Sei sulla pagina 1di 4

Federal Register / Vol. 71, No.

212 / Thursday, November 2, 2006 / Notices 64527

information, please contact Karen DEPARTMENT OF HEALTH AND Management and Budget (OMB) on
Migdail at (301) 427–1855. HUMAN SERVICES October 27, 2006. To ensure that all
If sign language interpretation or other parties have adequate time in which to
Centers for Medicare & Medicaid comment, the new system will become
reasonable accommodation for a
Services effective 30 days from the publication of
disability is needed, please contact Mr.
the notice, or 40 days from the date it
Donald L. Inniss, Director, Office of Privacy Act of 1974; Report of a New was submitted to OMB and the
Equal Employment Opportunity System of Records Congress, whichever is later. We may
Program, Program Support Center, on defer implementation of this system or
(301) 443–1144 no later than October AGENCY: Department of Health and
Human Services (HHS), Center for one or more of the routine use
30, 2006. The agenda, roster, and statements listed below if we receive
minutes are available from Ms. Bonnie Medicare & Medicaid Services (CMS).
comments that persuade us to defer
Campbell, Committee Management ACTION: Notice of a new system of
implementation.
Officer, Agency for Healthcare Quality records (SOR).
ADDRESSES: The public should address
and Research, 540 Gaither Road, SUMMARY: In accordance with the comment to the CMS Privacy Officer,
Rockville, Maryland 20850. Her phone requirements of the Privacy Act of 1974, Division of Privacy Compliance,
number is (301) 427–1554. we are proposing to establish a new Enterprise Architecture and Strategy
SUPPLEMENTARY INFORMATION: system titled, ‘‘Evaluation of Drug Usage Group, Office of Information Services,
Under the Staff Time and Resource Mail-stop N2–04–27, 7500 Security
1. Purpose Intensity Verification Study (STRIVE), Boulevard, Baltimore, Maryland 21244–
System No. 09–70–0595.’’ Section 1850. Comments received will be
Section 921 of the Public Health 1888(e)(G) of the Social Security Act available for review at this location by
Service Act (42 U.S.C. 299c) established (the Act) authorizes the Secretary of appointment during regular business
the National Advisory Council for HHS to provide for payment hours, Monday through Friday from 9
Healthcare Research and Quality. In adjustments to the skilled nursing a.m.–3 p.m., eastern time.
accordance with its statutory mandate, facility (SNF) prospective payment FOR FURTHER INFORMATION CONTACT: Julie
the Council is to advise the Secretary of system (PPS) through a resident Stankivic, Division of Institutional Post
the Department of Health and Human classification system established by the Acute Care, Chronic Care Policy Group,
Services and the Director, Agency for Secretary that accounts for the relative Center for Medicare Management, Mail
Healthcare Research and Quality resource utilization of different patient Stop C5–06–27, Centers for Medicare &
(AHRQ), on matters related to actions of types. The case mix adjustment shall be Medicaid Services, 7500 Security
the Agency to enhance the quality, based on resident assessment data and Boulevard, Baltimore, MD 21244–1849.
improve the outcomes, reduce the costs other data the Secretary considers She can be reached by telephone at 410–
of health care services, improve access appropriate. To accomplish this task, 786–5725, or via e-mail at
to such services through scientific CMS is currently undertaking a national Julie.Stankivic@cms.hhs.gov.
research, and to promote improvements nursing home time study known as SUPPLEMENTARY INFORMATION: Section
in clinical practice and in the STRIVE, of which this data will be a 4008(k) of the Omnibus Reconciliation
organization, financing, and delivery of part. Act of 1990 (Public Law (Pub. L.) 101–
health care services. The purpose of this system is to 508) required the Secretary to develop a
collect and maintain during the STRIVE proposal either to modify the then-
The Council is composed of members time study individually identifiable
of the public appointed by the Secretary current system under which SNFs
information on selected beneficiaries’ received payment for extended care
and Federal ex-officio members. medication utilization while in a services under Part A of the Medicare
II Agenda nursing home, skilled nursing facility or program or to replace such a system
swing bed hospital. Information with a system under which such
On Thursday, November 2, the retrieved from this system may be payment would be made on the basis of
Council meeting will begin at 4 p.m., disclosed to: (1) Support regulatory, a prospectively determined rate. In
with the call to order by the Council reimbursement, and policy functions developing a proposal for the new
Chair and approval of previous Council performed within the agency or by a system, the Secretary was required to
minutes. The Director, AHRQ, will contractor, grantee, or consultant. We ‘‘provide for adjustments to
present her update on AHRQ’s current have provided background information prospectively determined rates to
research, programs, and initiatives. about the new system in the account for changes in a facility’s case
Following the update, the Council will SUPPLEMENTARY INFORMATION section mix, volume of cases, and the
discuss the topic Visioning the Future. below. Although the Privacy Act development of new technologies and
The discussion of Visioning the Future requires only that CMS provide an standards for medical practice.’’ Section
will continue Friday morning, opportunity for interested persons to 4432 of the Balanced Budget Act of 1997
comment on the proposed routine uses, (Pub. L. 105–33) mandated a PPS for all
November 3. The official agenda will be
CMS invites comments on all portions SNFs for cost reporting periods
available on AHRQ’s Web site at
of this notice. See Effective Date section beginning on or after July 1, 1998.
http://www.ahrq.gov no later than for comment period.
November 1, 2006. Resident drug data may enable CMS
DATES: Effective Date: CMS filed a new to recalibrate the weights associated
Dated: October 30, 2006. SOR report with the Chair of the House with the provision of non-therapy
mstockstill on PROD1PC61 with NOTICES

Carolyn M. Clancy, Committee on Government Reform and ancillary services to residents in SNFs
Director. Oversight, the Chair of the Senate and swing bed hospitals subject to the
[FR Doc. 06–9039 Filed 10–31–06; 10:10 am] Committee on Homeland Security & SNF PPS. In order to adjust the rates to
Governmental Affairs, and the account for changes in a facility’s case
BILLING CODE 4160–90–M
Administrator, Office of Information mix, volume of cases and development
and Regulatory Affairs, Office of of new technologies and standards of

VerDate Aug<31>2005 14:49 Nov 01, 2006 Jkt 211001 PO 00000 Frm 00019 Fmt 4703 Sfmt 4703 E:\FR\FM\02NON1.SGM 02NON1
64528 Federal Register / Vol. 71, No. 212 / Thursday, November 2, 2006 / Notices

medical practice, CMS must recalibrate Data in the System.’’ Both identifiable the agency to assist in the performance
the weights associated with the amount and non-identifiable data may be of a service related to this collection and
of time that nursing home staff spend disclosed under a routine use. We will who need to have access to the records
caring for residents, as well as other only collect the minimum personal data in order to perform the activity.
elements of resident care. To do this, necessary to achieve the purpose of We contemplate disclosing
CMS has contracted with the Iowa STRIVE. information under this routine use only
Foundation for Medicare Care to CMS has the following policies and in situations in which CMS may enter
conduct a study of staff time commonly procedures concerning disclosures of into a contractual or similar agreement
referred to as STRIVE. This is the first information that will be maintained in with a third party to assist in
national nursing home time study the system. Disclosure of information accomplishing CMS function relating to
undertaken in the U.S. since 1997. As from the system will be approved only purposes for this system.
part of this process, CMS believes that to the extent necessary to accomplish CMS believes that the disclosure of
collecting data on medication utilization the purpose of the disclosure and only medication utilization data may enable
in nursing homes is critical to analyzing after CMS: CMS to better account for the relative
the impact of the provision of non- 1. Determines that the use or resource utilization of different patient
therapy ancillary services to residents in disclosure is consistent with the reason types for the purpose of updating SNF
SNFs and swing bed hospitals subject to that the data is being collected; e.g., to PPS.
the PPS. collect and maintain individually CMS occasionally contracts out
identifiable information on selected certain of its functions when doing so
I. Description of the Proposed System of beneficiaries’ medication utilization would contribute to effective and
Records while in a nursing home, skilled nursing efficient operations. CMS must be able
A. Statutory and Regulatory Basis for facility, or swing bed hospital. to give a contractor, consultant or
SOR 2. Determines that: grantee whatever information is
a. The purpose for which the necessary for the contractor or
The statutory authority for this system disclosure is to be made can only be consultant to fulfill its duties. In these
is given under Section 1888(e)(G) of the accomplished if the record is provided situations, safeguards are provided in
Social Security Act. in individually identifiable form; the contract prohibiting the contractor,
B. Collection and Maintenance of Data b. The purpose for which the consultant or grantee from using or
in the System disclosure is to be made is of sufficient disclosing the information for any
importance to warrant the effect and/or purpose other than that described in the
This system will collect and maintain risk on the privacy of the individual that contract and requires the contractor,
individually identifiable and other data additional exposure of the record might consultant or grantee to return or
collected by CMS and its contractors on bring; and destroy all information at the
Medicare participants and providers of c. There is a strong probability that completion of the contract.
service who are participating in the proposed use of the data would in
STRIVE, in order to analyze relevant B. Additional Provisions Affecting
fact accomplish the stated purpose(s).
data to create adjustments based upon a 3. Requires the information recipient Routine Use Disclosures
resident classification system to: To the extent this system contains
established by the Secretary that a. Establish administrative, technical, Protected Health Information (PHI) as
accounts for the relative resource and physical safeguards to prevent defined by HHS regulation ‘‘Standards
utilization of different patient types. unauthorized use of disclosure of the for Privacy of Individually Identifiable
The collected information will include, record; Health Information’’ (45 CFR parts 160
but is not limited to: Facility name, b. Remove or destroy, at the earliest and 164, subparts A and E) 65 FR 82462
Federal provider identification number, time, all patient-identifiable (12–28–00), disclosures of such PHI that
facility national provider identifier, information; and are otherwise authorized by these
beneficiary name, social security c. Agree to not use or disclose the routine uses may only be made if, and
number, health insurance claim information for any purpose other than as, permitted or required by the
number, gender, date of birth, NDC the stated purpose under which the ‘‘Standards for Privacy of Individually
Code, drug name, drug strength, dosage information was disclosed. Identifiable Health Information.’’ (See
form (drops (gtts), gram (gm), etc.), 4. Determines that the data are valid 45 CFR 164.512(a) (1)).
quantity dispensed or returned, date and reliable. In addition, our policy will be to
drug dispensed or returned, dose and prohibit release even of data not directly
frequency, routine or PRN, compound III. Proposed Routine Use Disclosures
identifiable, except pursuant to one of
code, and cost data if available. of Data in the System
the routine uses or if required by law,
A. The Privacy Act allows us to if we determine there is a possibility
II. Agency Policies, Procedures, and disclose information without an
Restrictions on the Routine Use that an individual can be identified
individual’s consent if the information through implicit deduction based on
A. The Privacy Act permits us to is to be used for a purpose that is small cell sizes (instances where the
disclose information without an compatible with the purpose(s) for patient population is so small that an
individual’s consent if the information which the information was collected. individual could, because of the small
is to be used for a purpose that is Any such compatible use of data is size, use this information to deduce the
compatible with the purpose(s) for known as a ‘‘routine use.’’ The proposed identity of the beneficiary).
which the information was collected. routine uses in this system meet the
mstockstill on PROD1PC61 with NOTICES

Any such disclosure of data is known as compatibility requirement of the Privacy IV. Safeguards
a ‘‘routine use.’’ The Government will Act. We are proposing to establish the CMS has safeguards in place for
only release STRIVE information that following routine use disclosures of authorized users and monitors such
can be associated with an individual as information maintained in the system: users to ensure against excessive or
provided for under ‘‘Section III. 5. To agency contractors, consultants unauthorized use. Personnel having
Proposed Routine Use Disclosures of or grantees, who have been engaged by access to the system have been trained

VerDate Aug<31>2005 14:49 Nov 01, 2006 Jkt 211001 PO 00000 Frm 00020 Fmt 4703 Sfmt 4703 E:\FR\FM\02NON1.SGM 02NON1
Federal Register / Vol. 71, No. 212 / Thursday, November 2, 2006 / Notices 64529

in the Privacy Act and information Dated: October 24, 2006. performed within the agency or by a
security requirements. Employees who John R. Dyer, contractor, grantee, or consultant.
maintain records in this system are Chief Operating Officer, Centers for Medicare
ROUTINE USES OF RECORDS MAINTAINED IN THE
instructed not to release data until the & Medicaid Services.
SYSTEM, INCLUDING CATEGORIES OR USERS AND
intended recipient agrees to implement THE PURPOSES OF SUCH USES:
appropriate management, operational SYSTEM NO. 09–70–0595
A. The Privacy Act allows us to
and technical safeguards sufficient to SYSTEM NAME: disclose information without an
protect the confidentiality, integrity and ‘‘Evaluation of Drug Usage Under the individual’s consent if the information
availability of the information and Staff Time and Resource Intensity is to be used for a purpose that is
information systems and to prevent Verification Study (STRIVE),’’ HHS/ compatible with the purpose(s) for
unauthorized access. CMS/CMM. which the information was collected.
This system will conform to all Any such compatible use of data is
applicable Federal laws and regulations SECURITY CLASSIFICATION:
known as a ‘‘routine use.’’ The proposed
and Federal, HHS, and CMS policies Level Three Privacy Act Sensitive routine uses in this system meet the
and standards as they relate to Data. compatibility requirement of the Privacy
information security and data privacy. Act. We are proposing to establish the
These laws and regulations may apply SYSTEM LOCATION:
following routine use disclosures of
but are not limited to: the Privacy Act Centers for Medicare & Medicaid information maintained in the system:
of 1974; the Federal Information Services (CMS) Data Center, 7500 1. To agency contractors, consultants
Security Management Act of 2002; the Security Boulevard, North Building, or grantees, who have been engaged by
Computer Fraud and Abuse Act of 1986; First Floor, Baltimore, Maryland 21244– the agency to assist in the performance
the Health Insurance Portability and 1850 and at various co-locations of CMS of a service related to this collection and
Accountability Act of 1996; the E- agents. who need to have access to the records
Government Act of 2002, the Clinger- in order to perform the activity.
CATEGORIES OF INDIVIDUALS COVERED BY THE
Cohen Act of 1996; the Medicare
SYSTEM:
Modernization Act of 2003, and the B. Additional Provisions Affecting
corresponding implementing This system will collect and maintain Routine Use Disclosures
regulations. OMB Circular A–130, individually identifiable and other data To the extent this system contains
Management of Federal Resources, collected by CMS and its contractors on Protected Health Information (PHI) as
Appendix III, Security of Federal Medicare participants and providers of defined by HHS regulation ‘‘Standards
Automated Information Resources also service who are participating in for Privacy of Individually Identifiable
applies. Federal, HHS, and CMS STRIVE, in order to analyze relevant Health Information’’ (45 CFR parts 160
policies and standards include but are data to create adjustments based upon a and 164, subparts A and E) 65 FR 82462
not limited to: All pertinent National resident classification system (12–28–00), disclosures of such PHI that
Institute of Standards and Technology established by the Secretary that are otherwise authorized by these
publications; the HHS Information accounts for the relative resource routine uses may only be made if, and
Systems Program Handbook and the utilization of different patient types. as, permitted or required by the
CMS Information Security Handbook. CATEGORIES OF RECORDS IN THE SYSTEM: ‘‘Standards for Privacy of Individually
V. Effects of the Proposed System of The collected information will Identifiable Health Information.’’ (See
Records on Individual Rights include, but is not limited to: Facility 45 CFR 164.512(a) (1)).
In addition, our policy will be to
name, Federal provider identification
CMS proposes to establish this system prohibit release even of data not directly
number, facility national provider
in accordance with the principles and identifiable, except pursuant to one of
identifier, beneficiary name, social
requirements of the Privacy Act and will the routine uses or if required by law,
security number, health insurance claim
collect, use, and disseminate if we determine there is a possibility
number, gender, date of birth, NDC
information only as prescribed therein. that an individual can be identified
Code, drug name, drug strength, dosage
Data in this system will be subject to the through implicit deduction based on
form (drops (gtts), gram (gm), etc.),
authorized releases in accordance with small cell sizes (instances where the
quantity dispensed or returned, date
the routine uses identified in this patient population is so small that an
drug dispensed or returned, dose and
system of records. individual could, because of the small
frequency, routine or PRN, compound
CMS will take precautionary size, use this information to deduce the
code, and cost data if available.
measures to minimize the risks of identity of the beneficiary).
unauthorized access to the records and AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
POLICIES AND PRACTICES FOR STORING,
the potential harm to individual privacy The statutory authority for this system RETRIEVING, ACCESSING, RETAINING, AND
or other personal or property rights of is given under Section 1888(e)(G) of the DISPOSING OF RECORDS IN THE SYSTEM:
patients whose data are maintained in Social Security Act. STORAGE:
this system. CMS will collect only that
information necessary to perform the PURPOSE(S) OF THE SYSTEM: All records will be stored
system’s functions. In addition, CMS The purpose of this system is to electronically and on hard copy.
will make disclosure from the proposed collect and maintain during the STRIVE RETRIEVABILITY:
system only with consent of the subject time study individually identifiable The collected data are retrieved by an
individual, or his/her legal information on selected beneficiaries’ individual identifier; e.g., beneficiary
mstockstill on PROD1PC61 with NOTICES

representative, or in accordance with an medication utilization while in a name or HICN.


applicable exception provision of the nursing home, skilled nursing facility or
Privacy Act. CMS, therefore, does not swing bed hospital. Information SAFEGUARDS:
anticipate an unfavorable effect on retrieved from this system may be CMS has safeguards in place for
individual privacy as a result of disclosed to: (1) support regulatory, authorized users and monitors such
information relating to individuals. reimbursement, and policy functions users to ensure against excessive or

VerDate Aug<31>2005 14:49 Nov 01, 2006 Jkt 211001 PO 00000 Frm 00021 Fmt 4703 Sfmt 4703 E:\FR\FM\02NON1.SGM 02NON1
64530 Federal Register / Vol. 71, No. 212 / Thursday, November 2, 2006 / Notices

unauthorized use. Personnel having is voluntary, but it may make searching (Medi-Medi) in which data from both
access to the system have been trained for a record easier and prevent delay). the Medicare and Medicaid programs
in the Privacy Act and information are analyzed together to better detect
RECORD ACCESS PROCEDURE:
security requirements. Employees who fraud, waste, and abuse existent in these
maintain records in this system are For purpose of access, use the same programs. In order to comply with these
instructed not to release data until the procedures outlined in Notification requirements and enhance our ability to
intended recipient agrees to implement Procedures above. Requestors should detect fraud, waste, and abuse in
appropriate management, operational also reasonably specify the record Medicare and Medicaid, CMS is
and technical safeguards sufficient to contents being sought. (These proposing to construct the ODR.
protect the confidentiality, integrity and procedures are in accordance with CMS maintains numerous systems
availability of the information and Department regulation 45 CFR 5b.5 (a) housing Medicare beneficiary Parts A,
information systems and to prevent (2)). B, C, and D entitlement, enrollment, and
unauthorized access. utilization information. Additionally,
CONTESTING RECORD PROCEDURES:
This system will conform to all CMS maintains data on physicians,
The subject individual should contact providers, employer plans, Medicaid
applicable Federal laws and regulations the system manager named above, and
and Federal, HHS, and CMS policies recipients and Medicare secondary
reasonably identify the record and payers. There are a large number of data
and standards as they relate to specify the information to be contested.
information security and data privacy. sources, extraction tools, and access
State the corrective action sought and mechanisms. Users of the data often
These laws and regulations may apply the reasons for the correction with
but are not limited to: The Privacy Act experience inconsistent, untimely, or
supporting justification. (These duplicated information. The ODR will
of 1974; the Federal Information procedures are in accordance with
Security Management Act of 2002; the be an enterprise resource that will
Department regulation 45 CFR 5b.7). provide an integrated view of the data
Computer Fraud and Abuse Act of 1986;
the Health Insurance Portability and to all of CMS and its partners providing
RECORDS SOURCE CATEGORIES:
Accountability Act of 1996; the E- a single authoritative source of
Data will be collected from OmniCare, information and providing quality and
Government Act of 2002, the Clinger- pharmacies, nursing homes, and Long
Cohen Act of 1996; the Medicare timely data.
Term Care Minimum Data Set, System The ODR will provide an organized
Modernization Act of 2003, and the No. 09–70–1517. structure for reaching the data through
corresponding implementing
a consistent application of access
regulations. OMB Circular A–130, SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS
policies, processes and procedures,
Management of Federal Resources, OF THE ACT:
common services, governance, and
Appendix III, Security of Federal None.
framework. The ODR will integrate and
Automated Information Resources also [FR Doc. E6–18452 Filed 11–1–06; 8:45 am] load data from various CMS systems
applies. Federal, HHS, and CMS BILLING CODE 4120–03–P consisting of Medicare Parts A, B, C,
policies and standards include but are and D, Medicaid and Retiree Drug
not limited to: All pertinent National Subsidy entitlement, enrollment and
Institute of Standards and Technology DEPARTMENT OF HEALTH AND utilization data. The ODR will also
publications; the HHS Information HUMAN SERVICES contain demographic information on
Systems Program Handbook and the Medicaid beneficiaries, Medicare
CMS Information Security Handbook. Centers for Medicare & Medicaid
Services providers and physicians, and employer
RETENTION AND DISPOSAL:
plans that are receiving a subsidy from
Privacy Act of 1974; Report of New CMS for providing creditable drug
CMS will retain information for a total coverage to their retirees. It is through
System of Records
period not to exceed 5 years after the the integration of this Medicare data
final report is released. All claims- AGENCY: Department of Health and with other data; e.g., historic data, Part
related records are encompassed by the Human Services (HHS), Centers for A and Part B data, and Medicaid data
document preservation order and will Medicare & Medicaid Services (CMS). sets provided by state agencies that CMS
be retained until notification is received ACTION: Notice of a new system of fraud, waste, and abuse, quality
from DOJ. records. improvement, research, and other
analytic activities are maximized.
SYSTEM MANAGER AND ADDRESS: SUMMARY: In accordance with the The data collected and maintained in
Director Division of Institutional Post requirements of the Privacy Act of 1974, this system are retrieved from the
Acute Care, Chronic Care Policy Group, CMS is proposing to establish a new following databases: Medicare Drug
Center for Medicare Management, Mail system of records (SOR) titled ‘‘One Data Processing System, System No. 09–
Stop C5–06–27, Centers for Medicare & Program Integrity Data Repository 70–0553 (70 FR 58436 (October 6,
Medicaid Services, 7500 Security (ODR),’’ System No. 09–70–0568. 2005)); Medicare Beneficiary Database,
Boulevard, Baltimore, MD 21244–1849. Section 1893 of the Social Security Act System No. 09–70–0536 (66 FR 63392
(the Act) established the ‘‘Medicare (December 6, 2001)); Medicare
NOTIFICATION PROCEDURE: Integrity Program’’ that requires CMS to Advantage Prescription Drug System,
For purpose of access, the subject contract with eligible entities to ‘‘review System No. 09–70–4001 (70 FR 60530
individual should write to the system activities of providers of services or (October 18, 2005)); Medicaid Statistical
manager who will require the system other individuals and entities furnishing Information System, System No. 09–70–
mstockstill on PROD1PC61 with NOTICES

name, employee identification number, items and services for which payment 6001 (67 FR 48906 (July 26, 2002));
tax identification number, national may be made under this title’’ by Retiree Drug Subsidy Program, System
provider number, and for verification utilizing equipment and software No. 09–70–0550 (70 FR 41035 (July 15,
purposes, the subject individual’s name technologies. Likewise, section 1893 of 2005)); Common Working File, System
(woman’s maiden name, if applicable), the Act requires CMS to establish the No. 09–70–0526 (67 FR 3210 (January
HICN, and/or SSN (furnishing the SSN Medicare Medicaid Data Match Program 23, 2002)); National Claims History,

VerDate Aug<31>2005 14:49 Nov 01, 2006 Jkt 211001 PO 00000 Frm 00022 Fmt 4703 Sfmt 4703 E:\FR\FM\02NON1.SGM 02NON1

Potrebbero piacerti anche