[Federal Register Volume 80, Number 158 (Monday, August 17, 2015)]
[Notices]
[Pages 49237-49240]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-20224]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
Privacy Act of 1974: Report of New System of Records
AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of
Health and Human Services (HHS)
ACTION: Notice of New System of Records (SOR).
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of
1974, we are proposing to establish a new SOR titled, ``CMS Risk
Adjustment Suite of Systems (RASS),'' System No. 09-70-0508. Payments
to Medicare Advantage (MA) organizations, Part D sponsors, and Program
of All Inclusive Care for the Elderly (PACE) organizations
(collectively referred to as ``MA organizations and other entities'')
are adjusted based on the health status of enrolled Medicare
beneficiaries (``enrollees''). RASS is established to receive, process,
and store the data used
[[Page 49238]]
to risk-adjust payments based on enrollee health status. The data will
be used specifically to develop risk adjustment models and to calculate
the risk score for each enrollee.
Each MA organization and other entity must submit data to CMS in
accordance with CMS regulations and instructions. ``Risk adjustment
data'' refers to data submitted in two separate formats: comprehensive
data equivalent to Medicare fee-for-service data (often referred to as
encounter data); and data in abbreviated formats (often referred to as
RAPS data). The MA risk adjustment data addressed by this SOR includes
RAPS data submitted by a MA organization in an abbreviated format, as
referenced at Sec. 422.310(d)(1), and similar abbreviated risk
adjustment data submitted by other MA organizations and other entities.
Encounter data has a separate SOR (System No. 09-70-0506).
DATES: Effective 30 days after publication. Written comments should be
submitted on or before the effective date. HHS/CMS/CM may publish an
amended system of records notice (SORN) in light of any comments
received.
ADDRESSES: The public should address comments to: CMS Privacy Officer,
Division of Security, Privacy Policy & Governance, Information Security
& Privacy Group, Office of Enterprise Information, CMS, 7500 Security
Boulevard, Baltimore, MD 21244-1870, Mailstop: N1-24-08, Office: (410)
786-5357, email: [email protected]. Comments received will be
available for review at this location, by appointment, during regular
business hours, Monday through Friday from 9 a.m.-3 p.m., Eastern Time
zone.
FOR FURTHER INFORMATION CONTACT: Risk Adjustment Mailbox Coordinator,
Division of Encounter Data and Risk Adjustment Operations, Medicare
Plan Payment Group, Center for Medicare, CMS, Mail Stop C1-13-07, 7500
Security Boulevard, Baltimore, Maryland 21244-1850. The email is
[email protected].
SUPPLEMENTARY INFORMATION:
I. Background on the Risk Adjustment Suite of Systems (RASS)
The new RASS system of records is being established to cover data
used to create risk adjustment scores needed to risk-adjust payments to
Medicare and Medicaid provider entities, based on beneficiary
demographics and health status. Risk-adjusted payments will implement
reformatory provisions of the Social Security Act at sections 1853(a),
1860D-15(c), and 1894(d)(2) (42 U.S.C. 1395w-23, 1395w-115, and
1395eee), intended to collect and accurately calculate scores based on
a beneficiary's demographics and health status. RASS will cover data
housed in two existing information systems: The Risk Adjustment
Processing System (RAPS), and the Risk Adjustment System (RAS). RAS
will contain data extracted from RAPS and from two other IT systems
(CME and NMUD), as more fully explained below:
[cir] RAPS will receive abbreviated current risk adjustment data,
consisting of diagnosis data about each beneficiary and the
beneficiary's health care provider type, submitted by the relevant
payee entity through the Front-End Risk Adjustment System (FERAS); RAPS
will use the data to create an enrollee diagnosis data file for each
beneficiary (See Categories of Records for data elements).
[cir] RAS will extract the enrollee diagnosis data files from RAPS
and will receive current demographic, enrollment and diagnoses data and
past medical history data for each enrollee from two other CMS systems
(CME and NMUD); RAS will use the RAPS, CME, and NMUD data to calculate
risk factors and create a Risk Adjustment Factor (RAF) file, containing
the risk score of each beneficiary:
[ssquf] Common Medicare Environment (CME): RAS will extract current
individual demographic and enrollment data about each enrollee (See
Categories of Records for data elements).
[ssquf] National Claims History files housed in the National
Medicare Utilization Database (NMUD): RAS will extract current Medicare
Fee-for-service (FFS) diagnoses information submitted on Inpatient,
Outpatient, and Physician claims for each enrollee (See Categories of
Records for data elements).
[cir] RAS will transmit the Risk Adjustment Factor (RAF) file
created in RAS to CMS' payment processing system for purposes of
calculating and adjusting payments to payee entities, as follows:
[ssquf] CMS pays MA organizations on a monthly prospective amount
for each beneficiary enrolled (enrollee) in a Part C plan.
[ssquf] CMS pays Part D sponsors a monthly prospective amount that
reflects the plan sponsor's estimate of the revenue needed to cover a
plan's costs for the risk portion of basic prescription drug coverage.
The direct subsidy is adjusted based on the beneficiary's risk score,
which reflects expected prescription drug expenditures for the coverage
year (relative to a national average of 1.0), based on demographic and
health status information for that person.
[ssquf] CMS pays PACE organizations a monthly capitation amount
based on the Part A and Part B payment rates established for purposes
of payment to Medicare Advantage organizations pursuant to 1894(d)(2).
CMS will ensure that payments take into account the comparative frailty
of PACE enrollees relative to the general Medicare population.
In addition to providing the file used to calculate risk adjustment
payments, the RASS also provides reports for CMS based on the analysis
of RAF files and other criteria; these reports include MA plan file
submission transactions (acceptance rates, rejection rates, error
rates, etc.) on a daily, weekly, monthly, and quarterly basis.
II. The Privacy Act
The Privacy Act governs the collection, maintenance, use, and
dissemination of certain information about individuals by agencies of
the Federal Government.
A ``SOR'' is a group of any records under the control of a Federal
agency from which information about individuals is retrieved by name or
other personal identifier. The Privacy Act requires each agency to
publish in the Federal Register notice of the existence and character
of each SOR that the agency maintains. The System of Records Notice
(SORN) identifies or describes the laws authorizing the system to be
maintained; the types and sources of records in the system; the
categories of individuals to whom the records pertain; the purposes for
which the records are used within the agency; the routine uses for
which a record maybe disclosed to parties outside the agency without
the individual's prior, written consent; agency policies and procedures
for safeguarding, storing, retrieving, accessing, retaining, and
disposing of the records; the procedures for an individual to follow to
make notification, access, and amendment requests to the System
Manager; and whether the SOR is exempt from certain Privacy Act
requirements.
System Number:
09-70-0508
System Name:
CMS Risk Adjustment Suite of Systems (RASS), HHS/CMS/CM.
Security Classification:
Unclassified.
System Location:
RASS (RAS/RAPS) Location: CMS Data Center, 7500 Security Boulevard,
North Building, First Floor, Baltimore, Maryland 21244-1850.
[[Page 49239]]
Categories of Individuals Covered by the System:
Information collected and maintained in this system pertains to:
(1) Medicare beneficiaries enrolled in a Part C MA plan, MA-PD plan,
PDP or PACE organization (``enrollees'') and (2) the health care
provider(s), supplier(s), physician(s), or other practitioner(s)
(``Providers'') who provide health care items and services to these
enrollees.
Categories of Records in the System:
The MA plans, MA-PDs, PDPs and PACE organizations (``MA
organizations and other entities'') receive the data from the providers
which is then submitted to RAPS via FERAS. The data received from the
MA organizations and other entities are primarily diagnosis data
extracted from claims information. Additional FFS and utilization data
regarding those submissions are received from the CME and NCH data
systems to complete the enrollee data requirements.
Records will consist of the risk score for each enrollee and the
data used to calculate the score, contained in Risk Adjustment Factor
(RAF) files created in CMS' Risk Adjustment System (RAS), using data
extracted from three other CMS IT systems:
RAPS data: Diagnosis data files containing abbreviated
current diagnosis data submitted by payee entities to CMS's Risk
Adjustment Processing System (RAPS):
[cir] Health Insurance Claim Number (HICN)
[cir] Provider Type
[cir] Service From Date
[cir] Service Through Date
[cir] Plan Number (MAO contract number)
[cir] Diagnosis Code
[cir] Diagnosis Delete Date
[cir] RAS Diagnosis Indicator
[cir] NCH Category Equitable BIC
[cir] Accrete Data
[cir] Delete Plan Number
[cir] Submitter ID
[cir] Daily File Code, and
[cir] Delete File Code
CME data: Current demographic and enrollment data from
CMS's Common Medicare Environment (CME):
[cir] Beneficiary Link Key Partition number
[cir] Beneficiary Link Identifier
[cir] Health Insurance Claim Number (HICN)
[cir] Beneficiary Social Security Number
[cir] Beneficiary Birth Date
[cir] Beneficiary Death Date
[cir] Beneficiary Sex Code
[cir] Beneficiary Race Code
[cir] Beneficiary First Name
[cir] Beneficiary Middle Name
[cir] Beneficiary Last Name
NCH data: Current diagnosis data [and past medical history
data] from National Claims History Files in CMS's National Medicare
Utilization Database (NMUD):
[cir] Health Insurance Claim Number (HICN)
[cir] NCH Category Equitable BIC
[cir] Diagnosis code
[cir] Service Through Date
[cir] Service From Date
[cir] Beneficiary Link Identifier
[cir] Provider Number
Authority for Maintenance of the System:
This system was established pursuant to sections 1853(a), 1860D-
15(c), and 1894(d)(2)of the Social Security Act (42 U.S.C. 1395w-23,
1395w-115, 1395eee).
Purpose(s) of the System:
Records will be used within the agency to develop risk adjustment
models and to calculate the risk score for each Medicare beneficiary
enrolled in the Medicare health plan. The risk score will be reported
to the system that CMS uses to process payments, and ultimately will be
used to adjust payments to MA organizations, Part D sponsors, and PACE
organizations, based on beneficiary health status. (Note that payment
records are not covered under this system of records.)
Information retrieved from this SOR will be used for the following
purposes:
To determine the risk adjustment factors used to adjust
payments to MA organizations and other entities, as required under 42
CFR 422.304(a) and (c), 423.329 and 460.180
to update risk adjustment models
to calculate Medicare Disproportionate Share Hospital (DSH)
percentages
to conduct quality review and improvement activities for
Medicare coverage purposes
to conduct evaluations and other analysis to support the
Medicare program (including demonstrations)
to support public health initiatives and other health care-
related research
for activities to support the administration of the Medicare
program
for activities conducted to support program integrity
for purposes authorized by applicable law
Routine Uses of Records Maintained in the System, Including Categories
or Users and the Purposes of Such Uses:
Records may be disclosed to parties outside HHS, without the
individual record subject's prior, written consent, for the following
purposes:
1. To determine the risk adjustment factors used to adjust
payments, as required under Sec. Sec. 422.304(a) and (c), 423.329, and
460.180, to update risk adjustment models, to calculate Medicare DSH
percentages, to conduct quality review and improvement activities, for
Medicare coverage purposes, to conduct evaluations and other analysis
to support the Medicare program (including demonstrations) and to
support public health initiatives, for activities conducted to support
program integrity, and for purposes authorized by applicable law.
2. To support CMS contractors, consultants, or grantees that have
been contracted by the Agency when necessary to assist in
accomplishment of a CMS function relating to the purposes for this
system or a purpose listed in paragraph 1.
3. To support an individual or organization for research to support
the Medicare program and public health initiatives, and otherwise
related to health care, such as evaluation or epidemiological projects
related to the prevention of disease or disability, the restoration or
maintenance of health, or for understanding and improving payment
projects.
4. To provide information to the U.S. Department of Justice (DOJ),
a court, or an adjudicatory body when (a) the Agency or any component
thereof, or (b) any employee of the Agency in his or her official
capacity, or (c) any employee of the Agency in his or her individual
capacity where the DOJ has agreed to represent the employee, or (d) the
United State Government, is a party to litigation or has an interest in
such litigation, and by careful review, CMS determines that the records
are both relevant and necessary to the litigation and that the use of
such records by the DOJ, court, or adjudicatory body is compatible with
the purpose for which the agency collected the records.
5. To assist a CMS contractor (including, but not limited to
Medicare Administrative Contractors, fiscal intermediaries, and
carriers) that assists in the administration of a CMS-administered
health benefits program, or to a grantee of a CMS-administered grant
program, when disclosure is deemed reasonably necessary by CMS to
prevent, deter, discover, detect, investigate, examine, prosecute, sue
with respect to, defend against, correct, remedy, or otherwise combat
fraud, waste or abuse in such program.
6. To assist another Federal agency or an instrumentality of any
governmental jurisdiction within or under the control of the United
States (including any state or local governmental agency), that
[[Page 49240]]
administers or that has the authority to investigate potential fraud,
waste or abuse in a health benefits program funded in whole or in part
by Federal funds, when disclosure is deemed reasonably necessary by CMS
to prevent, deter, discover, detect, investigate, examine, prosecute,
sue with respect to, defend against, correct, remedy, or otherwise
combat fraud, waste or abuse in such programs.
7. To assist Medicare Advantage organizations, Part D Sponsors and
PACE organizations with improving the quality of required risk
adjustment data obtained from the provider that furnished the item or
service. CMS will be analyzing the data received and advising MA
organizations, Part D Sponsors and PACE organizations of trends and
data analysis results to help improve the accuracy and completeness of
data received from the provider.
8. To assist appropriate Federal agencies and CMS contractors and
consultants that have a need to know the information for the purpose of
assisting CMS' efforts to respond to a suspected or confirmed breach of
the security or confidentiality of information maintained in this
system of records, provided that the information disclosed is relevant
and necessary for that assistance.
Note: CMS may disclose information from this system of records,
without the individual record subject's consent, for any of the
following purposes referenced directly in the Privacy Act: 5 U.S.C.
552a(b)(1), (3)-(8), and (12). CMS must also disclose information
from this system of records, without the individual record subject's
consent, for any of the following purposes referenced directly in
the Privacy Act: 5 U.S.C. 552a(b)(2), and (b)(9)-(11).
Additional Provisions Affecting Routine Use Disclosures:
This system contains Protected Health Information (PHI) as defined
by HHS regulation ``Standards for Privacy of Individually Identifiable
Health Information'' (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00),
subparts A and E). Disclosures of PHI authorized by these routine uses
may only be made if, and as, permitted or required by the ``Standards
for Privacy of Individually Identifiable Health Information.''
In addition, our policy will be to prohibit release even of data
that is not directly identifiable, except if required by law, if we
determine there is a possibility that an individual can be identified
through implicit deduction based on small cell sizes (instances where
the patient population is so small that individuals could, because of
the small size, use this information to deduce the identity of the
beneficiary).
Note: Information collected or obtained under Sec. 1860D-15
(i.e., risk adjustment data used to pay Part D plan sponsors) will
be used and disclosed only in accordance with the statutory
limitations under Sec. 1860D-15(f)(2).
POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING,
AND DISPOSING OF RECORDS IN THE SYSTEMStorage:
Archived records will be stored on magnetic tapes. Data that is
currently in use is stored in the RAPS database.
Retrievability:
Records will be retrieved by National Provider Identifier (NPI),
beneficiary provider name, or beneficiary Health Insurance Claim
Number.
Safeguards:
Personnel having access to the system have been trained in the
Privacy Act and information security requirements. Employees who
maintain records in this system are instructed not to release data
until the intended recipient agrees to implement appropriate
management, operational, and technical safeguards sufficient to protect
the confidentiality, integrity and availability of the information and
information systems; and to prevent unauthorized access. Access to
records in the RASS will be limited to CMS personnel and contractors
through password security, encryption, firewalls, and secured operating
system(s).
Retention and Disposal:
Records (i.e., enrollee diagnosis data files created in RAPS, and
Risk Adjustment Factor (RAF) files created in RAS) will be maintained
for a period of up to 10 years after date of creation. Any such records
that are needed longer, such as to resolve claims and audit exceptions
or to prosecute fraud, will be retained until such matters are
resolved. Enrollee claims records are currently subject to a document
preservation order and will be preserved indefinitely pending further
notice from the U.S. Department of Justice (DOJ).
System Manager and Address:
Director, Division of Encounter Data and Risk Adjustment
Operations, Medicare Plan Payment Group, Center for Medicare, CMS, 7500
Security Boulevard, Baltimore, Maryland 21244-1850.
Notification Procedure:
Individuals (i.e., the beneficiary or provider) wishing to know if
this system contains records about them should write to the system
manager and include pertinent personally identifiable information
(encrypted and properly transmitted) to be used for retrieval of their
records (i.e., NPI or Health Insurance Claim Number).
Record Access Procedure:
Individuals seeking access to records about them in this system
should follow the same instructions indicated under ``Notification
Procedure'' and reasonably specify the record content being sought.
(These procedures are in accordance with Department regulation 45 CFR
5b.5(a)(2)).
Contesting Record Procedures:
Individuals seeking to contest the content of information about
them in this system should follow the same instructions indicated under
``Notification Procedure.'' The request should: reasonably identify the
record and specify the information being contested; state the
corrective action sought; and provide the reasons for the correction,
with supporting justification. (These procedures are in accordance with
Department regulation 45 CFR 5b.7.)
Record Source Categories:
RASS processes data extracted from RAPS and RAS IT systems to
calculate the risk scores used to adjust payments to Medicare Advantage
organizations, Part D plan sponsors and PACE plans. RAS receives the
most current data for each Medicare Part C and Part D beneficiary from
the following sources: RAPS, Common Medicare Environment (CME) also
known as Medicare Beneficiary Database (MBD/CME), and National Medicare
Utilization Database (NMUD). RAPS receives risk adjustment data from MA
organizations and other entities defined above.
Systems Exempted from Certain Provisions of the Act:
None.
Celeste Dade-Vinson,
Health Insurance Specialist, Centers for Medicare & Medicaid Services.
[FR Doc. 2015-20224 Filed 8-14-15; 8:45 am]
BILLING CODE 4120-03-P