2020-26859. Agency Information Collection Activities: Proposed Collection; Comment Request

AGENCY:

Centers for Medicare & Medicaid Services, Health and Human Services (HHS).

ACTION:

Notice.

SUMMARY:

The Centers for Medicare & Medicaid Services (CMS) is announcing an opportunity for the public to comment on CMS' intention to collect information from the public. Under the Paperwork Reduction Act of 1995 (the PRA), federal agencies are required to publish notice in the Federal Register concerning each proposed collection of information (including each proposed extension or reinstatement of an existing collection of information) and to allow 60 days for public comment on the proposed action. Interested persons are invited to send comments regarding our burden estimates or any other aspect of this collection of information, including the necessity and utility of the proposed information collection for the proper performance of the agency's functions, the accuracy of the estimated burden, ways to enhance the quality, utility, and clarity of the information to be collected, and the use of automated collection techniques or other forms of information technology to minimize the information collection burden.

DATES:

Comments must be received by February 5, 2021.

ADDRESSES:

When commenting, please reference the document identifier or OMB control number. To be assured consideration, comments and recommendations must be submitted in any one of the following ways:

1. Electronically. You may send your comments electronically to http://www.regulations.gov. Follow the instructions for “Comment or Submission” or “More Search Options” to find the information collection document(s) that are accepting comments.

2. By regular mail. You may mail written comments to the following address: CMS, Office of Strategic Operations and Regulatory Affairs, Division of Regulations Development, Attention: Document Identifier/OMB Control Number _____, Room C4-26-05, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.

To obtain copies of a supporting statement and any related forms for the proposed collection(s) summarized in this notice, you may make your request using one of following:

1. Access CMS' website address at https://www.cms.gov/​Regulations-and-Guidance/​Legislation/​PaperworkReductionActof1995/​PRA-Listing.html.

2. Call the Reports Clearance Office at [phone].

FOR FURTHER INFORMATION CONTACT:

William N. Parham at [phone].

SUPPLEMENTARY INFORMATION:

Contents

This notice sets out a summary of the use and burden associated with the following information collections. More detailed information can be found in each collection's supporting statement and associated materials (see ADDRESSES).

CMS-10733 Data Management Plan Self-Attestation Questionnaire (DMP SAQ)

Under the PRA (44 U.S.C. 3501-3520), federal agencies must obtain approval from the Office of Management and Budget (OMB) for each collection of information they conduct or sponsor. The term “collection of information” is defined in 44 U.S.C. 3502(3) and 5 CFR 1320.3(c) and includes agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. Section 3506(c)(2)(A) of the PRA requires federal agencies to publish a 60-day notice in the Federal Register concerning each proposed collection of information, including each proposed extension or reinstatement of an existing collection of information, before submitting the collection to OMB for approval. To comply with this requirement, CMS is publishing this notice.

Information Collection

1. Type of Information Collection Request: New collection (Request for a new OMB control number); Title of Information Collection: Data Management Plan Self-Attestation Questionnaire (DMP SAQ); Use: The Privacy Act of 1974 allows for discretionary releases of data maintained in Privacy Act protected systems of records under § 552a(b) (Conditions of Disclosure). The mandate to account for disclosures of data under the Privacy Act is found at § 552a(c)(Accounting of Certain Disclosures). This section states that certain information must be maintained regarding disclosures made by each agency. This information is: Date, Nature, Purpose, and Name/Address of Recipient. Section 552a(e) sets the overall Agency Requirements that each agency must meet in order to maintain records under the Privacy Act. The Data Use Agreement (DUA) form is needed as part of the review of each CMS data request to ensure compliance with the requirements of the Privacy Act for disclosures that contain PII.

The DUA legally binds the user to the Agreement's terms. The user must agree to all the terms and sign off on them prior to the release or access to data files containing protected health information, and individual identifiers. The DMP SAQ is a technical, evidence-based questionnaire that DUA users must complete as part of the data request packet. The DMP SAQ will enable CMS to evaluate researcher data systems to ensure that CMS data are adequately secured and appropriately protected, as per the Privacy Act and the HIPAA Privacy Rule. The DMP SAQ also allows CMS to measure compliance through the implementation of security and privacy controls as outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53 and the Centers for Medicare & Medicaid Services (CMS) Information Security and Acceptable Risk Safeguards (ARS). The second component of the DMP SAQ is to provide ongoing oversight. All organizations will be subject to routine audits of the environments used to store and process CMS data, as described in their organizational-level DMP SAQ. Form Number: CMS-10733 (OMB control number: 0938-New); Frequency: Annually; Affected Public: Private Sector, State, Local, or Tribal Governments, Federal Government, Business or other for-profits, Not-for-profits institutions; Number of Respondents: 1,000; Total Annual Responses: 1,000; Total Annual Hours: 1,500. (For policy questions regarding this collection contact James Krometis at 410-786-0340.)

Dated: December 2, 2020.

William N. Parham, III,

Director, Paperwork Reduction Staff, Office of Strategic Operations and Regulatory Affairs.