[Federal Register Volume 59, Number 154 (Thursday, August 11, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-19578]


[[Page Unknown]]

[Federal Register: August 11, 1994]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Health Care Financing Administration

 

Privacy Act of 1974; System of Records

AGENCY: Department of Health and Human Services (HHS), Health Care 
Financing Administration (HCFA).

ACTION: Notice of proposed expansion of system purpose, addition of a 
new category of records in the system, addition of new routine uses, 
and administrative update.

-----------------------------------------------------------------------

SUMMARY: HCFA proposes revising the system notice for the ``Medicaid 
Statistical Information System (MSIS),'' System No. 09-70-6001, by: 
Adding ``drug data'' as a new category of records in the system; 
expanding the purpose of the system to include actuarial forecasting 
and statistical profiling; modifying a current route use (number 5); 
and adding a new route use (number 6) for the release of data without 
individuals' consent
    HCFA has developed drug data which will be helpful in supporting 
such things as research, policy, effectiveness of care, and statistical 
reporting. These data are being added to the ``Categories of records in 
the system.''
    The purpose of the system of records is also being expanded in 
order to be more specific, by including actuarial forecasting and 
statistical profiling as distinct purposes.
    Routine use No. 5 allows release to employees of a State for 
specific purposes. The modification would add the language, ``or for 
management and/or administration of the Medicaid program.''
    The proposed new routine use would permit release of data to other 
Federal agencies. This routine use has two purposes. First, disclosure 
would be permitted to another Federal agency to enhance the accuracy of 
Medicaid's payment of heath benefits. Second, disclosure would be 
permitted when necessary to enable another Federal agency to fulfill 
the requirements of a Federal statute or regulation. HCFA has recently 
received several requests from other Federal agencies asking for help 
in coordinating benefits or implementing Federal statutes or 
regulations that involve Medicare and Medicaid beneficiaries. A primary 
purpose of this system of records is to ensure high quality and 
effective use of data on the Medicaid program. We believe that this 
purpose can be better accomplished through coordination of Medicaid 
beneficiary data between and among Federal agencies.
    In addition, administrative updates, such as current language and 
address changes are proposed.

EFFECTIVE DATES: HCFA filed a revised system report with the Chairman 
of the Committee on Government Operations of the House of 
Representatives, the Chairman of the Committee on Governmental Affairs 
of the Senate, and the Administrator, Office of Information and 
Regulatory Affairs, Office of Management and Budget (OMB), on August 4, 
1994. To ensure all parties have adequate time in which to comment, the 
revised system of records, including routine uses, will become 
effective 40 days from the publication of this notice or from the date 
submitted to OMB and the Congress, whichever is later, unless HCFA 
receives comments which require alterations to this notice.

ADDRESSES: The public should address comments to Mr. Richard A. DeMeo, 
HCFA Privacy Act Officer, Office of Customer Relations and 
Communications, HCFA, Room 2-H-4, East Low Rise Building, 6325 Security 
Boulevard, Baltimore, Maryland 21207-5187. Comments received will be 
available at this location.

FOR FURTHER INFORMATION CONTACT:
Mr. Richard Beisel, Director, Division of Medicaid Statistics, Bureau 
of Data Management and Strategy, HCFA, Room 2-A-1, Security Office Park 
Building, 6325 Security Boulevard, Baltimore, Maryland 21207-5187, 
Telephone (410) 597-3902.

SUPPLEMENTARY INFORMATION: We are publishing this notice to inform the 
public of our intent to expand the purpose, add a category of records, 
modify a routine use, add a routine use, and make administrative and 
language updates to the MSIS System of Records. The purpose of the 
system of records is being expanded in order to be more specific, by 
including actuarial forecasting and statistical profiling as distinct 
purposes. HCFA has developed drug data which will be helpful in 
supporting such things as research, policy, effectiveness of care, and 
statistical reporting. These data are being added as a ``Category of 
records in the system.'' Routine Use No. 5, which allows release to 
employees of a State for specific purposes, is being modified by 
adding, ``or for management and/or administration of the Medicaid 
program.'' The new routine use will be numbered (6) and will read as 
follows:
    6. To another Federal agency: (1) To contribute to the accuracy of 
HCFA's proper payment of Medicaid health benefits, and/or (2) to enable 
such agency to administer a Federal health benefits program, or as 
necessary to enable such agency to fulfill a requirement of a Federal 
statute or regulation, if HCFA:
    (a) Determines that the use or disclosure does not violate legal 
limitations under which the data were provided, collected, or obtained;
    (b) Determines that the purpose for which the disclosure is to be 
made cannot reasonably be accomplished unless the data are provided in 
individually identifiable form;
    (c) Requires the recipient to:
    (1) Establish reasonable administrative, technical, and physical 
safeguards to prevent unauthorized use or disclosure of the record;
    (2) Make no further use or disclosure of the record except:
    (a.) In emergency circumstances affecting the health or safety of 
any individual;
    (b.) For use on another project under the same conditions, and with 
written authorization from HCFA; and
    (c.) When required by law;
    (3) Secure a written statement attesting to the recipient's 
understanding of, and willingness to abide by the following provisions:
    (a.) Not to use the data for purposes that are not related to the 
subject project;
    (b.) Not to publish or otherwise disclose the data in a form 
raising unacceptable possibilities that persons could be identified 
(i.e., the data to be published must not be person-specific and must be 
aggregated to a level where no data cells have 10 or fewer persons); 
and
    (c.) Not to publish any aggregation of the data without HCFA's 
approval.
    Because these proposed changes will change the purpose for which 
the information is collected or otherwise significantly alter the 
system, we are preparing a report of altered system of records under 5 
U.S.C. 552a(r). We are publishing the notice in its entirety below for 
the convenience of the reader.

    Dated: July 28, 1994.
Bruce C. Vladeck,
Administrator, Health Care Financing Administration.
09-70-6001
    Medicaid Statistical Information System (MSIS).
    None.
    Health Care Financing Administration, 6325 Security Boulevard, 
Baltimore, Maryland 21207-5187. (Contact system manager for location of 
computerized records.)
    Persons enrolled in Medicaid in participating States.
    Medicaid enrollment records, paid health care claims records, and 
drug data.
    Section 1902(a)(6) of the Social Security Act (42 U.S.C. 
1396a(a)(6)).
    1. To establish an accurate and timely database on the Medicaid 
program for the purpose of Federal administration of the Medicaid 
program by collecting from State programs standardized enrollment and 
paid claims data that will be reported, verified, and maintained on an 
ongoing basis.
    2. To establish a single source of Medicaid data at the Federal 
level for maintaining a single, accurate, and comprehensive Medicaid 
database that can be analyzed to produce statistical reports; to 
support research of important policy, of quality and effectiveness of 
care, and of epidemiological issues; to support actuarial forecasting; 
to support statistical profiling; and to support the detection of 
fraud, abuse, and waste in regard to the Medicaid program.
    3. To eliminate the need for special data collection efforts to 
support special studies.
    4. To reduce the State reporting burden by eliminating redundant 
reporting and the need to prepare complex, time-consuming summary 
information.
    Disclosure may be made:
    1. To a contractor for the purpose of collating, analyzing, 
aggregating, or otherwise refining or processing records in this 
system, or for developing, modifying and/or manipulating it with ADP 
software. Data would also be available to a contractor incidental to 
consultation, programming, operation, user assistance, or maintenance 
for an ADP or telecommunications system containing or supporting 
records in the system.
    2. To the congressional office of an individual, in response to an 
inquiry from that congressional office at the request of the individual 
involved.
    3. To the Department of Justice, to a court or other tribunal, or 
to another party before such tribunal, when
    (a) HHS, or any component thereof; or
    (b) Any HHS employee in his or her official capacity; or
    (c) Any HHS employee in his or her capacity where the Department of 
Justice (or HHS, where it is authorized to do so) has agreed to 
represent the employee; or
    (d) The United States or any agency thereof where HHS determines 
that the litigation is likely to affect HHS or any of its components;

is a party to litigation or has an interest in such litigation, and HHS 
determines that the use of such records by the Department of Justice, 
the tribunal, or the other party is relevant and necessary to the 
litigation and would help in the effective representation of the 
governmental party, provided, however, that in each case, HHS 
determines that such disclosure is compatible with the purpose for 
which the records were collected.
    4. To an individual or organization for a research, evaluation, or 
epidemiological project related to the prevention of disease or 
disability, the restoration or maintenance of health, or the study of 
the costs of providing health care, if HCFA:
    (a) Determines that the use of disclosure does not violate legal 
limitations under which the record was provided, collected, or 
obtained.
    (b) Determines that the purpose for which the disclosure is to be 
made:
    (1) Cannot be reasonably accomplished unless the record is provided 
in individually identifiable form;
    (2) Is of sufficient importance to warrant the effect and/or risk 
on the privacy of the individual that additional exposure of the record 
might bring; and
    (3) There is reasonable probability that the objective for the use 
would be accomplished.
    (c) Requires the information recipient to:
    (1) Establish reasonable administrative, technical, and physical 
safeguards to prevent unauthorized use or disclosure of the record, and 
guards to prevent unauthorized use or disclosure of the record, and
    (2) Remove or destroy the information that allows the individual to 
be identified at the earliest time at which removal or destruction can 
be accomplished consistent with the purpose of the project unless the 
recipient presents an adequate justification of a research or health 
nature for retaining such information, and
    (3) Make no further use or disclosure of the record except:
    a. In emergency circumstances affecting the health or safety of any 
individual;
    b. For use in another research project, under these same 
conditions, and with written authorization of HCFA;
    c. For disclosure to a properly identified person for the purpose 
of an audit related to the research project, if information that would 
enable research subjects to be identified is removed or destroyed at 
the earliest opportunity consistent with the purpose of the audit; or
    d. When required by law.
    (d) Secures a written statement attesting to the information 
recipient's understanding of and willingness to abide by these 
provisions.
    5. To employees of a State government for the purposes of 
investigating potential fraud, abuse, or waste related to the Medicaid 
program, for research relating to the Medicaid program, or for 
management and/or administration of the Medicaid program.
    6. To another Federal agency; (1) to contribute to the accuracy of 
HCFA's proper payment of Medicaid health benefits, and/or (2) to enable 
such agency to administer a Federal health benefits program, or as 
necessary to enable such agency to fulfill a requirement of a Federal 
statute or regulation, if HCFA:
    (a) Determines that the use or disclosure does not violate legal 
limitations under which the data were provided, collected, or obtained;
    (b) Determines that the purpose for which the disclosure is to be 
made cannot reasonably be accomplished unless the data are provided in 
individually identifiable form;
    (c) Requires the recipient to:
    (1) Establish reasonable administrative, technical, and physical 
safeguards to prevent unauthorized use or disclosure of the record;
    (2) Make no further use or disclosure of the record except:
    (a.) In emergency circumstances affecting the health or safety of 
any individual;
    (b.) For use on another project under the same conditions, and with 
written authorization from HCFA; and
    (c.) When required by law;
    (3) Secure a written statement attesting to the recipient's 
understanding of, and willingness to abide by the following provisions:
    (a.) Not to use the data for purposes that are not related to the 
subject project;
    (b.) Not to publish or otherwise disclose the data in a form 
raising unacceptable possibilities that persons could be identified 
(i.e., the data to be published must not be person-specific and must be 
aggregated to a level where no data cells have 10 or fewer persons); 
and
    (c.) Not to publish any aggregation of the data without HCFA's 
approval.
    All records are stored in hard copy and/or on magnetic media
    Records may be retrieved by the MSIS identification number (which 
may be either a State-assigned identifier or a social security number).
    For computerized records, safeguards are established in accordance 
with department standards and National Institute of Standards and 
Technology guidelines (e.g., security codes) will be used, limiting 
access to authorized personnel. System security safeguards are 
established in accordance with HHS, Information Resource Management 
(IRM) Circular #10, Automated Information Systems Security Program; and 
the HCFA Administrative Issuance System (AIS) Guide for Systems 
Security Policies.
    Records are maintained with identifiers as long as needed for 
program research.
    Director, Bureau of Data Management and Strategy, Health Care 
Financing Administration, Room 1-A-11 Security Office Park Building, 
6325 Security Boulevard, Baltimore, Maryland 21207-5187.
    Inquiries and requests for system records should be addressed to 
the system manager at the address above. the requester must specify the 
State, Medicaid Identifier number, date of birth, and/or social 
security number (SSN). Divulgence of the requester's SSN is voluntary, 
unless the requester's record cannot be located without their SSN.
    Same as notification procedures. Individuals in the system should 
also reasonably specify the record contents being sought. (These access 
procedures are in accordance with the Department regulations (45 CFR 
5b.5.).
    Contact the system manager named above, reasonably identify the 
record (provide State, Medicaid identifier number, date of birth, and 
social security number), and specify the information to be contested. 
State the reason for contesting it; e.g., why the information is 
inaccurate, irrelevant, incomplete or not current. (These procedures 
are in accordance with Departmental Regulations (45 CFR 5b.7).)
    HCFA obtains the identifying information in this system from State 
Medicaid Agencies. Almost all information in the proposed system is 
derived from States' Medicaid Management Information Systems. Drug data 
is obtained from the National Drug Data File.
    None.

[FR Doc. 94-19578 Filed 8-10-94; 8:45 am]
BILLING CODE 4120-03-M