[Federal Register Volume 69, Number 241 (Thursday, December 16, 2004)]
[Notices]
[Pages 75323-75329]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 04-27530]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Report of Modified or Altered System

AGENCY: Department of Health and Human Services (HHS) Centers for 
Medicare & Medicaid Services (CMS).

ACTION: Notice of modified or altered system of records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to modify or alter an SOR, ``Medicare Hearings 
and Appeals System (MHAS), System No. 09-70-5001.'' We propose to 
broaden the scope of this system to support additional levels of claim 
determination appeals administered by CMS pursuant to Title XVIII of 
the Social Security Act (the Act). We propose to change the name of the 
system from MHAS to the ``Medicare Appeals System'' (MAS) to more 
closely reflect the new and broadened scope of activities that will 
become a part of this system. We propose to further broaden the scope 
of this system with the inclusions of support for appeals processes for 
both the Medicare Fee-for-Service (FFS) appeals at the Qualified 
Independent Contractors (QIC) and Medicare Advantage appeals at the 
Independent Review Entity (IRE) Second Level Appeal. As an orderly 
timetable will permit, CMS will explore the possibility of extending 
the scope of MAS to include all five appeal levels:
    Affiliated Contractors (Carriers and Fiscal Intermediaries) and 
Medicare Advantage Organizations (MAO)--the First Level Appeal; QIC and 
IRE--the Second Level Appeal; ALJ Hearing--the Third Level Appeal; 
Medicare Departmental Appeals Board (DAB) Hearing--the Fourth Level 
Appeal; and Federal District Court Judicial Review--the Fifth Level 
Appeal.
    In the interim, before deployment of the MAS, CMS has developed a 
mid-tier, client server-based system known as the Medicare Case 
Tracking System (MCATS). MCATS will be utilized if the MAS is not 
available to collect and track appeals data, including status, 
timelines, and decision data. It has the capability to provide summary 
reports for data analysis, and will comply with applicable security and 
privacy rules, regulations, and policies.
    We propose to broaden the scope of activities covered by this 
system with the inclusion of related activities presented in the 2 
published CMS systems identified below: (1) ``Reconsideration and 
Hearing Case Files (Part A)--Hospital Insurance Program,'' System No. 
09-70-0508 (published 47 FR 45725 (Oct. 13, 1982)), and (2) ``Review 
and Fair Hearing Case Files (Part B)--Supplementary Medical Insurance 
Program,'' System No. 09-70-0512 (47 FR 45727 (Oct. 13, 1982)). These 2 
systems will be discontinued with the completion of this proposed

[[Page 75324]]

modification to MAS since they will duplicate many of the same 
functions.
    We propose to delete published routine use number 4 authorizing 
disclosure to the Department of Justice (DOJ), and an unnumbered 
routine use authorizing disclosure to SSA. Access to the data for these 
activities will be accomplished by the addition of a new routine use 
authorizing release of information in this system to ``another Federal 
agency.'' In addition, we propose to add a new routine use for QIO to 
ensure that payment is only made for medically necessary services and 
to investigate beneficiary complaints about quality of care. We will 
also add 2 new routine uses to combat fraud and abuse in certain health 
care programs.
    The security classification previously reported as ``None'' will be 
modified to reflect that the data in this system is considered to be 
``Level Three Privacy Act Sensitive.'' We are modifying the language in 
the remaining routine uses to provide an easy to read format and to 
increase uniformity where appropriate to CMS's intention to disclose 
individual-specific information contained in this system. The routine 
uses will then be prioritized and reordered according to their usage. 
We will also take the opportunity to update any sections of the system 
that were affected by the recent reorganization and to update language 
in the administrative sections to correspond with language used in 
other CMS SORs.
    The primary purposes of the system is to collect and maintain 
information necessary to: (1) Process the initial, organization, and 
reconsidered determination requests, ``Request For Hearing or Appeal,'' 
made by an appellant or appealing party, as required for the review of 
determinations by FFS and MAOs; (2) track appeal data, including 
status, timeliness, and decisions; and (3) reply to future 
correspondence related to the case. Information in this system will 
also be disclosed to: support regulatory and policy functions performed 
within the Agency or by a contractor or consultant; assist another 
Federal agency; assist QIO; support constituent requests made to a 
congressional representative; support litigation involving the agency 
related to this SOR; and, combat fraud and abuse in certain health 
benefits programs. We have provided background information about the 
modified system in the Supplementary Information section below. 
Although the Privacy Act requires only that CMS provide an opportunity 
for interested persons to comment on the proposed routine uses, CMS 
invites comments on all portions of this notice. See Effective Dates 
section for comment period.

DATES: Effective Dates: CMS filed a modified or altered system report 
with the Chair of the House Committee on Government Reform and 
Oversight, the Chair of the Senate Committee on Governmental Affairs, 
and the Administrator, Office of Information and Regulatory Affairs, 
Office of Management and Budget (OMB) on October 1, 2004. To ensure 
that all parties have adequate time in which to comment, the modified 
or altered SOR, including routine uses, will become effective 30 days 
from the publication of the notice, or 40 days from the date it was 
submitted to OMB and the congress, whichever is later, unless CMS 
receives comments that require alterations to this notice.

ADDRESSES: The public should address comments to: Director, Division of 
Privacy Compliance Data Development, Enterprises Databases Group, 
Office of Information Services, CMS, Mail Stop N2-04-27, 7500 Security 
Boulevard, Baltimore, Maryland 21244-1850. Comments received will be 
available for review at this location, by appointment, during regular 
business hours, Monday through Friday from 9 a.m.-3 p.m., eastern 
daylight time.

FOR FURTHER INFORMATION CONTACT: Michael Crochunis, Director, Division 
of Appeals Operations, Health Plan Policy Group, Center for Beneficiary 
Choices, CMS, Room S1-05-06, 7500 Security Boulevard, Baltimore, 
Maryland 21244-1850. The telephone number is 410-786-3203.

SUPPLEMENTARY INFORMATION:

I. Description of the Modified System

Statutory and Regulatory Basis for SOR

    In 1987, CMS established this SOR under the authority of sections 
205, 1155, 1156, 1869, and 1872 of the Act. Notice of this system, 
``Medicare Hearings and Appeals Systems (MHAS), System No. 09-70-
5001,'' was published at 52 FR 34846 (Sept. 15, 1987), and an 
unnumbered routine use for disclosure to SSA was added at 61 FR 6645 
(Feb. 21, 1996). Additional authority for the maintenance of this 
system is given under of sections 205 of Title II, sections 1155 and 
1156 of Title XI, sections 1812, 1814, 1816, 1842, 1869, and 1872 of 
Title XVIII of the Act, as amended (42 United States Code (U.S.C.) 
sections 405, 1320c-4, 1320c-5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 
1395ii).

II. Collection and Maintenance of Data in the System

A. Scope of the Data Collected

    The system contains information concerning Medicare beneficiaries, 
physicians, providers, and other persons involved in furnishing 
services to health insurance beneficiaries. Information on 
beneficiaries consist of name, address, social security numbers (SSN), 
health insurance claims numbers (HICN), medical services, equipment and 
supplies for which Medicare reimbursement is requested, and materials 
used to determine amount of benefits allowable under Medicare. 
Information on appellants, physicians, and other persons consist of 
name, work address, work phone number, an assigned provider 
identification number, specialty, medical services for which Medicare 
reimbursement is requested, and materials used to determine amounts of 
benefits allowable under Medicare.

B. Agency Policies, Procedures, and Restrictions on the Routine Uses

    The Privacy Act permits us to disclose information without an 
individual's consent if the information is to be used for a purpose 
that is compatible with the purpose(s) for which the information was 
collected. Any such disclosure of data is known as a ``routine use.'' 
The government will only release MAS information that can be associated 
with an individual as provided for under ``Section III. Proposed 
Routine Use Disclosures of Data in the System.'' Both identifiable and 
non-identifiable data may be disclosed under a routine use.
    We will only collect the minimum personal data necessary to achieve 
the purpose of MAS. CMS has the following policies and procedures 
concerning disclosures of information that will be maintained in the 
system. Disclosure of information from the SOR will be approved only 
for the minimum information necessary to accomplish the purpose of the 
disclosure only after CMS:
    1. Determines that the use or disclosure is consistent with the 
reason that the data is being collected, e.g., collecting and 
maintaining information used in processing the appellant's hearing or 
appeal, to track a particular case, and information necessary to reply 
to future correspondence.
    2. Determines that:
    a. The purpose for which the disclosure is to be made can only be 
accomplished if the record is provided in individually identifiable 
form;
    b. The purpose for which the disclosure is to be made is of 
sufficient

[[Page 75325]]

importance to warrant the effect and/or risk on the privacy of the 
individual that additional exposure of the record might bring; and
    c. There is a strong probability that the proposed use of the data 
would in fact accomplish the stated purpose (s).
    3. Requires the information recipient to:
    a. Establish administrative, technical, and physical safeguards to 
prevent unauthorized use of disclosure of the record;
    b. Remove or destroy at the earliest, legally permissible-time all 
individually-identifiable information; and
    c. Agree to not use or disclose the information for any purpose 
other than the stated purpose under which the information was 
disclosed.
    4. Determines that the data are valid and reliable.

III. Proposed Routine Use Disclosures of Data in the System

A. Entities Who May Receive Disclosures Under Routine Use

    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the MAS without the consent of the individual 
to whom such information pertains. Each proposed disclosure of 
information under these routine uses will be evaluated to ensure that 
the disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected. We are proposing to 
establish or modify the following routine use disclosures of 
information maintained in the system:
    1. To support agency contractors, or consultants who have been 
engaged by the agency to assist in accomplishment of a CMS function 
relating to the purposes for this SOR and who need to have access to 
the records in order to assist CMS.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contractual or similar 
agreement with a third party to assist in accomplishing a CMS function 
relating to purposes for this SOR.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor or consultant all information that is 
necessary for the contractor or consultant to fulfill its duties. In 
these situations, safeguards are provided in the contract prohibiting 
the contractor or consultant from using or disclosing the information 
for any purpose other than that described in the contract and requires 
the contractor or consultant to return or destroy all information at 
the completion of the contract.
    2. To assist another Federal agency in the accomplishment of a CMS 
function relating to the purposes for this SOR and who need to have 
access to the records in order to support CMS.
    DOJ may require MAS data to assist them in investigating and 
prosecuting violations of the Act to which criminal penalties attach, 
or other criminal statutes as they pertain to certain programs 
authorized by the Act, and for representing the Secretary of the 
Department of Health and Human Services.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contractual or similar 
agreement with another Federal agency to assist in accomplishing CMS 
functions relating to purposes for this SOR.
    3. To assist Quality Improvement Organizations in connection with 
review of claims, or in connection with studies or other review 
activities, conducted pursuant to Part B of Title XI of the Act and in 
performing affirmative outreach activities to individuals for the 
purpose of establishing and maintaining their entitlement to Medicare 
benefits or health insurance plans.
    QIOs will work to implement quality improvement programs, provide 
consultation to CMS, its contractors, and to ensure that payment is 
only made for medically necessary services. QIOs will assist in related 
monitoring and enforcement efforts, assist CMS and intermediaries in 
program integrity assessment, investigate beneficiary complaints about 
quality of care, and prepare summary information for release to CMS.
    4. To support a Member of Congress or to a congressional staff 
member in response to an inquiry of the congressional office made at 
the written request of the constituent about whom the record is 
maintained.
    Individuals sometimes request the help of a Member of Congress in 
resolving some issue relating to a matter before CMS. The Member of 
Congress then writes CMS, and CMS must be able to give sufficient 
information to be responsive to the inquiry.
    5. To support the Department of Justice (DOJ), court or 
adjudicatory body when
    a. The agency or any component thereof, or
    b. Any employee of the agency in his or her official capacity, or
    c. Any employee of the agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    d. The United States Government is a party to litigation or has an 
interest in such litigation, and by careful review, CMS determines that 
the records are both relevant and necessary to the litigation.
    Whenever CMS is involved in litigation, or occasionally when 
another party is involved in litigation and CMS's policies or 
operations could be affected by the outcome of the litigation, CMS 
would be able to disclose information to the DOJ, court or adjudicatory 
body involved.
    6. To support a CMS contractor (including, but not limited to 
fiscal intermediaries and carriers) that assists in the administration 
of a CMS-administered health benefits program, or to a grantee of a 
CMS-administered grant program, when disclosure is deemed reasonably 
necessary by CMS to prevent, deter, discover, detect, investigate, 
examine, prosecute, sue with respect to, defend against, correct, 
remedy, or otherwise combat fraud or abuse in such program.
    We contemplate disclosing information under this routine use only 
in situations in which CMS may enter into a contract or grant with a 
third party to assist in accomplishing CMS functions relating to the 
purpose of combating fraud and abuse.
    CMS occasionally contracts out certain of its functions when doing 
so would contribute to effective and efficient operations. CMS must be 
able to give a contractor or grantee whatever information is necessary 
for the contractor or grantee to fulfill its duties. In these 
situations, safeguards are provided in the contract prohibiting the 
contractor or grantee from using or disclosing the information for any 
purpose other than that described in the contract and requiring the 
contractor or grantee to return or destroy all information.
    7. To support another Federal agency or to an instrumentality of 
any governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that 
administers, or that has the authority to investigate potential fraud 
or abuse in, a health benefits program funded in whole or in part by 
Federal funds, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct,

[[Page 75326]]

remedy, or otherwise combat fraud or abuse in such programs.
    Other agencies may require MAS information for the purpose of 
combating fraud and abuse in such Federally funded programs.

B. Additional Circumstances Affecting Routine Use Disclosures

    This system contains Protected Health Information as defined by HHS 
regulation ``Standards for Privacy of Individually Identifiable Health 
Information'' (45 CFR Parts 160 and 164, 65 FR 82462 (12-28-00), 
Subparts A and E. Disclosures of Protected Health Information 
authorized by these routine uses may only be made if, and as, permitted 
or required by the ``Standards for Privacy of Individually Identifiable 
Health Information.''
    In addition, our policy will be to prohibit release even of data 
not directly identifiable, except pursuant to one of the routine uses 
or if required by law, if we determine there is a possibility that an 
individual can be identified through implicit deduction based on data 
where the patient population is so small that individuals who are 
familiar with the enrollees could, because of the small size, use this 
information to deduce the identity of the beneficiary.

IV. Safeguards

    CMS has safeguards in place for authorized users and monitors such 
users to ensure against excessive or unauthorized use. Personnel having 
access to the system have been trained in the Privacy Act and 
information security requirements. Employees who maintain records in 
this system are instructed not to release data until the intended 
recipient agrees to implement appropriate management, operational and 
technical safeguards sufficient to protect the confidentiality, 
integrity and availability of the information and information systems 
and to prevent unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: the Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the Health Insurance Portability and 
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
Of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also applies. Federal, HHS, and CMS policies and 
standards include but are not limited to: All pertinent NIST 
publications; the HHS Automated Information Systems Security Handbook 
and the CMS Information Security Handbook.

V. Effect of the Modified System on Individual Rights

    CMS proposes to establish this system in accordance with the 
principles and requirements of the Privacy Act and will collect, use, 
and disseminate information only as prescribed therein. We will only 
disclose the minimum personal data necessary to achieve the purpose of 
MAS. Disclosure of information from the SOR will be approved only to 
the extent necessary to accomplish the purpose of the disclosure. CMS 
has assigned a higher level of security clearance for the information 
in this system to provide added security and protection of data in this 
system.
    CMS will take precautionary measures to minimize the risks of 
unauthorized access to the records and the potential harm to individual 
privacy or other personal or property rights. CMS will collect only 
that information necessary to perform the system's functions. In 
addition, CMS will make disclosure from the proposed system only with 
consent of the subject individual, or his/her legal representative, or 
in accordance with an applicable exception provision of the Privacy 
Act.
    CMS, therefore, does not anticipate an unfavorable effect on 
individual privacy as a result of the disclosure of information 
relating to individuals.

    Dated: October 1, 2004.
Mark B. McClellan,
Administrator, Centers for Medicare & Medicaid Services.
System No. 09-70-5001

System Name:
    ``Medicare Appeals System (MAS),'' HHS/CMS/CBC.

Security Classification:
    Level Three Privacy Act Sensitive.

System Location:
    CMS Data Center, 7500 Security Boulevard, North Building, First 
Floor, Baltimore, Maryland 21244-1850. This system is also located in 
locations listed in appendix A.

Categories of Individuals Covered By the System:
    The system contains information concerning Medicare beneficiaries, 
and physicians and other persons involved in furnishing services to 
health insurance beneficiaries.

Categories of Records in the System:
    Information contained in this system include beneficiary's name, 
address, social security number (SSN), health insurance claims number 
(HICN), medical services, equipment, and supplies for which Medicare 
reimbursement is requested, and materials used to determine amount of 
benefits allowable under Medicare. Information on physicians and other 
persons consists of name, work address, work phone number, an assigned 
provider identification number, specialty, medical services for which 
Medicare reimbursement is requested, materials used to determine 
amounts of benefits allowable under Medicare.

Authority for Maintenance of the System:
    Authority for the maintenance of this SOR is given under section 
205 of Title II, sections 1155 and 1156 of Title XI, sections 1812, 
1814, 1816, 1842, 1869, and 1872 of Title XVIII of the Social Security 
Act (the Act), as amended (42 United States Code (U.S.C.) sections 405, 
1320c-4, 1320c-5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 1395ii).

Purpose(s) of the System:
    The primary purpose of the system is to collect and maintain 
information necessary to: (1) Process the initial, organization, and 
reconsidered determination requests, ``Request For Hearing or Appeal,'' 
made by an appellant or appealing party, as required for the review of 
determinations by Fee-for-Service and Medicare Advantage Organizations; 
(2) track appeal data, including status, timeliness, and decisions; and 
(3) reply to future correspondence related to the case. Information in 
this system will also be disclosed to: support regulatory and policy 
functions performed within the Agency or by a contractor or consultant; 
assist another Federal agency; assist QIO; support constituent requests 
made to a congressional representative; support litigation involving 
the agency related to this SOR; and, combat fraud and abuse in certain 
health benefits programs.

[[Page 75327]]

Routine Uses of Records Maintained in the System, Including Categories 
or Users and the Purposes of Such Uses
A. Entities Who May Receive Disclosures Under Routine Use
    These routine uses specify circumstances, in addition to those 
provided by statute in the Privacy Act of 1974, under which CMS may 
release information from the MAS without the consent of the individual 
to whom such information pertains. Each proposed disclosure of 
information under these routine uses will be evaluated to ensure that 
the disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected. We are proposing to 
establish or modify the following routine use disclosures of 
information maintained in the system:
    1. To support Agency contractors, or consultants who have been 
engaged by the Agency to assist in accomplishment of a CMS function 
relating to the purposes for this SOR and who need to have access to 
the records in order to assist CMS.
    2. To assist another Federal agency in the accomplishment of a CMS 
function relating to the purposes for this SOR and who need to have 
access to the records in order to support CMS.
    3. To assist Quality Improvement Organizations in connection with 
review of claims, or in connection with studies or other review 
activities, conducted pursuant to Part B of Title XI of the Act and in 
performing affirmative outreach activities to individuals for the 
purpose of establishing and maintaining their entitlement to Medicare 
benefits or health insurance plans.
    4. To assist a Member of Congress or to a congressional staff 
member in response to an inquiry of the congressional office made at 
the written request of the constituent about whom the record is 
maintained.
    5. To assist the Department of Justice (DOJ), court or adjudicatory 
body when:
    a. The Agency or any component thereof, or
    b. Any employee of the Agency in his or her official capacity, or
    c. Any employee of the Agency in his or her individual capacity 
where the DOJ has agreed to represent the employee, or
    d. The United States Government is a party to litigation or has an 
interest in such litigation, and by careful review, CMS determines that 
the records are both relevant and necessary to the litigation.
    6. To assist a CMS contractor (including, but not limited to fiscal 
intermediaries and carriers) that assists in the administration of a 
CMS-administered health benefits program, or to a grantee of a CMS-
administered grant program, when disclosure is deemed reasonably 
necessary by CMS to prevent, deter, discover, detect, investigate, 
examine, prosecute, sue with respect to, defend against, correct, 
remedy, or otherwise combat fraud or abuse in such program.
    7. To assist another Federal agency or to an instrumentality of any 
governmental jurisdiction within or under the control of the United 
States (including any state or local governmental agency), that 
administers, or that has the authority to investigate potential fraud 
or abuse in, a health benefits program funded in whole or in part by 
Federal funds, when disclosure is deemed reasonably necessary by CMS to 
prevent, deter, discover, detect, investigate, examine, prosecute, sue 
with respect to, defend against, correct, remedy, or otherwise combat 
fraud or abuse in such programs.

B. Additional Circumstances Affecting Routine Use Disclosures
    This system contains Protected Health Information as defined by HHS 
regulation ``Standards for Privacy of Individually Identifiable Health 
Information'' (45 CFR Parts 160 and 164, 65 FR 82462 (12-28-00)), 
Subparts A and E. Disclosures of Protected Health Information 
authorized by these routine uses may only be made if, and as, permitted 
or required by the ``Standards for Privacy of Individually Identifiable 
Health Information.''
    In addition, our policy will be to prohibit release even of data 
not directly identifiable, except pursuant to one of the routine uses 
or if required by law, if we determine there is a possibility that an 
individual can be identified through implicit deduction based on data 
where the patient population is so small that individuals who are 
familiar with the enrollees could, because of the small size, use this 
information to deduce the identity of the beneficiary.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
Storage:
    Computer diskette and on magnetic storage media.

Retrievability:
    Information can be retrieved by the name, SSN, HICN, and assigned 
provider number.

Safeguards:
    CMS has safeguards in place for authorized users and monitors such 
users to ensure against excessive or unauthorized use. Personnel having 
access to the system have been trained in the Privacy Act and 
information security requirements. Employees who maintain records in 
this system are instructed not to release data until the intended 
recipient agrees to implement appropriate management, operational and 
technical safeguards sufficient to protect the confidentiality, 
integrity and availability of the information and information systems 
and to prevent unauthorized access.
    This system will conform to all applicable Federal laws and 
regulations and Federal, HHS, and CMS policies and standards as they 
relate to information security and data privacy. These laws and 
regulations include but are not limited to: the Privacy Act of 1974; 
the Federal Information Security Management Act of 2002; the Computer 
Fraud and Abuse Act of 1986; the Health Insurance Portability and 
Accountability Act of 1996; the E-Government Act of 2002, the Clinger-
Cohen Act of 1996; the Medicare Modernization Act of 2003, and the 
corresponding implementing regulations. OMB Circular A-130, Management 
Of Federal Resources, Appendix III, Security of Federal Automated 
Information Resources also applies. Federal, HHS, and CMS policies and 
standards include but are not limited to: all pertinent NIST 
publications; the HHS Automated Information Systems Security Handbook 
and the CMS Information Security Handbook.

Retention and Disposal:
    Records are maintained in a secure storage area with identifiers. 
Disposal occurs ten years after the final determination of the case is 
completed.

System Manager and Address:
    Director, Division of Appeals Operations, Health Plan Policy Group, 
Center for Beneficiary Choices, CMS, Room S1-05-06, 7500 Security 
Boulevard, Baltimore, Maryland 21244-1850.

Notification Procedure:
    For purpose of access, the subject individual should write to the 
system manager who will require the system name, HICN, address, date of 
birth, and sex, and for verification purposes, the subject individual's 
name (woman's maiden name, if applicable), social security number 
(SSN). Furnishing the SSN is voluntary, but it may make searching for a 
record easier and prevent delay.

[[Page 75328]]

Record Access Procedure:
    For purpose of access, use the same procedures outlined in 
Notification Procedures above. Requestors should also reasonably 
specify the record contents being sought. (These procedures are in 
accordance with Department regulation 45 CFR 5b.5(a)(2)).

Contesting Record Procedures:
    The subject individual should contact the system manager named 
above, and reasonably identify the record and specify the information 
to be contested. State the corrective action sought and the reasons for 
the correction with supporting justification. (These procedures are in 
accordance with Department regulation 45 CFR 5b.7).

Record Source Categories:
    Sources of information contained in this records system include 
data collected from the individual on the completed form requesting a 
Medicare hearing or appeal. In addition, information contained in this 
SOR may be obtained from Medicare carriers or intermediaries and 
Quality Improvement Organizations records.

Systems Exempted From Certain Provisions of the Act:
    None.

Appendix A. Health Insurance Claims

    Medicare records are maintained at the CMS Central Office (see 
section 1 below for the address). Health Insurance Records of the 
Medicare program can also be accessed through a representative of 
the CMS Regional Office (see section 2 below for addresses). 
Medicare claims records are also maintained by private insurance 
organizations that share in administering provisions of the health 
insurance programs. These private insurance organizations, referred 
to as carriers and intermediaries, are under contract to the Centers 
for Medicare & Medicaid Services to perform specific task in the 
Medicare program (see section three below for addresses for 
intermediaries, section four addresses the carriers, and section 
five addresses the Payment Safeguard Contractors.

1. Central Office Address

    CMS Data Center, 7500 Security Boulevard, North Building, First 
Floor, Baltimore, Maryland 21244-1850.

2. CMS Regional Offices

     BOSTON REGION--Connecticut, Maine, Massachusetts, New 
Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, 
Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 
p.m.
     NEW YORK REGION--New Jersey, New York, Puerto Rico, 
Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 
10007, Office Hours: 8:30 a.m.-5 p.m.
     PHILADELPHIA REGION--Delaware, District of Columbia, 
Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 
8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 
p.m.
     ATLANTA REGION--Alabama, North Carolina, South 
Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 
Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 
8:30 a.m.-4:30 p.m.
     CHICAGO REGION--Illinois, Indiana, Michigan, Minnesota, 
Ohio, Wisconsin. Suite A--824, Chicago, Illinois 60604. Office 
Hours: 8 a.m.-4:45 p.m.
     DALLAS REGION--Arkansas, Louisiana, New Mexico, 
Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office 
Hours: 8 a.m.-4:30 p.m.
     KANSAS CITY REGION--Iowa, Kansas, Missouri, Nebraska. 
New Federal Office Building, 601 East 12th Street--Room 436, Kansas 
City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
     DENVER REGION--Colorado, Montana, North Dakota, South 
Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St--Room 
1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
     SAN FRANCISCO REGION--American Samoa, Arizona, 
California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van 
Ness Avenue, 20th Floor, San Francisco, California 94102. Office 
Hours: 8 a.m.-4:30 p.m.
     SEATTLE REGION--Alaska, Idaho, Oregon, Washington. 1321 
Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. 
Office Hours: 8 a.m.-4:30 p.m.

3. Intermediary Addresses (Hospital Insurance)

     Medicare Coordinator, Assoc. Hospital Serv. Maine (ME 
BC), 2 Gannett Drive South Portland, ME 04106-6911.
     Medicare Coordinator, Anthem New Hampshire, 300 Goffs 
Falls Road, Manchester, NH 03111-0001.
     Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 
Westminster Street, Providence, RI 02903-3279.
     Medicare Coordinator, Empire Medicare Services, 400 S. 
Salina Street, Syracuse, NY 13202.
     Medicare Coordinator, Cooperativa, P.O. Box 363428, San 
Juan, PR 00936-3428.
     Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 
Greenspring Ave., Timonium, MD 21093.
     Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue 
Place, Pittsburgh, PA 15222-3099.
     Medicare Coordinator, United Government Services, 1515 
N. Rivercenter Dr., Milwaukee, WI 53212.
     Medicare Coordinator, Alabama B/C, 450 Riverchase 
Parkway East, Birmingham, AL 35298.
     Medicare Coordinator, Florida B/C, 532 Riverside Ave., 
Jacksonville, FL 32202-4918.
     Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 
Warm Springs Road, Columbus, GA 31908.
     Medicare Coordinator, Mississippi B/C B MS, P.O. Box 
23035, 3545 Lakeland Drive, Jackson, MI 9225-3035.
     Medicare Coordinator, North Carolina B/C, P.O. Box 
2291, Durham, NC 27702-2291.
     Medicare Coordinator, Palmetto GBA A/RHHI, 17 
Technology Circle, Columbia, SC 29203-0001.
     Medicare Coordinator, Tennessee B/C, 801 Pine Street, 
Chattanooga, TN 37402-2555.
     Medicare Coordinator, Anthem Insurance Co. (Anthm IN), 
P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
     Medicare Coordinator, Arkansas B/C, 601 Gaines Street, 
Little Rock, AR 72203.
     Medicare Coordinator, Group Health of Oklahoma, 1215 
South Boulder, Tulsa, OK 74119-2827.
     Medicare Coordinator, TrailBlazer, P.O. Box 660156, 
Dallas, TX 75266-0156.
     Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand 
Avenue, Des Moines, IA 50309-2551.
     Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 
Topeka Ave., Topeka, KS 66629-0001.
     Medicare Coordinator, Nebraska B/C, P.O. Box 3248, Main 
PO Station, Omaha, NE 68180-0001.
     Medicare Coordinator, Mutual of Omaha, P.O. Box 1602, 
Omaha, NE 68101.
     Medicare Coordinator, Montana B/C, P.O. Box 5017, Great 
Falls Div., Great Falls, MT 59403-5017.
     Medicare Coordinator, Noridian, 4510 13th Avenue S.W., 
Fargo, ND 58121-0001.
     Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 
Parleys Way, Salt Lake City, UT 84130-0270.
     Medicare Coordinator, Wyoming B/C, 4000 House Avenue, 
Cheyenne, WY 82003.
     Medicare Coordinator, Arizona B/C, P.O. Box 37700, 
Phoenix, AZ 85069.
     Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 
91470-0000.
     Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-
4A, Portland, OR 97207-8110.
     Medicare Coordinator, Premera BC, P.O. Box 2847, 
Seattle, WA 98111-2847.

4. Medicare Carriers

     Medicare Coordinator, NHIC, 75 Sargent William Terry 
Drive, Hingham, MA 02044.
     Medicare Coordinator, B/S Rhode Island (RI BS), 444 
Westminster Street, Providence, RI 02903-2790.
     Medicare Coordinator, Trailblazer Health Enterprises, 
Meriden Park, 538 Preston Ave., Meriden, CT 06450.
     Medicare Coordinator, Upstate Medicare Division, 11 
Lewis Road, Binghamton, NY 13902.
     Medicare Coordinator, Empire Medicare Services, 2651 
Strang Blvd., Yorktown Heights, NY 10598.
     Medicare Coordinator, Empire Medicare Services, NJ, 300 
East Park Drive, Harrisburg, PA 17106.
     Medicare Coordinator, Triple S, 1441 F.D., 
Roosevelt Ave., Guaynabo, PR 00968.
     Medicare Coordinator, Group Health Inc., 4th Floor, 88 
West End Avenue, New York, NY 10023.
     Medicare Coordinator, Highmark, P.O. Box 89065, 1800 
Center Street, Camp Hill, PA 17089-9065.
     Medicare Coordinator, Trailblazers Part B, 11150 
McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.

[[Page 75329]]

     Medicare Coordinator, Trailblazer Health Enterprises, 
Virginia, P.O. Box 26463, Richmond, VA 23261-6463. United Medicare 
Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
     Medicare Coordinator, Alabama B/S, 450 Riverchase 
Parkway East, Birmingham, AL 35298.
     Medicare Coordinator, Cahaba GBA, 12052 Middleground 
Road, Suite A, Savannah, GA 31419.
     Medicare Coordinator, Florida B/S, 532 Riverside Ave, 
Jacksonville, FL 32202-4918.
     Medicare Coordinator, Administar Federal, 9901 
Linnstation Road, Louisville, KY 40223.
     Medicare Coordinator, Palmetto GBA, 17 Technology 
Circle, Columbia, SC 29203-0001.
     Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, 
TN 37228.
     Medicare Coordinator, Railroad Retirement Board, 2743 
Perimeter Parkway, Building 250, Augusta, GA 30999.
     Medicare Coordinator, Cahaba GBA, Jackson Miss, P.O. 
Box 22545, Jackson, MI 39225-2545.
     Medicare Coordinator, Adminastar Federal (IN), 8115 
Knue Road, Indianapolis, IN 46250-1936.
     Medicare Coordinator, Wisconsin Physicians Service, 
P.O. Box 8190, Madison, WI 53708-8190.
     Medicare Coordinator, Nationwide Mutual Insurance Co., 
P.O. Box 16788, 1 Nationwide Plaza, Columbus, Oh 3216-6788.
     Medicare Coordinator, Arkansas B/S, 601 Gaines Street, 
Little Rock, AR 72203.
     Medicare Coordinator, Arkansas-New Mexico, 601 Gaines 
Street, Little Rock, AR 72203.
     Medicare Coordinator, Palmetto GBA--DMERC, 17 
Technology Circle, Columbia, SC 29203-0001.
     Medicare Coordinator, Trailblazer Health Enterprises, 
901 South Central Expressway, Richardson, TX 75080.
     Medicare Coordinator, Nordian, 636 Grand Avenue, Des 
Moines, IA 50309-2551.
     Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 
Topeka Ave., Topeka, KS 66629-0001.
     Medicare Coordinator, Kansas B/S--NE, P.O. Box 239, 
1133 Topeka Ave., Topeka, KS 66629-0239.
     Medicare Coordinator, Montana B/S, P.O. Box 4309, 
Helena, MT 59601.
     Medicare Coordinator, Nordian, 4305 13th Avenue South, 
Fargo, ND 58103-3373.
     Medicare Coordinator, Noridian BCBSND (CO), 730 N. 
Simms 100, Golden, CO 80401-4730.
     Medicare Coordinator, Noridian BCBSND (WY), 4305 13th 
Avenue South, Fargo, ND 58103-3373.
     Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 
Parleys Way, Salt Lake City, UT 84130-0270.
     Medicare Coordinator, Transamerica Occidental, P.O. Box 
54905, Los Angeles, CA 90054-4905.
     Medicare Coordinator, NHIC--California, 450 W. East 
Avenue, Chico, CA 95926.
     Medicare Coordinator, Cigna, Suite 254, 3150 
Lakeharbor, Boise, ID 83703.
     Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, 
Nashville, TN 37228.

5. Payment Safeguard Contractors

     Medicare Coordinator, Aspen Systems Corporation, 2277 
Research Blvd., Rockville, MD 20850.
     Medicare Coordinator, DynCorp Electronic Data Systems 
(EDS), 11710 Plaza America Drive 5400 Legacy Drive, Reston, VA 
20190-6017.
     Medicare Coordinator, Lifecare Management Partners 
Mutual of Omaha Insurance Co. 6601 Little River Turnpike, Suite 300 
Mutual of Omaha Plaza, Omaha, NE 68175.
     Medicare Coordinator, Reliance Safeguard Solutions, 
Inc., P. O. Box 30207 400 South Salina Street, 2890 East Cottonwood 
Pkwy. Syracuse, NY 13202.
     Medicare Coordinator, Science Applications 
International, Inc., 6565 Arlington Blvd. P. O. Box 100282, Falls 
Church, VA.
     Medicare Coordinator, California Medical Review, Inc. 
Integriguard Division Federal Sector Civil Group One Sansome Street, 
San Francisco, CA 94104-4448.
     Medicare Coordinator, Computer Sciences Corporation 
Suite 600 3120 Timanus Lane, Baltimore, MD 21244.
     Medicare Coordinator, Electronic Data Systems (EDS), 
11710 Plaza America Drive 5400 Legacy Drive, Plano, TX 75204.
     Medicare Coordinator, TriCenturion, L.L.C., P. O. Box 
100282, Columbia, SC 29202.

[FR Doc. 04-27530 Filed 12-15-04; 8:45 am]
BILLING CODE 4120-03-P