 45 CFR part 153, data collected and maintained in this system will be used to support the audit functions of the risk adjustment program, including validation activities under the risk adjustment data validation program. The goal of the risk adjustment program is to provide payments to non-grandfathered health insurance issuers in the individual and small group markets that attract higher-risk populations, including a validation program to ensure the reliability of data used as a basis for risk adjustment payments and charges. Non-grandfathered plans are health plans that came into existence after March 23, 2010. Insurers offering these plans were required to modify them to follow the ACA rules as of January 1, 2014. The RAD-V system will contain personally identifiable information (PII) about individuals who are current or former enrollees in non- grandfathered health plans, including information obtained through the risk adjustment data validation process to establish the relative deviation from the average. The program and the system of record are more thoroughly described in the SUPPLEMENTARY INFORMATION section and System of Records Notice below. At this time, the only personally identifiable information that will be collected under this System will be through the RAD-V, part of the risk adjustment program.

Federal Register, Volume 81 Issue 85 (Tuesday, May 3, 2016)
[Federal Register Volume 81, Number 85 (Tuesday, May 3, 2016)]
[Notices]
[Pages 26566-26569]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2016-10253]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Report of New System of Records

AGENCY: Department of Health and Human Services (HHS), Centers for 
Medicare & Medicaid Services (CMS).

ACTION: Notice of New System of Records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to establish a new SOR titled, ``CMS Risk 
Adjustment Data Validation System (RAD-V),'' System No. 09-70-0511. 
Under Sec.  1343 of the Patient Protection and Affordable Care Act 
(Pub. L. 111-148) as amended by the Health Care and Education 
Reconciliation Act of 2010 (Pub. L. 111-152), (hereinafter, the ACA), 
and the implementing regulations at 45 CFR part 153, data collected and 
maintained in this system will be used to support the audit functions 
of the risk adjustment

[[Page 26567]]

program, including validation activities under the risk adjustment data 
validation program.
    The goal of the risk adjustment program is to provide payments to 
non-grandfathered health insurance issuers in the individual and small 
group markets that attract higher-risk populations, including a 
validation program to ensure the reliability of data used as a basis 
for risk adjustment payments and charges. Non-grandfathered plans are 
health plans that came into existence after March 23, 2010. Insurers 
offering these plans were required to modify them to follow the ACA 
rules as of January 1, 2014.
    The RAD-V system will contain personally identifiable information 
(PII) about individuals who are current or former enrollees in non-
grandfathered health plans, including information obtained through the 
risk adjustment data validation process to establish the relative 
deviation from the average. The program and the system of record are 
more thoroughly described in the SUPPLEMENTARY INFORMATION section and 
System of Records Notice below.
    At this time, the only personally identifiable information that 
will be collected under this System will be through the RAD-V, part of 
the risk adjustment program.

DATES: This action will be effective without further notice 30 days 
after publication in the Federal Register or 40 days after providing a 
report of this Notice to the Office of Management and Budget and 
Congress, whichever is later. Written comments should be submitted 
within 30 days of publication in the Federal Register. HHS may publish 
an amended system of records notice (SORN) in light of any comments 
received.

ADDRESSES: Written comments can be sent to: CMS Privacy Act Officer, 
Division of Security, Privacy Policy & Governance, Information Security 
& Privacy Group, Office of Enterprise Information, CMS, 7500 Security 
Boulevard, Baltimore, MD 21244-1870, Mailstop: N1-24-08, or by E-Mail 
to: [email protected]. Comments received will be available for 
review at this location, by appointment, during regular business hours, 
Monday through Friday from 9:00 a.m.-3:00 p.m., Eastern Time zone.

FOR INFORMATION CONTACT:  Catherine Anderson, RAD-V Mailbox 
Coordinator, Division of Risk Adjustment Operations, CCIIO, CMS, 7500 
Security Boulevard, Baltimore, Maryland 21244. The email address is 
[email protected].

SUPPLEMENTARY INFORMATION: Section 1343(b) of the ACA requires the 
Secretary to establish criteria and methods to carry out a risk 
adjustment program. Section 1321(a)(1)(C) of the ACA directs the 
Secretary to issue regulations and set standards to establish the risk 
adjustment program. Consistent with Sec.  1321(c)(1) of the ACA, 45 CFR 
153.310(a) provides that HHS will operate risk adjustment where a State 
does not elect to administer the risk adjustment program. The primary 
goals of the risk adjustment program are to assist health plans that 
provide coverage to individuals with higher health care costs and will 
help ensure that those who are sick have access to the coverage they 
need. The ACA's risk adjustment program also serves to level the 
playing field inside and outside of the individual and small group 
markets in each state by stabilizing premiums.
    Under 45 CFR 153.620(b), issuers of risk adjustment covered plans 
must maintain documents and records to enable such evaluation, and must 
make such records available to HHS upon request for purposes of 
verification, investigation, audit or other review. As part of the risk 
adjustment data validation program, HHS may audit an issuer of a risk 
adjustment covered plan to assess its compliance with the risk 
adjustment requirements.
    The state, or HHS on behalf of the state, must ensure proper 
validation of a statistically valid sample of risk adjustment data from 
each issuer that offers at least one risk adjustment covered plan in 
that state, as well as an administrative process to appeal findings 
from the risk adjustment data validation process. When HHS is 
conducting the risk adjustment data validation program, 45 CFR 
153.620(a) and 153.630(a), requires issuers of risk adjustment covered 
plans to comply with any request for data for any audit or validation 
preformed, including relevant source enrollment documentation, all 
claims and encounter data, and medical record documentation.
    Existing information privacy and security standards, such as 
standards under HIPAA and those detailed at 45 CFR 153.630(f)(2), which 
governs the risk adjustment data validation program, will apply to 
issuers and their initial validation auditors. In order to minimize the 
amount of individually identifiable information collected, CMS will use 
the smallest possible sample size that will provide a statistically 
valid sample, in accordance with the regulations at 45 CFR 153.350(a).

The Privacy Act

    The Privacy Act governs the collection, maintenance, use, and 
dissemination of certain information about individuals by agencies of 
the federal government. A system of records is a group of any records 
under the control of a federal agency from which information about 
individuals is retrieved by name or other personal identifier. The 
Privacy Act requires each agency to publish notice in the Federal 
Register of the existence and character of each system of records that 
the agency maintains, including the name and location of the system; 
the categories of individuals whom records are maintained; the 
categories, routine uses, and sources of the records; the agencies 
policies and practices regarding storage retrieval, access controls, 
and retention and disposal of the records; and the title and business 
address of the agency official to contact with notification, access, 
and amendment requests.
SYSTEM NUMBER:
    09-70-0511.

SYSTEM NAME:
    Risk Adjustment Data Validation System (RAD-V), HHS/CMS/CCIIO.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The RAD-V will be physically located at the CMS Data Center, 7500 
Security Boulevard, North Building, First Floor, Baltimore, MD 21244-
1850, and at various contractor sites.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The system will contain information about individuals currently or 
previously enrolled in a risk adjustment covered plan as defined at 45 
CFR 153.20, and individual providers of medical or health care 
services.

CATEGORIES OF RECORDS IN THE SYSTEM:
    CMS will collect demographic, geographic, medical and/or health 
care information, date of birth, gender, dates of service about 
individuals that are currently and previously enrolled in risk 
adjustment covered plans. In addition, CMS will collect identifiable 
information about individual health care providers, including but not 
limited to name, ITIN or EIN, and NPI numbers.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for the maintenance of the RAD-V is given under the 
provisions of Sec. Sec.  1321 and 1343 of the Patient

[[Page 26568]]

Protection and Affordable Care Act (Pub. L. 111-148) as amended by the 
Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152), 
and the Regulations at 45 CFR 153.350, 153.620, 153.630.

PURPOSE(S) OF THE SYSTEM:
    The primary purpose of this system is to collect and maintain 
necessary to support the audit functions of the risk adjustment 
programs, including validation activities under the risk adjustment 
data validation system (RAD-V).

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OR USERS AND THE PURPOSES OF SUCH USES:
    A. Entities Who May Receive Disclosures under Routine Uses Records 
about an individual may be disclosed from this system of records to the 
following parties outside the agency, without the individual's consent, 
for these purposes:
    1. To CMS contractors who have been engaged by the agency to assist 
in the performance of a service related to this collection and who need 
to have access to the records in order to perform the activity.
    2. To a health insurance issuer participating in the risk 
adjustment data validation program or any agent, contractor, sub-
contractor or entity of that health insurance issuer that has entered 
into an agreement or contract with the issuer to assist in compliance 
with the risk adjustment data validation program.
    3. The Department of Justice (DOJ), a court or an adjudicatory body 
when: a. The agency or any component thereof, or b. Any employee of the 
agency in his/her official capacity, or c. Any employee of the agency 
in his/her individual capacity where the DOJ has agreed to represent 
the employee, or d. The United States Government is a party to 
litigation or has an interest in such litigation, and by careful 
review, CMS determines that the records are both relevant and necessary 
to the litigation and that the use of such records by the DOJ, a court 
or an adjudicatory body is compatible for the purpose for which the 
agency collected the records.
    4. To a CMS contractor that assists in the administration of a CMS 
administered health benefits program, when disclosure is deemed 
reasonably necessary by CMS, to prevent, deter, discover, detect, 
investigate, examine, prosecute, sue with respect to, defend against, 
correct, remedy, or otherwise combat fraud or abuse in such program.
    5. To another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any State or local governmental agency), that 
administers, or that has the authority to investigate, potential fraud 
in the health benefits program funded in whole or in part by Federal 
funds, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud or abuse in such program.
    6. To appropriate federal agencies and Department contractors that 
have a need to know the information for the purpose of assisting the 
Department's efforts to respond to a suspected or confirmed breach of 
the security or confidentiality of information maintained in this 
system of records, if the information disclosed is relevant to and 
necessary for that assistance; and information from this system may 
become available to U.S. Department of Homeland Security (DHS) cyber 
security personnel if captured in an intrusion detection system used by 
HHS and DHS pursuant to a DHS cyber security program that monitors 
internet traffic to and from federal government computer networks to 
prevent a variety of types of cybersecurity incidents.
    Records may also be disclosed to parties outside the agency, 
without the individual's consent, for any of the purposes authorized 
directly in the Privacy Act at 5 U.S.C Sec.  552(a)(b)(1), (2) and 
(b)(4)-(b)(12).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM
STORAGE:
    Archived records for the risk adjustment data validation program 
will be stored in electronic form in the HHS-RADV Audit Tool maintained 
in the Acumen Web Portal.

RETRIEVABILITY:
    The data collected is retrieved by the name of an individual, or by 
some other identifying number, symbol, or other identifying particular 
assigned to an individual.

SAFEGUARDS:
    CMS has safeguards in place for authorized users and monitors such 
users to ensure against excessive or unauthorized use. Personnel having 
access to the RAD-V have been trained in the Privacy Act information 
privacy and security requirements. Employees who maintain records in 
this system are instructed not to release data unless the intended 
recipient agrees to implement appropriate physical, technical, and 
administrative safeguards sufficient to protect the confidentiality, 
integrity and availability of the information and information systems, 
and to prevent unauthorized access.
    This system will conform to all applicable Federal laws and 
regulation and Federal, HHS and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulation mat apply but are not limited to: the Privacy Act of 1974; 
the Federal Information Security Act of 2002; the Computer Fraud and 
Abuse Act of 1986; the Health Insurance Portability and Accountability 
Act of 1996; the e-Government Act of 2002; the Clinger-Cohen Act of 
1996; the Medicare Modernization Act of 2003, and their corresponding 
implementing regulations. OMB Circular A-130, Management of Federal 
Resources, Appendix III Security of Federal Automated Information 
Resources also applies, as well as Federal, HHS, and CMS information 
system security and privacy policies.

RETENTION AND DISPOSAL:
    Records will be maintained until they become inactive, at which 
time they will be retired or destroyed in accordance with published 
records schedules of CMS, as approved by the National Archives and 
Records Administration, and following the guidelines in National 
Institutes of Science and Technology (NIST) Special Publication 800-88, 
Guidelines for Media Sanitation. Enrollee claims records subject to a 
document preservation order will be preserved consistent with the terms 
of the court's order.

SYSTEM MANAGER AND ADDRESS:
    Director, Division of Risk Adjustment Operations, Payment Policy & 
Financial Management Group, CCIIO, CMS, 7500 Security Boulevard, 
Baltimore, MD 21244.

NOTIFICATION PROCEDURE:
    Individuals wishing to know if this system contains records about 
them should write to the System Manager and include pertinent 
personally identifiable information (which CMS recommends be encrypted 
and properly transmitted) to be used for retrieval of their records.

RECORD ACCESS PROCEDURE:
    Individuals seeking access to records about them in this system 
should follow the same instructions indicated under ``Notification 
Procedure'' and reasonably specify the record content being sought. 
(These procedures are in accordance with HHS regulations at 45 CFR 
5b.5(a)(2).)

[[Page 26569]]

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest the content of information about 
them in this system should follow the same instructions indicated under 
``Notification Procedure.'' The request should: Reasonably identify the 
record and specify the information being contested; state the 
corrective action sought; and provide the reasons for the correction, 
with supporting justification. (These procedures are in accordance with 
HHS regulations at 45 CFR 5b.7.)

RECORD SOURCE CATEGORIES:
    The RAD-V will contain individually identifiable enrollment and 
demographic information, claims and encounter information and 
enrollees' medical records provided by issuers of risk adjustment 
covered plans. The issuers will provide the information as requested by 
CMS or a contractor on CMS' behalf.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    None.

    Dated: April 26, 2016.
Emery Csulak,
CMS Senior Official for Privacy, Centers for Medicare & Medicaid 
Services.
[FR Doc. 2016-10253 Filed 5-2-16; 8:45 am]
 BILLING CODE 4120-03-P



                                                    26566                           Federal Register / Vol. 81, No. 85 / Tuesday, May 3, 2016 / Notices

                                                    II. Provisions of the Notice                               An individual or entity shall not be                 • Phase 2
                                                                                                            deemed ineligible because the                           ++ Ease in which a user can navigate
                                                    A. Subject of Challenge Competition:
                                                                                                            individual or entity used federal                     Usability and Design;
                                                    MIPS Mobile Challenge
                                                                                                            facilities or consulted with federal                    ++ Evidence of design with User
                                                    1. Eligibility Rules for Participating in               employees during a competition if the                 feedback;
                                                    the Competition                                         facilities and employees are made                       ++ Innovation in Design;
                                                       To be eligible to win a prize under                  available to all individuals and entities               ++ Functionality/Accuracy; and
                                                    this challenge, participants (individual                participating in the competition on an                  ++ Look and Feel.
                                                    or entity) must comply with each and                    equitable basis.
                                                                                                               Challenge participants will sign a                 C. Additional Information
                                                    every rule set forth in this section:
                                                       1. Shall register to participate in the              liability release as part of the contest                Challenge participants will draw from
                                                    competition under the rules                             registration process. The liability release           existing information provided on
                                                    promulgated below by the Department                     will use the following language:                      www.cms.gov and collaborate directly
                                                    of Health and Human Services (HHS).                        By participating in this competition, I            with health professionals and/or end
                                                       2. In the case of a private entity, shall            agree to assume any and all risks and                 users to build their application. The
                                                    be incorporated in and maintain a                       waive claims against the federal                      participants will have access to
                                                    primary place of business in the United                 government and its related entities,                  www.cms.gov and to end users.
                                                    States, and in the case of an individual,               except in the case of willing                         Challenge details and registration are
                                                    whether participating individually or in                misconduct, for any injury, death,                    located at www.challenge.gov.
                                                    a group, shall be a citizen or permanent                damage, or loss of property, revenue, or              III. Collection of Information
                                                    resident of the United States.                          profits, whether direct, indirect, or                 Requirements
                                                       3. HHS Employees may participate in                  consequential, arising from my
                                                    the MIPS Mobile Challenge, but may not                  participation in this prize contest,                     This document does not impose
                                                    submit in the scope of their employment                 whether the injury, death, damage, or                 information collection requirements,
                                                    and may not pursue an application                       loss arises through negligence or                     that is, reporting, recordkeeping or
                                                    while in the federal workplace or while                 otherwise.                                            third-party disclosure requirements.
                                                    on duty.                                                                                                      Consequently, there is no need for
                                                       4. Shall not be an employee of the                   B. Registration Process for Participants              review by the Office of Management and
                                                    CMS.                                                    1. Amount of the Prize                                Budget under the authority of the
                                                       5. Federal grantees may not use                                                                            Paperwork Reduction Act of 1995 (44
                                                    federal funds to develop the America                      The top 3 to 5 winners for phase I of               U.S.C. 3501 et seq.).
                                                    COMPETES Reauthorization Act of 2010                    the challenge will be provided a
                                                                                                            monetary cash prize totaling $10,000                    Dated: April 20, 2016.
                                                    (Pub. L. 111–358, enacted January 4,                                                                          Andrew M. Slavitt,
                                                    2011) (COMPETES Act) challenge                          per winner. The Phase II final challenge
                                                                                                            winner will be provided a monetary                    Acting Administrator, Centers for Medicare
                                                    applications unless consistent with the                                                                       & Medicaid Services.
                                                    purpose of their grant award.                           cash prize totaling $25,000.
                                                                                                                                                                  [FR Doc. 2016–10301 Filed 5–2–16; 8:45 am]
                                                       6. Federal contractors may not use                   2. How Winners Are Selected
                                                    federal funds from a contract to develop                                                                      BILLING CODE 4120–01–P

                                                    COMPETES Act challenge applications                        Challenge submissions will be judged
                                                    or to fund efforts in support of a                      by a panel selected by CMS with
                                                                                                            relevant expertise in current CMS                     DEPARTMENT OF HEALTH AND
                                                    COMPETES Act challenge submission.
                                                       7. Applicants must agree to provide                  reporting systems. The expert panel of                HUMAN SERVICES
                                                    the federal government an irrevocable,                  judges, qualified by training and
                                                                                                            experience, will evaluate the                         Centers for Medicare & Medicaid
                                                    royalty-free, non-exclusive worldwide                                                                         Services
                                                    license in the winning work(s) or                       submissions on the criteria identified
                                                    component parts thereof, in the event                   below in this section. Judges will be fair
                                                                                                                                                                  Privacy Act of 1974; Report of New
                                                    that they are prize winner(s). HHS shall                and impartial, may not have a personal
                                                                                                                                                                  System of Records
                                                    be granted the rights to reproduce,                     or financial interest in, or be an
                                                    distribute copies to the public, publicly               employee, officer, director, or agent of,             AGENCY: Department of Health and
                                                    display, create derivative works, and                   any entity that is a registered participant           Human Services (HHS), Centers for
                                                    publicly post, link to, and share the                   in the competition, and may not have a                Medicare & Medicaid Services (CMS).
                                                    winning work(s) or parts thereof.                       personal or financial relationship with               ACTION: Notice of New System of
                                                       A submission may be disqualified if,                 an individual who is a registered                     Records (SOR).
                                                    in CMS’s sole judgment:                                 contestant. The panel will provide
                                                       • Fails to function as expressed in the              expert advice on the merits of each                   SUMMARY:   In accordance with the
                                                    detailed description,                                   submission to CMS officials responsible               requirements of the Privacy Act of 1974,
                                                       • The detailed description is                        for final selections for award. Awardees              we are proposing to establish a new
                                                    significantly inaccurate or incomplete,                 will be notified on or around the dates               SOR titled, ‘‘CMS Risk Adjustment Data
                                                    or                                                      listed in the ‘‘Date’’ section. Winners               Validation System (RAD–V),’’ System
                                                       • Malware or other security threats                  will be selected based on the following               No. 09–70–0511. Under § 1343 of the
                                                    are present.                                                                                                  Patient Protection and Affordable Care
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                                                                            criteria:
                                                       Participants agree that we may                                                                             Act (Pub. L. 111–148) as amended by
                                                    conduct testing on the submitted code                     • Phase 1                                           the Health Care and Education
                                                    to determine whether malware or other                     ++ Ease in which a user can navigate                Reconciliation Act of 2010 (Pub. L. 111–
                                                    security threats may be present such                    Usability and Design;                                 152), (hereinafter, the ACA), and the
                                                    that they may damage the equipment or                     ++ Evidence of design with User                     implementing regulations at 45 CFR part
                                                    operating environments of the Federal                   feedback;                                             153, data collected and maintained in
                                                    Government or those acting on its                         ++ Innovation in Design; and                        this system will be used to support the
                                                    behalf.                                                   ++ Look and Feel.                                   audit functions of the risk adjustment


                                               VerDate Sep<11>2014   18:53 May 02, 2016   Jkt 238001   PO 00000   Frm 00041   Fmt 4703   Sfmt 4703   E:\FR\FM\03MYN1.SGM   03MYN1


                                                                                    Federal Register / Vol. 81, No. 85 / Tuesday, May 3, 2016 / Notices                                              26567

                                                    program, including validation activities                SUPPLEMENTARY INFORMATION:      Section               The Privacy Act
                                                    under the risk adjustment data                          1343(b) of the ACA requires the                          The Privacy Act governs the
                                                    validation program.                                     Secretary to establish criteria and                   collection, maintenance, use, and
                                                      The goal of the risk adjustment                       methods to carry out a risk adjustment                dissemination of certain information
                                                    program is to provide payments to non-                  program. Section 1321(a)(1)(C) of the                 about individuals by agencies of the
                                                    grandfathered health insurance issuers                  ACA directs the Secretary to issue                    federal government. A system of records
                                                    in the individual and small group                       regulations and set standards to                      is a group of any records under the
                                                    markets that attract higher-risk                        establish the risk adjustment program.                control of a federal agency from which
                                                    populations, including a validation                     Consistent with § 1321(c)(1) of the ACA,              information about individuals is
                                                    program to ensure the reliability of data               45 CFR 153.310(a) provides that HHS                   retrieved by name or other personal
                                                    used as a basis for risk adjustment                     will operate risk adjustment where a                  identifier. The Privacy Act requires each
                                                    payments and charges. Non-                              State does not elect to administer the                agency to publish notice in the Federal
                                                    grandfathered plans are health plans                    risk adjustment program. The primary                  Register of the existence and character
                                                    that came into existence after March 23,                goals of the risk adjustment program are              of each system of records that the
                                                    2010. Insurers offering these plans were                to assist health plans that provide                   agency maintains, including the name
                                                    required to modify them to follow the                   coverage to individuals with higher                   and location of the system; the
                                                    ACA rules as of January 1, 2014.                        health care costs and will help ensure
                                                      The RAD–V system will contain                                                                               categories of individuals whom records
                                                                                                            that those who are sick have access to                are maintained; the categories, routine
                                                    personally identifiable information (PII)
                                                                                                            the coverage they need. The ACA’s risk                uses, and sources of the records; the
                                                    about individuals who are current or
                                                                                                            adjustment program also serves to level               agencies policies and practices
                                                    former enrollees in non-grandfathered
                                                                                                            the playing field inside and outside of               regarding storage retrieval, access
                                                    health plans, including information
                                                                                                            the individual and small group markets                controls, and retention and disposal of
                                                    obtained through the risk adjustment
                                                                                                            in each state by stabilizing premiums.                the records; and the title and business
                                                    data validation process to establish the
                                                    relative deviation from the average. The                   Under 45 CFR 153.620(b), issuers of                address of the agency official to contact
                                                    program and the system of record are                    risk adjustment covered plans must                    with notification, access, and
                                                    more thoroughly described in the                        maintain documents and records to                     amendment requests.
                                                    SUPPLEMENTARY INFORMATION section and                   enable such evaluation, and must make                 SYSTEM NUMBER:
                                                    System of Records Notice below.                         such records available to HHS upon
                                                      At this time, the only personally                     request for purposes of verification,                   09–70–0511.
                                                    identifiable information that will be                   investigation, audit or other review. As              SYSTEM NAME:
                                                    collected under this System will be                     part of the risk adjustment data                        Risk Adjustment Data Validation
                                                    through the RAD–V, part of the risk                     validation program, HHS may audit an                  System (RAD–V), HHS/CMS/CCIIO.
                                                    adjustment program.                                     issuer of a risk adjustment covered plan
                                                    DATES: This action will be effective                    to assess its compliance with the risk                SECURITY CLASSIFICATION:
                                                    without further notice 30 days after                    adjustment requirements.                                Unclassified.
                                                    publication in the Federal Register or                     The state, or HHS on behalf of the                 SYSTEM LOCATION:
                                                    40 days after providing a report of this                state, must ensure proper validation of                  The RAD–V will be physically located
                                                    Notice to the Office of Management and                  a statistically valid sample of risk                  at the CMS Data Center, 7500 Security
                                                    Budget and Congress, whichever is later.                adjustment data from each issuer that                 Boulevard, North Building, First Floor,
                                                    Written comments should be submitted                    offers at least one risk adjustment                   Baltimore, MD 21244–1850, and at
                                                    within 30 days of publication in the                    covered plan in that state, as well as an             various contractor sites.
                                                    Federal Register. HHS may publish an                    administrative process to appeal
                                                    amended system of records notice                        findings from the risk adjustment data                CATEGORIES OF INDIVIDUALS COVERED BY THE
                                                    (SORN) in light of any comments                         validation process. When HHS is                       SYSTEM:
                                                    received.                                               conducting the risk adjustment data                     The system will contain information
                                                    ADDRESSES: Written comments can be                      validation program, 45 CFR 153.620(a)                 about individuals currently or
                                                    sent to: CMS Privacy Act Officer,                       and 153.630(a), requires issuers of risk              previously enrolled in a risk adjustment
                                                    Division of Security, Privacy Policy &                  adjustment covered plans to comply                    covered plan as defined at 45 CFR
                                                    Governance, Information Security &                      with any request for data for any audit               153.20, and individual providers of
                                                    Privacy Group, Office of Enterprise                     or validation preformed, including                    medical or health care services.
                                                    Information, CMS, 7500 Security                         relevant source enrollment
                                                                                                                                                                  CATEGORIES OF RECORDS IN THE SYSTEM:
                                                    Boulevard, Baltimore, MD 21244–1870,                    documentation, all claims and
                                                                                                            encounter data, and medical record                       CMS will collect demographic,
                                                    Mailstop: N1–24–08, or by E-Mail to:                                                                          geographic, medical and/or health care
                                                    walter.stone@cms.hhs.gov. Comments                      documentation.
                                                                                                                                                                  information, date of birth, gender, dates
                                                    received will be available for review at                   Existing information privacy and                   of service about individuals that are
                                                    this location, by appointment, during                   security standards, such as standards                 currently and previously enrolled in
                                                    regular business hours, Monday through                  under HIPAA and those detailed at 45                  risk adjustment covered plans. In
                                                    Friday from 9:00 a.m.–3:00 p.m., Eastern                CFR 153.630(f)(2), which governs the                  addition, CMS will collect identifiable
                                                    Time zone.                                              risk adjustment data validation program,
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                                                                                                                                  information about individual health
                                                    FOR INFORMATION CONTACT: Catherine                      will apply to issuers and their initial               care providers, including but not
                                                    Anderson, RAD–V Mailbox Coordinator,                    validation auditors. In order to                      limited to name, ITIN or EIN, and NPI
                                                    Division of Risk Adjustment Operations,                 minimize the amount of individually                   numbers.
                                                    CCIIO, CMS, 7500 Security Boulevard,                    identifiable information collected, CMS
                                                    Baltimore, Maryland 21244. The email                    will use the smallest possible sample                 AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
                                                    address is                                              size that will provide a statistically                  Authority for the maintenance of the
                                                    CCIIOACARADataValidation@                               valid sample, in accordance with the                  RAD–V is given under the provisions of
                                                    cms.hhs.gov.                                            regulations at 45 CFR 153.350(a).                     §§ 1321 and 1343 of the Patient


                                               VerDate Sep<11>2014   18:53 May 02, 2016   Jkt 238001   PO 00000   Frm 00042   Fmt 4703   Sfmt 4703   E:\FR\FM\03MYN1.SGM   03MYN1


                                                    26568                           Federal Register / Vol. 81, No. 85 / Tuesday, May 3, 2016 / Notices

                                                    Protection and Affordable Care Act                      jurisdiction within or under the control              administrative safeguards sufficient to
                                                    (Pub. L. 111–148) as amended by the                     of the United States (including any State             protect the confidentiality, integrity and
                                                    Health Care and Education                               or local governmental agency), that                   availability of the information and
                                                    Reconciliation Act of 2010 (Pub. L. 111–                administers, or that has the authority to             information systems, and to prevent
                                                    152), and the Regulations at 45 CFR                     investigate, potential fraud in the health            unauthorized access.
                                                    153.350, 153.620, 153.630.                              benefits program funded in whole or in                  This system will conform to all
                                                                                                            part by Federal funds, when disclosure                applicable Federal laws and regulation
                                                    PURPOSE(S) OF THE SYSTEM:                                                                                     and Federal, HHS and CMS policies and
                                                                                                            is deemed reasonably necessary by CMS
                                                      The primary purpose of this system is                 to prevent, deter, discover, detect,                  standards as they relate to information
                                                    to collect and maintain necessary to                    investigate, examine, prosecute, sue                  security and data privacy. These laws
                                                    support the audit functions of the risk                 with respect to, defend against, correct,             and regulation mat apply but are not
                                                    adjustment programs, including                          remedy, or otherwise combat fraud or                  limited to: the Privacy Act of 1974; the
                                                    validation activities under the risk                    abuse in such program.                                Federal Information Security Act of
                                                    adjustment data validation system                          6. To appropriate federal agencies and             2002; the Computer Fraud and Abuse
                                                    (RAD–V).                                                Department contractors that have a need               Act of 1986; the Health Insurance
                                                                                                            to know the information for the purpose               Portability and Accountability Act of
                                                    ROUTINE USES OF RECORDS MAINTAINED IN THE
                                                                                                            of assisting the Department’s efforts to              1996; the e-Government Act of 2002; the
                                                    SYSTEM, INCLUDING CATEGORIES OR USERS AND
                                                    THE PURPOSES OF SUCH USES:                              respond to a suspected or confirmed                   Clinger-Cohen Act of 1996; the
                                                                                                            breach of the security or confidentiality             Medicare Modernization Act of 2003,
                                                       A. Entities Who May Receive                                                                                and their corresponding implementing
                                                    Disclosures under Routine Uses Records                  of information maintained in this
                                                                                                            system of records, if the information                 regulations. OMB Circular A–130,
                                                    about an individual may be disclosed                                                                          Management of Federal Resources,
                                                    from this system of records to the                      disclosed is relevant to and necessary
                                                                                                            for that assistance; and information from             Appendix III Security of Federal
                                                    following parties outside the agency,                                                                         Automated Information Resources also
                                                    without the individual’s consent, for                   this system may become available to
                                                                                                            U.S. Department of Homeland Security                  applies, as well as Federal, HHS, and
                                                    these purposes:                                                                                               CMS information system security and
                                                       1. To CMS contractors who have been                  (DHS) cyber security personnel if
                                                                                                            captured in an intrusion detection                    privacy policies.
                                                    engaged by the agency to assist in the
                                                    performance of a service related to this                system used by HHS and DHS pursuant                   RETENTION AND DISPOSAL:
                                                    collection and who need to have access                  to a DHS cyber security program that                    Records will be maintained until they
                                                    to the records in order to perform the                  monitors internet traffic to and from                 become inactive, at which time they
                                                    activity.                                               federal government computer networks                  will be retired or destroyed in
                                                       2. To a health insurance issuer                      to prevent a variety of types of                      accordance with published records
                                                    participating in the risk adjustment data               cybersecurity incidents.                              schedules of CMS, as approved by the
                                                    validation program or any agent,                           Records may also be disclosed to                   National Archives and Records
                                                    contractor, sub-contractor or entity of                 parties outside the agency, without the               Administration, and following the
                                                    that health insurance issuer that has                   individual’s consent, for any of the                  guidelines in National Institutes of
                                                    entered into an agreement or contract                   purposes authorized directly in the                   Science and Technology (NIST) Special
                                                    with the issuer to assist in compliance                 Privacy Act at 5 U.S.C § 552(a)(b)(1), (2)            Publication 800–88, Guidelines for
                                                    with the risk adjustment data validation                and (b)(4)–(b)(12).                                   Media Sanitation. Enrollee claims
                                                    program.                                                POLICIES AND PRACTICES FOR STORING,                   records subject to a document
                                                       3. The Department of Justice (DOJ), a                RETRIEVING, ACCESSING, RETAINING, AND                 preservation order will be preserved
                                                    court or an adjudicatory body when: a.                  DISPOSING OF RECORDS IN THE SYSTEM                    consistent with the terms of the court’s
                                                    The agency or any component thereof,                    STORAGE:                                              order.
                                                    or b. Any employee of the agency in his/
                                                                                                              Archived records for the risk                       SYSTEM MANAGER AND ADDRESS:
                                                    her official capacity, or c. Any employee
                                                                                                            adjustment data validation program will                 Director, Division of Risk Adjustment
                                                    of the agency in his/her individual
                                                                                                            be stored in electronic form in the HHS–              Operations, Payment Policy & Financial
                                                    capacity where the DOJ has agreed to
                                                                                                            RADV Audit Tool maintained in the                     Management Group, CCIIO, CMS, 7500
                                                    represent the employee, or d. The
                                                                                                            Acumen Web Portal.                                    Security Boulevard, Baltimore, MD
                                                    United States Government is a party to
                                                    litigation or has an interest in such                   RETRIEVABILITY:
                                                                                                                                                                  21244.
                                                    litigation, and by careful review, CMS                    The data collected is retrieved by the              NOTIFICATION PROCEDURE:
                                                    determines that the records are both                    name of an individual, or by some other                 Individuals wishing to know if this
                                                    relevant and necessary to the litigation                identifying number, symbol, or other                  system contains records about them
                                                    and that the use of such records by the                 identifying particular assigned to an                 should write to the System Manager and
                                                    DOJ, a court or an adjudicatory body is                 individual.                                           include pertinent personally identifiable
                                                    compatible for the purpose for which                                                                          information (which CMS recommends
                                                    the agency collected the records.                       SAFEGUARDS:
                                                                                                                                                                  be encrypted and properly transmitted)
                                                       4. To a CMS contractor that assists in                 CMS has safeguards in place for                     to be used for retrieval of their records.
                                                    the administration of a CMS                             authorized users and monitors such
                                                    administered health benefits program,                   users to ensure against excessive or                  RECORD ACCESS PROCEDURE:
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                    when disclosure is deemed reasonably                    unauthorized use. Personnel having                       Individuals seeking access to records
                                                    necessary by CMS, to prevent, deter,                    access to the RAD–V have been trained                 about them in this system should follow
                                                    discover, detect, investigate, examine,                 in the Privacy Act information privacy                the same instructions indicated under
                                                    prosecute, sue with respect to, defend                  and security requirements. Employees                  ‘‘Notification Procedure’’ and
                                                    against, correct, remedy, or otherwise                  who maintain records in this system are               reasonably specify the record content
                                                    combat fraud or abuse in such program.                  instructed not to release data unless the             being sought. (These procedures are in
                                                       5. To another Federal agency or to an                intended recipient agrees to implement                accordance with HHS regulations at 45
                                                    instrumentality of any governmental                     appropriate physical, technical, and                  CFR 5b.5(a)(2).)


                                               VerDate Sep<11>2014   18:53 May 02, 2016   Jkt 238001   PO 00000   Frm 00043   Fmt 4703   Sfmt 4703   E:\FR\FM\03MYN1.SGM   03MYN1


                                                                                    Federal Register / Vol. 81, No. 85 / Tuesday, May 3, 2016 / Notices                                                 26569

                                                    CONTESTING RECORD PROCEDURES:                            Dated: April 26, 2016.                               and renovation of child care facilities. A
                                                       Individuals seeking to contest the                   Emery Csulak,                                         tribal grantee must first request and
                                                    content of information about them in                    CMS Senior Official for Privacy, Centers for          receive approval from the
                                                    this system should follow the same                      Medicare & Medicaid Services.                         Administration for Children and
                                                    instructions indicated under                            [FR Doc. 2016–10253 Filed 5–2–16; 8:45 am]            Families (ACF) before using CCDF funds
                                                    ‘‘Notification Procedure.’’ The request                 BILLING CODE 4120–03–P                                for construction or major renovation.
                                                    should: Reasonably identify the record                                                                        This information collection contains the
                                                    and specify the information being                                                                             statutorily-mandated uniform
                                                    contested; state the corrective action                  DEPARTMENT OF HEALTH AND                              procedures for the solicitation and
                                                    sought; and provide the reasons for the                 HUMAN SERVICES                                        consideration of requests, including
                                                    correction, with supporting justification.
                                                                                                            Administration for Children and                       instructions for preparation of
                                                    (These procedures are in accordance
                                                                                                            Families                                              environmental assessments in
                                                    with HHS regulations at 45 CFR 5b.7.)
                                                                                                                                                                  conjunction with the National
                                                    RECORD SOURCE CATEGORIES:                               Submission for OMB Review;                            Environmental Policy Act. The
                                                       The RAD–V will contain individually                  Comment Request                                       proposed draft procedures update the
                                                    identifiable enrollment and                                                                                   procedures that were originally issued
                                                    demographic information, claims and                       Title: Procedures for Requests from
                                                                                                                                                                  in August 1997 and last updated in
                                                    encounter information and enrollees’                    Tribal Lead Agencies to use Child Care
                                                                                                                                                                  April 2013. Respondents will be CCDF
                                                    medical records provided by issuers of                  and Development Fund (CCDF) Funds
                                                                                                            for Construction or Major Renovation of               tribal grantees requesting to use CCDF
                                                    risk adjustment covered plans. The                                                                            funds for construction or major
                                                    issuers will provide the information as                 Child Care Facilities.
                                                                                                              OMB No.: 0970–0160.                                 renovation.
                                                    requested by CMS or a contractor on
                                                                                                              Description: The Child Care and                        Respondents: Tribal Child Care Lead
                                                    CMS’ behalf.
                                                                                                            Development Block Grant Act, as                       Agencies acting on behalf of Tribal
                                                    SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS                amended, allows Indian Tribes to use                  Governments.
                                                    OF THE ACT:                                             Child Care and Development Fund
                                                       None.                                                (CCDF) grant awards for construction

                                                                                                                   ANNUAL BURDEN ESTIMATES
                                                                                                                                                                 Number of            Average
                                                                                                                                               Number of                                           Total burden
                                                                                          Instrument                                                           responses per        burden hours
                                                                                                                                              respondents                                             hours
                                                                                                                                                                 respondent         per response

                                                    Construction or Major Renovation of Tribal Child Care Facilities ...................             5                1                 20             100



                                                      Estimated Total Annual Burden                         the Administration for Children and                   information, including each proposed
                                                    Hours: 100.                                             Families.                                             extension of an existing collection of
                                                      Additional Information: Copies of the                                                                       information, and to allow 60 days for
                                                                                                            Robert Sargis,
                                                    proposed collection may be obtained by                                                                        public comment in response to the
                                                                                                            Reports Clearance Officer.                            notice. This notice solicits comments on
                                                    writing to the Administration for                       [FR Doc. 2016–10293 Filed 5–2–16; 8:45 am]            the information collection requirements
                                                    Children and Families, Office of                        BILLING CODE 4184–01–P                                relating to an extension with no changes
                                                    Planning, Research and Evaluation, 330
                                                                                                                                                                  of a currently approved collection of the
                                                    C Street, Washington, DC 20201, Attn:                                                                         Title III and VII State Program Report.
                                                    ACF Reports Clearance Officer. Email                    DEPARTMENT OF HEALTH AND
                                                                                                                                                                  DATES: Submit written or electronic
                                                    address: infocollection@acf.hhs.gov. All                HUMAN SERVICES
                                                                                                                                                                  comments on the collection of
                                                    requests should be identified by the title
                                                                                                            Administration for Community Living                   information by July 5, 2016.
                                                    of the information collection.
                                                                                                                                                                  ADDRESSES: Submit electronic
                                                      OMB Comment: OMB is required to                       Agency Information Collection                         comments on the collection of
                                                    make a decision concerning the                          Activities; Proposed Extension With                   information to: Elena.Fazio@
                                                    collection of information between 30                    No Changes of a Currently Approved                    acl.hhs.gov.
                                                    and 60 days after publication of this                   Collection; Comment Request; State                      Submit written comments on the
                                                    document in the Federal Register.                       Program Report                                        collection of information to: U.S.
                                                    Therefore, a comment is best assured of                                                                       Department of Health and Human
                                                    having its full effect if OMB receives it               AGENCY:  Administration for Community                 Services: Administration for
                                                                                                            Living, HHS.                                          Community Living, Washington, DC
                                                    within 30 days of publication. Written
                                                    comments and recommendation for the                     ACTION: Notice.                                       20201, Attention: Elena Fazio.
                                                    proposed information collection should                  SUMMARY:  The Administration for                      FOR FURTHER INFORMATION CONTACT:
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                    be sent directly to the following: Office               Community Living (ACL) is announcing                  Elena Fazio by telephone: (202) 795–
                                                    of Management and Budget, Paperwork                     an opportunity for public comment on                  7343 or by email: Elena.Fazio@
                                                    Reduction Project, Fax: 202–395–7285,                   the proposed collection of certain                    acl.hhs.gov.
                                                    Email: OIRA_SUBMISSION@                                 information by the agency. Under the                  SUPPLEMENTARY INFORMATION:   Under the
                                                    OMB.EOP.GOV, Attn: Desk Officer for                     Paperwork Reduction Act of 1995 (the                  PRA (44 U.S.C. 3501–3520), Federal
                                                                                                            PRA), Federal agencies are required to                agencies must obtain approval from the
                                                                                                            publish notice in the Federal Register                Office of Management and Budget
                                                                                                            concerning each proposed collection of                (OMB) for each collection of


                                               VerDate Sep<11>2014   18:53 May 02, 2016   Jkt 238001   PO 00000   Frm 00044   Fmt 4703   Sfmt 4703   E:\FR\FM\03MYN1.SGM   03MYN1



Document Created: 2016-05-03 00:30:45
Document Modified: 2016-05-03 00:30:45
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice of New System of Records (SOR).
DatesThis action will be effective without further notice 30 days after publication in the Federal Register or 40 days after providing a report of this Notice to the Office of Management and Budget and Congress, whichever is later. Written comments should be submitted within 30 days of publication in the Federal Register. HHS may publish an amended system of records notice (SORN) in light of any comments received.
FR Citation81 FR 26566 

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR