[Federal Register Volume 59, Number 154 (Thursday, August 11, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-19578]
[[Page Unknown]]
[Federal Register: August 11, 1994]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Health Care Financing Administration
Privacy Act of 1974; System of Records
AGENCY: Department of Health and Human Services (HHS), Health Care
Financing Administration (HCFA).
ACTION: Notice of proposed expansion of system purpose, addition of a
new category of records in the system, addition of new routine uses,
and administrative update.
-----------------------------------------------------------------------
SUMMARY: HCFA proposes revising the system notice for the ``Medicaid
Statistical Information System (MSIS),'' System No. 09-70-6001, by:
Adding ``drug data'' as a new category of records in the system;
expanding the purpose of the system to include actuarial forecasting
and statistical profiling; modifying a current route use (number 5);
and adding a new route use (number 6) for the release of data without
individuals' consent
HCFA has developed drug data which will be helpful in supporting
such things as research, policy, effectiveness of care, and statistical
reporting. These data are being added to the ``Categories of records in
the system.''
The purpose of the system of records is also being expanded in
order to be more specific, by including actuarial forecasting and
statistical profiling as distinct purposes.
Routine use No. 5 allows release to employees of a State for
specific purposes. The modification would add the language, ``or for
management and/or administration of the Medicaid program.''
The proposed new routine use would permit release of data to other
Federal agencies. This routine use has two purposes. First, disclosure
would be permitted to another Federal agency to enhance the accuracy of
Medicaid's payment of heath benefits. Second, disclosure would be
permitted when necessary to enable another Federal agency to fulfill
the requirements of a Federal statute or regulation. HCFA has recently
received several requests from other Federal agencies asking for help
in coordinating benefits or implementing Federal statutes or
regulations that involve Medicare and Medicaid beneficiaries. A primary
purpose of this system of records is to ensure high quality and
effective use of data on the Medicaid program. We believe that this
purpose can be better accomplished through coordination of Medicaid
beneficiary data between and among Federal agencies.
In addition, administrative updates, such as current language and
address changes are proposed.
EFFECTIVE DATES: HCFA filed a revised system report with the Chairman
of the Committee on Government Operations of the House of
Representatives, the Chairman of the Committee on Governmental Affairs
of the Senate, and the Administrator, Office of Information and
Regulatory Affairs, Office of Management and Budget (OMB), on August 4,
1994. To ensure all parties have adequate time in which to comment, the
revised system of records, including routine uses, will become
effective 40 days from the publication of this notice or from the date
submitted to OMB and the Congress, whichever is later, unless HCFA
receives comments which require alterations to this notice.
ADDRESSES: The public should address comments to Mr. Richard A. DeMeo,
HCFA Privacy Act Officer, Office of Customer Relations and
Communications, HCFA, Room 2-H-4, East Low Rise Building, 6325 Security
Boulevard, Baltimore, Maryland 21207-5187. Comments received will be
available at this location.
FOR FURTHER INFORMATION CONTACT:
Mr. Richard Beisel, Director, Division of Medicaid Statistics, Bureau
of Data Management and Strategy, HCFA, Room 2-A-1, Security Office Park
Building, 6325 Security Boulevard, Baltimore, Maryland 21207-5187,
Telephone (410) 597-3902.
SUPPLEMENTARY INFORMATION: We are publishing this notice to inform the
public of our intent to expand the purpose, add a category of records,
modify a routine use, add a routine use, and make administrative and
language updates to the MSIS System of Records. The purpose of the
system of records is being expanded in order to be more specific, by
including actuarial forecasting and statistical profiling as distinct
purposes. HCFA has developed drug data which will be helpful in
supporting such things as research, policy, effectiveness of care, and
statistical reporting. These data are being added as a ``Category of
records in the system.'' Routine Use No. 5, which allows release to
employees of a State for specific purposes, is being modified by
adding, ``or for management and/or administration of the Medicaid
program.'' The new routine use will be numbered (6) and will read as
follows:
6. To another Federal agency: (1) To contribute to the accuracy of
HCFA's proper payment of Medicaid health benefits, and/or (2) to enable
such agency to administer a Federal health benefits program, or as
necessary to enable such agency to fulfill a requirement of a Federal
statute or regulation, if HCFA:
(a) Determines that the use or disclosure does not violate legal
limitations under which the data were provided, collected, or obtained;
(b) Determines that the purpose for which the disclosure is to be
made cannot reasonably be accomplished unless the data are provided in
individually identifiable form;
(c) Requires the recipient to:
(1) Establish reasonable administrative, technical, and physical
safeguards to prevent unauthorized use or disclosure of the record;
(2) Make no further use or disclosure of the record except:
(a.) In emergency circumstances affecting the health or safety of
any individual;
(b.) For use on another project under the same conditions, and with
written authorization from HCFA; and
(c.) When required by law;
(3) Secure a written statement attesting to the recipient's
understanding of, and willingness to abide by the following provisions:
(a.) Not to use the data for purposes that are not related to the
subject project;
(b.) Not to publish or otherwise disclose the data in a form
raising unacceptable possibilities that persons could be identified
(i.e., the data to be published must not be person-specific and must be
aggregated to a level where no data cells have 10 or fewer persons);
and
(c.) Not to publish any aggregation of the data without HCFA's
approval.
Because these proposed changes will change the purpose for which
the information is collected or otherwise significantly alter the
system, we are preparing a report of altered system of records under 5
U.S.C. 552a(r). We are publishing the notice in its entirety below for
the convenience of the reader.
Dated: July 28, 1994.
Bruce C. Vladeck,
Administrator, Health Care Financing Administration.
09-70-6001
Medicaid Statistical Information System (MSIS).
None.
Health Care Financing Administration, 6325 Security Boulevard,
Baltimore, Maryland 21207-5187. (Contact system manager for location of
computerized records.)
Persons enrolled in Medicaid in participating States.
Medicaid enrollment records, paid health care claims records, and
drug data.
Section 1902(a)(6) of the Social Security Act (42 U.S.C.
1396a(a)(6)).
1. To establish an accurate and timely database on the Medicaid
program for the purpose of Federal administration of the Medicaid
program by collecting from State programs standardized enrollment and
paid claims data that will be reported, verified, and maintained on an
ongoing basis.
2. To establish a single source of Medicaid data at the Federal
level for maintaining a single, accurate, and comprehensive Medicaid
database that can be analyzed to produce statistical reports; to
support research of important policy, of quality and effectiveness of
care, and of epidemiological issues; to support actuarial forecasting;
to support statistical profiling; and to support the detection of
fraud, abuse, and waste in regard to the Medicaid program.
3. To eliminate the need for special data collection efforts to
support special studies.
4. To reduce the State reporting burden by eliminating redundant
reporting and the need to prepare complex, time-consuming summary
information.
Disclosure may be made:
1. To a contractor for the purpose of collating, analyzing,
aggregating, or otherwise refining or processing records in this
system, or for developing, modifying and/or manipulating it with ADP
software. Data would also be available to a contractor incidental to
consultation, programming, operation, user assistance, or maintenance
for an ADP or telecommunications system containing or supporting
records in the system.
2. To the congressional office of an individual, in response to an
inquiry from that congressional office at the request of the individual
involved.
3. To the Department of Justice, to a court or other tribunal, or
to another party before such tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her capacity where the Department of
Justice (or HHS, where it is authorized to do so) has agreed to
represent the employee; or
(d) The United States or any agency thereof where HHS determines
that the litigation is likely to affect HHS or any of its components;
is a party to litigation or has an interest in such litigation, and HHS
determines that the use of such records by the Department of Justice,
the tribunal, or the other party is relevant and necessary to the
litigation and would help in the effective representation of the
governmental party, provided, however, that in each case, HHS
determines that such disclosure is compatible with the purpose for
which the records were collected.
4. To an individual or organization for a research, evaluation, or
epidemiological project related to the prevention of disease or
disability, the restoration or maintenance of health, or the study of
the costs of providing health care, if HCFA:
(a) Determines that the use of disclosure does not violate legal
limitations under which the record was provided, collected, or
obtained.
(b) Determines that the purpose for which the disclosure is to be
made:
(1) Cannot be reasonably accomplished unless the record is provided
in individually identifiable form;
(2) Is of sufficient importance to warrant the effect and/or risk
on the privacy of the individual that additional exposure of the record
might bring; and
(3) There is reasonable probability that the objective for the use
would be accomplished.
(c) Requires the information recipient to:
(1) Establish reasonable administrative, technical, and physical
safeguards to prevent unauthorized use or disclosure of the record, and
guards to prevent unauthorized use or disclosure of the record, and
(2) Remove or destroy the information that allows the individual to
be identified at the earliest time at which removal or destruction can
be accomplished consistent with the purpose of the project unless the
recipient presents an adequate justification of a research or health
nature for retaining such information, and
(3) Make no further use or disclosure of the record except:
a. In emergency circumstances affecting the health or safety of any
individual;
b. For use in another research project, under these same
conditions, and with written authorization of HCFA;
c. For disclosure to a properly identified person for the purpose
of an audit related to the research project, if information that would
enable research subjects to be identified is removed or destroyed at
the earliest opportunity consistent with the purpose of the audit; or
d. When required by law.
(d) Secures a written statement attesting to the information
recipient's understanding of and willingness to abide by these
provisions.
5. To employees of a State government for the purposes of
investigating potential fraud, abuse, or waste related to the Medicaid
program, for research relating to the Medicaid program, or for
management and/or administration of the Medicaid program.
6. To another Federal agency; (1) to contribute to the accuracy of
HCFA's proper payment of Medicaid health benefits, and/or (2) to enable
such agency to administer a Federal health benefits program, or as
necessary to enable such agency to fulfill a requirement of a Federal
statute or regulation, if HCFA:
(a) Determines that the use or disclosure does not violate legal
limitations under which the data were provided, collected, or obtained;
(b) Determines that the purpose for which the disclosure is to be
made cannot reasonably be accomplished unless the data are provided in
individually identifiable form;
(c) Requires the recipient to:
(1) Establish reasonable administrative, technical, and physical
safeguards to prevent unauthorized use or disclosure of the record;
(2) Make no further use or disclosure of the record except:
(a.) In emergency circumstances affecting the health or safety of
any individual;
(b.) For use on another project under the same conditions, and with
written authorization from HCFA; and
(c.) When required by law;
(3) Secure a written statement attesting to the recipient's
understanding of, and willingness to abide by the following provisions:
(a.) Not to use the data for purposes that are not related to the
subject project;
(b.) Not to publish or otherwise disclose the data in a form
raising unacceptable possibilities that persons could be identified
(i.e., the data to be published must not be person-specific and must be
aggregated to a level where no data cells have 10 or fewer persons);
and
(c.) Not to publish any aggregation of the data without HCFA's
approval.
All records are stored in hard copy and/or on magnetic media
Records may be retrieved by the MSIS identification number (which
may be either a State-assigned identifier or a social security number).
For computerized records, safeguards are established in accordance
with department standards and National Institute of Standards and
Technology guidelines (e.g., security codes) will be used, limiting
access to authorized personnel. System security safeguards are
established in accordance with HHS, Information Resource Management
(IRM) Circular #10, Automated Information Systems Security Program; and
the HCFA Administrative Issuance System (AIS) Guide for Systems
Security Policies.
Records are maintained with identifiers as long as needed for
program research.
Director, Bureau of Data Management and Strategy, Health Care
Financing Administration, Room 1-A-11 Security Office Park Building,
6325 Security Boulevard, Baltimore, Maryland 21207-5187.
Inquiries and requests for system records should be addressed to
the system manager at the address above. the requester must specify the
State, Medicaid Identifier number, date of birth, and/or social
security number (SSN). Divulgence of the requester's SSN is voluntary,
unless the requester's record cannot be located without their SSN.
Same as notification procedures. Individuals in the system should
also reasonably specify the record contents being sought. (These access
procedures are in accordance with the Department regulations (45 CFR
5b.5.).
Contact the system manager named above, reasonably identify the
record (provide State, Medicaid identifier number, date of birth, and
social security number), and specify the information to be contested.
State the reason for contesting it; e.g., why the information is
inaccurate, irrelevant, incomplete or not current. (These procedures
are in accordance with Departmental Regulations (45 CFR 5b.7).)
HCFA obtains the identifying information in this system from State
Medicaid Agencies. Almost all information in the proposed system is
derived from States' Medicaid Management Information Systems. Drug data
is obtained from the National Drug Data File.
None.
[FR Doc. 94-19578 Filed 8-10-94; 8:45 am]
BILLING CODE 4120-03-M