E6-22253. Privacy Act of 1974; CMS Computer Match No. 2006-06, HHS Computer Match No. 0603

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Notice of Computer Matching Program (CMP).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, this notice announces the establishment of a CMP that CMS plans to conduct with various Participating States. We have provided information about the matching program in the “Supplementary Information” section below. The Privacy Act provides an opportunity for interested persons to comment on the matching program. We may defer implementation of this matching program if we receive comments that persuade us to defer implementation. See “Effective Dates” section below for comment period.

DATES:

Effective Dates: CMS filed a report of the CMP with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security and Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on December 20, 2006. We will not disclose any information under a matching agreement until 40 days after filing a report to OMB and Congress or 30 days after publication in the Federal Register, whichever is later. We may defer implementation of this matching program if we receive comments that persuade us to defer implementation.

ADDRESSES:

The public should address comments to: CMS Privacy Officer, Division of Privacy Compliance, Enterprise Architecture and Strategy Group, Office of Information Services, CMS, Mail-stop N2-04-27, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9 a.m.-3 p.m., eastern daylight time.

FOR FURTHER INFORMATION CONTACT:

Lourdes Grindal Miller, Health Insurance Specialist, Program Integrity Group, Office of Financial Management, CMS, Mail-stop C3-02-16, 7500 Security Boulevard, Baltimore Maryland 21244-1850. The telephone number is 410-786-1022 and e-mail is [e-mail].

SUPPLEMENTARY INFORMATION:

I. Description of the Matching Program

A. General

The Computer Matching and Privacy Protection Act of 1988 (Public Law (Pub. L.) 100-503), amended the Privacy Act (5 U.S.C. 552a) by describing the manner in which computer matching involving Federal agencies could be performed and adding certain protections for individuals applying for and receiving Federal benefits.

Section 7201 of the Omnibus Budget Reconciliation Act of 1990 (Pub. L. 101-508) further amended the Privacy Act regarding protections for such individuals. The Privacy Act, as amended, regulates the use of computer matching by Federal agencies when records in a system of records are matched with other Federal, state, or local government records. It requires Federal agencies involved in computer matching programs to:

1. Negotiate written agreements with the other agencies participating in the matching programs;

2. Obtain the Data Integrity Board approval of the match agreements;

3. Furnish detailed reports about matching programs to Congress and OMB;

4. Notify applicants and beneficiaries that the records are subject to matching; and,

5. Verify match findings before reducing, suspending, terminating, or denying an individual's benefits or payments.

B. CMS Computer Matches Subject to the Privacy Act

CMS has taken action to ensure that all CMPs that this Agency participates in comply with the requirements of the Privacy Act of 1974, as amended.

Dated: December 19, 2006.

John R. Dyer,

Chief Operating Officer, Centers for Medicare & Medicaid Service.

CMS Computer Match No. 2006-06

HHS Computer Match No. 0603

NAME:

“Computer Matching Agreement (CMA) Between the Centers for Medicare & Medicaid Services (CMS) and Participating States for the Disclosure of Medicare and Medicaid Information.”

SECURITY CLASSIFICATION:

Level Three Privacy Act Sensitive.

PARTICIPATING AGENCIES:

The Centers for Medicare & Medicaid Services (CMS).

All Participating States, the District of Columbia, and the territories of Guam, Puerto Rico, American Samoa, and the Virgin Islands.

AUTHORITY FOR CONDUCTING MATCHING PROGRAM:

This CMA is executed to comply with the Privacy Act of 1974 (Title 5 United States Code (U.S.C.) 552a), as amended, (as amended by Public Law (Pub. L.) 100-503, the Computer Matching and Privacy Protection Act (CMPPA) of 1988), the Office of Management and Budget (OMB) Circular A-130, titled “Management of Federal Information Resources” at 65 Federal Register (FR) 77677 (December 12, 2000), 61 FR 6435 (February 20, 1996), and OMB guidelines pertaining to computer matching at 54 FR 25818 (June 19, 1989).

This Agreement provides for information matching fully consistent with the authority of the Secretary of the Department of Health and Human Services (HHS) (the Secretary). Sections 1816 and 1842 of the Social Security Act (the Act) permits the Secretary to make audits of the records of providers as necessary to insure that proper payments are made, to assist in the application of safeguards against unnecessary utilization of services furnished by providers of services and other persons to individuals entitled to benefits, and to perform other functions as are necessary (Pub. L. 108-173 section 911, amending Title XVIII, section 1874A (42 U.S.C. 1395kk-1).

Section 1857 of the Act provides that the Secretary, or any person or organization designated by the Secretary shall have the right to “inspect or otherwise evaluate (i) the quality, appropriateness, and timeliness of services performed under the contract” (42 U.S.C. 1395w-27(d)(2)(A)); and “audit and inspect any books and records of [a Medicare Advantage] organization that pertain to services performed or determinations of amounts payable under the contract.” (42 U.S.C. 1395w-27(d) (2) (B)).

Furthermore, § 1874(b) of the Act authorizes the Secretary to “contract with any person, agency, or institution to secure on a reimbursable basis such special data, actuarial information, and other information as may be necessary in the carrying out of his functions under Subchapter XVIII.” (42 U.S.C. 1395kk(b).)

Section 1893 of the Act establishes the Medicare Integrity Program, under which the Secretary may contract with eligible entities to conduct a variety of program safeguard activities, including fraud review employing equipment and software technologies that surpass existing capabilities (42 U.S.C. 1395ddd)). These entities are called Program Safeguards Contractors (PSC) and Medicare Drug Integrity Contractors (MEDIC).

Pursuant to the applicable state statutes and guidelines for the Participating State charged with the administration of the Medicaid program, disclosure of the Medicaid data pursuant to this Agreement is for purposes directly connected with the administration of the Medicaid program, in compliance with 42 CFR 431.300 through 431.307. Those purposes include the detection, prosecution, and deterrence of fraud, waste and abuse (FW&A) in the Medicaid program.

PURPOSE (S) OF THE MATCHING PROGRAM:

The purpose of this Agreement is to establish the conditions, safeguards, and procedures under which CMS will conduct a computer matching program with Participating States to study claims, billing, and eligibility information to detect suspected instances of Medicare and Medicaid FW&A. CMS and the Participating State will provide a CMS contractor (hereinafter referred to as the “Custodian”) with Medicare and Medicaid records pertaining to eligibility, claims, and billing which the Custodian will match in order to merge the information as necessary to conduct the match. Utilizing fraud detection software, the information will then be used to identify patterns of aberrant practices and abnormal patterns requiring further investigation. Aberrant practices and abnormal patterns identified in this matching program that constitute FW&A will involve individuals who are practitioners, providers and suppliers of services, Medicare beneficiaries, Medicaid recipients, and other individuals whose information may be maintained in the records.

CATEGORIES OF RECORDS AND INDIVIDUALS COVERED BY THE MATCH:

This computer matching program (CMP) will enhance the ability of CMS and Participating States to detect FW&A by matching claims data, eligibility, and practitioner, provider, and supplier enrollment records of Medicare beneficiaries, practitioners, providers, and suppliers in the Participating State against records of Medicaid recipients, practitioners, providers, and suppliers in the Participating State.

DESCRIPTION OF RECORDS TO BE USED IN THE MATCHING PROGRAM:

National Claims History (NCH), System No. 09-70-0005 was published at 71 FR 67137 (November 20, 2006).

Medicare Multi-Carrier Claims System (MCS) (formerly published as the Carrier Medicare Claims Record (CMCR)), System No. 09-70-0501 was published at 71 FR 64968 (November 6, 2006).

Enrollment Database (EDB), System No. 09-70-0502 was published at 67 FR 3203 (January 23, 2002).

Fiscal Intermediary Shared System (FISS) (formerly published as the Intermediary Medicare Claims Record (IMCR), System No. 09-70-0503 was published at 71 FR 64961 (November 6, 2006).

Unique Physician/Provider Identification Number (UPIN), System No. 09-70-0525, was published at 71 FR 66535 (November 15, 2006).

Medicare Supplier Identification File (MSIF), System No. 09-70-0530 was published at 71 FR 70404 (December 4, 2006).

Provider Enrollment Chain and Ownership System (PECOS), System No. 09-70-0532 was published at 71 FR 60536 (October 13, 2006).

Medicare Beneficiary Database (MBD), System No. 09-70-0536 was published at 71 FR 70396 (December 4, 2006).

Medicare Drug Data Processing System (DDPS), System No. 09-70-0553 was published at 70 FR 58436 (October 6, 2005).

Medicare Advantage Prescription Drug (MARx) System, System No. 09-70-4001 was published at 70 FR 60530 (October 18, 2005).

The records files that will be made available for this matching program by the Participating State include utilization, entitlement, and provider records.

INCLUSIVE DATES OF THE MATCH:

The CMP shall become effective 40 days after the report of the matching program is sent to OMB and Congress, or 30 days after publication in the Federal Register, which ever is later. The matching program will continue for 18 months from the effective date and may be extended for an additional 12 months thereafter, if certain conditions are met.