2019-05175. Privacy Act of 1974; System of Records for the Evaluation of the Supportive Services Demonstration

AGENCY:

Office of Policy Development and Research.

ACTION:

Notice of a new System of Records.

SUMMARY:

Pursuant to the Privacy Act of 1974, as amended, notice is hereby given that the Office of Policy Development and Research (PD&R), U.S. Department of Housing and Urban Development (HUD), provides public notice regarding its System of Records for the Evaluation of the Supportive Services Demonstration (SSD). The SSD is a three-year demonstration sponsored by HUD to test the impact of a new model of housing-based supportive services on the healthcare utilization and housing stability of low-income older adults. HUD's Office of Policy Development and Research contracted with Abt Associates Inc. (Abt) to evaluate the SSD. The evaluation entails matching administrative data already being collected on demonstration participants by HUD, the Centers for Medicare and Medicaid Services (CMS) in the Department of Health and Human Services (HHS), state Medicaid agencies in seven states, and The Lewin Group (the implementation contractor for the demonstration). The various administrative data sets will be matched to demonstration participants and linked using personally identifying information (PII) collected by HUD. The evaluation dataset that results from the administrative data matching will include PII and protected health information (PHI) and is the proposed system of records.

DATES:

This notice will become effective April 18, 2019.

Comments Due Dates: April 18, 2019.

ADDRESSES:

You may submit comments, identified by docket number and title, by one of the following methods: Interested persons are invited to submit comments regarding this notice to the Rules Docket Clerk, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW, Room 10139, Washington, DC 20410. Comments may be filed electronically by accessing: www.regulations.gov. Regulations.gov provides clear instructions on how to submit a public comment on a rule. Communications should refer to the above docket number and title. Faxed comments are not accepted. A copy of each communication submitted will be available for public inspection and copying between 8 a.m. and 5 p.m. weekdays at the above address.

FOR FURTHER INFORMATION CONTACT:

John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of Housing and Urban Development; Washington, DC 20410-0001; telephone number 202-708-3054 (this is not a toll-free number). Individuals who are hearing- or speech-impaired may access this telephone number via TTY by calling the Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION:

The new System of Records will encompass administrative data assembled by HUD's contractor, Abt Associates Inc., for the Evaluation of the Supportive Services Demonstration, which is designed to assess the implementation and impact of a new approach to help low-income seniors in HUD-assisted multifamily developments successfully age in place. In January 2016, HUD solicited applications for the Supportive Services Demonstration for Elderly Households in HUD-Assisted Multifamily Housing. The Notice of Funding Availability (NOFA) offered grant funding to multifamily property owners to implement the Integrated Wellness in Supportive Housing (IWISH) model over a three-year period. A total of 124 HUD-assisted properties, housing approximately 13,000 elderly residents, are participating in the demonstration. These properties are located in seven states: California, Illinois, Maryland, Massachusetts, Michigan, New Jersey, and South Carolina.

The evaluation will collect qualitative information through questionnaires, interviews, and focus groups to assess the implementation of the demonstration. The data will not be store and retrieved using PII, and therefore will not be records in the system. The evaluation will also measure the impacts of the demonstration by obtaining pre-existing administrative data for residents of the 124 demonstration properties and matching those data to create a linked evaluation dataset. The data sources that will be part of the linked dataset and will be records in the system are:

• Data from HUD's Tenant Rental Assistance Certification System (TRACS) system. The TRACS data are available for all residents of the 124 properties and provides the PII used to retrieve information on demonstration participants from the other data sources.
• Medicare claims and enrollment data collected by CMS and made available for research through CMS's Research Data Assistance Center (ResDAC).
• Medicaid claims and enrollment data collected by the seven states in the study
• Self-reported demographic and health and social status information collected by The Lewin Group for demonstration participants who enroll in the Integrated Wellness in Supportive Housing (IWISH) pilot program. These data are collected via the Population Health Logistics (PHL) platform, which is covered by a separate SORN, “HUD Supportive Services Demonstration/Integrated Wellness in Supportive Housing: Privacy Act of 1974; System of Records,” published in the Federal Register on February 15, 2018 (83 FR 6875).

The evaluation will use the PII contained in the TRACS data to link HUD administrative records for demonstration participants to Medicaid and Medicare claims data and select data from the PHL platform. The evaluation supports HUD's mission by fulfilling legislatively mandated requirements for evaluation and evaluating the effectiveness of the Supportive Services Demonstration. The demonstration and evaluation support HUD's mission of meeting the need for quality affordable rental homes and utilizing housing as a platform for improving quality of life.

The new notice states the name and location of the record system, the authority for and manner of its operations, the categories of individuals that it covers, the type of records that it contains, the sources of the information for the records, the routine uses made of the records, and the types of exemptions in place for the records. The notice also includes the business address of the HUD officials who will inform interested persons of how they may gain access to and/or request amendments to records pertaining to themselves.

Publication of this notice allows the Department to provide new information about its system of records notices in a clear and cohesive format. The new system of records will incorporate Federal privacy requirements and Department's policy requirements. The Privacy Act places on Federal agencies principal responsibility for compliance with its provisions, by requiring Federal agencies to safeguard an individual's records against an invasion of personal privacy; protect the records contained in an agency system of records from unauthorized disclosure; ensure that the records collected are relevant, necessary, current, and collected only for their intended use; and adequately safeguard the records to prevent misuse of such information. In addition, this notice demonstrates the Department's focus on industry best practices to protect the personal privacy of the individuals covered by this SORN.

Pursuant to the Privacy Act and the Office of Management and Budget (OMB) guidelines, a report of the system of records was submitted to OMB, the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Government Reform, as instructed by paragraph 7a of OMB Circular No. A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” December 23, 2016.

SYSTEM NAME AND NUMBER:

Administrative Dataset for the Evaluation of HUD's Supportive Services Demonstration Evaluation.

SECURITY CLASSIFICATION:

No information in the system is classified.

SYSTEM LOCATION:

Abt Associates has headquarters at 6130 Executive Blvd., Rockville, MD 20852. Records are stored in Abt's Analytic Computing Environment (ACE 3), which meets NIST SP 800-53 Revision 4 FISMA Moderate Standards, and utilizes FedRAMP Moderate accredited services from Amazon as infrastructure. Amazon is located at 410 Terry Ave. N, Seattle, WA 98109. HUD's Office of Policy Development and Research, Program Evaluation Division, is located at 471 Seventh Street SW, Room 8120, Washington, DC 20410.

SYSTEM MANAGER(S):

Carol S. Star, Program Evaluation Division, Office of Policy Development and Research, U.S. Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410; telephone number 202-402-6139 (this is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Sec. 501 and 502 of the Housing and Urban Development Act of 1970 (Pub. L. 91-609), 12 U.S.C. 1701z-1, 1701z-2.

PURPOSE(S) OF THE SYSTEM:

The purpose of the system is to allow the Department to study information gathered on Supportive Services Demonstration IWISH pilot program participants in comparison to other participants receiving HUD-assisted elderly housing. The system will be used to link, store, and analyze the administrative data collected through the SSD evaluation (HUD data, Medicare data, Medicaid data, and PHL data). Use of this system is essential to the successful implementation of the evaluation because analyzing person-level linked health and housing data is the main way the evaluation will measure the impacts of the demonstration on participating residents. Matching existing data from different federal and state government agencies is an innovative and cost-effective evaluation method that minimizes data collection burden on the public.

HUD and policy makers will use the information collected through the evaluation to understand the effectiveness and outcomes of the IWISH model. The evaluation will provide insight to Congress, HUD, grantee states, and other interested parties on issues to consider in providing housing-based supportive services. It will also provide rigorous, quantitative data on the impact of housing-based supportive services on healthcare utilization and housing stability among older adults in HUD-assisted housing.

The goal of the IWISH pilot being evaluated is to help low-income seniors to age in their own homes and delay or avoid the need for nursing home care. IWISH features a full-time Resident Wellness Director (RWD) with a part-time Wellness Nurse (WN) at each property. The RWD and WN work together to implement a formal strategy for coordinating services to help residents meet their needs. This strategy includes six key components:

• Resident engagement and a program rollout process to maximize participation.
• Standardized assessment with all participants after program enrollment and periodically throughout demonstration.
• A healthy aging plan for each participant and each property to address identified needs and interests, and a wellness and service coordination process to implement plans and address other resident needs.
• A centralized, web-based platform for tracking and monitoring resident and program data.
• Partnerships with appropriate local social service and health providers.
• Use of appropriate evidence-based health and wellness programs.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Residents of 124 HUD-assisted multifamily housing properties in California, Illinois, Maryland, Massachusetts, Michigan, New Jersey and South Carolina. Most individuals will be low-income seniors aged 62 or older.

CATEGORIES OF RECORDS IN THE SYSTEM:

• HUD-Tenant Rental Assistance Certificate System (TRACS): Tenant-level data on HUD-assisted residents. Data include age, race, ethnicity, household size, income, housing cost, and length of tenure, as well as PII (name, DOB, SSN) for purposes of data matching to Medicare, Medicaid, and PHL data.
• CMS/ResDAC Data (Medicare): Medicare fee-for-service (FFS) claims, Master Beneficiary Summary File (Enrollment Database), and Minimum Data Set 3.0 (MDS) from ResDAC. The data in these files include: inpatient, outpatient, skilled nursing facility, hospice, home health, carrier and Durable Medical Equipment Center (DMERC) claims, Part D event files, and nursing home assessment data. Data include PII and PHI. We will obtain the data through a Data Use Agreement with ResDAC, the contractor that manages external data requests on behalf of CMS.
• State Medicaid Data: Medicaid enrollment, fee-for-service (FFS) claims, and managed care encounter data. Data include PII and PHI. We will obtain data through separate Data Use Agreements with each of the seven states featured in the study.
• PHL Data: Self-reported demographic and health and social status information data on demonstration participants enrolled in IWISH collected by The Lewin Group. The main data items are (for each participant) an assessment of health and wellness, individual healthy aging plan, and data on the services and programs used. Includes PII and PHI. Data will be obtained through a Data Use Agreement with The Lewin Group, which is covered by a separate SORN, “HUD Supportive Services Demonstration/Integrated Wellness in Supportive Housing: Privacy Act of 1974; System of Records,” published in the Federal Register on February 15, 2018 (83 FR 6875).

RECORD SOURCE CATEGORIES:

HUD will obtain the records from one federal agency (HHS/CMS); state Medicaid agencies in seven states (California, Illinois, Maryland, Massachusetts, Michigan, New Jersey and South Carolina); and one private entity, HUD's contractor for the implementation of the demonstration, The Lewin Group. The focus groups and interviews conducted for the evaluation are not a source of records for the purposes of the SORN.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. Section 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside HUD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

1. To contractors, experts, consultants with whom HUD has a contract, service agreement, or other assignments of the Department, when necessary to utilize relevant data for purposes of testing new technology and systems designed to enhance program operations and performance.

2. To appropriate agencies, entities, and persons when (1) HUD suspects or has confirmed that there has been a breach of the system of records; (2) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

3. To another Federal agency or Federal entity, when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Abt provides all project staff with HIPAA Rules of the Road—Practical Information for Ensuring Compliance; IRB 101 Training; General Security Awareness Training; and CITI Human Subjects Training. All study team members also undergo project specific training on maintaining privacy and safe data storage and handling procedures.

All study team members will be made aware of the project-specific data regulations and best practices associated with handling data for the study. These practices are incorporated in the study protocol and will be detailed in training plans for interviewers, support staff, and data analytic staff. Abt will receive PII information from HUD TRACS data, including full name, date of birth, gender, SSN, address, for all residents of the 124 HUD-assisted multifamily properties in the demonstration.

HUD will transmit the data to Abt through either Huddle, Abt's FedRAMP Moderate accredited file transfer service for moving data in and out of the system, or another secure file transfer system (SFTP) of HUD's choice. Abt will access the data through its Analytic Computing Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA Moderate Standards, and utilizes FedRAMP Moderate accredited services from Amazon as infrastructure. Only authorized Abt staff will have access to the data on ACE 3 and to the project-specific folder on Huddle.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Once records are stored in Abt's database, records will be retrieved by Abt staff that are listed in data agreements as the individuals that can handle the data when PII or PHI is included in that data. Sessions are marked inactive when users log out of the system or stop working in the system for more than fifteen minutes. Records with PII will primarily be retrieved to obtain data from ResDAC and the State Medicaid agencies and to merge the four types of data: HUD TRACS, Medicare, Medicaid, and PHL into one evaluation data set. The personal identifiers used for these additional data sources are SSN, first and last name, and date of birth. Identifiers will only be retained where necessary for analysis. Any identifiers not needed for analysis (such as SSN) will be removed from the evaluation data set before analysis begins.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

The system of records will be retained by the contractor for no later than three years after the completion of the contract. After this time, no copies of or extracts from the person-level administrative data files, including names, address information, social security numbers, birthdates, or other identifiers shall be retained by the contractor. No later than three years after the completion of the contract, and pursuant to the terms of the individual data use agreements, the contractor will destroy the person-level administrative data obtained for the study from entities other than HUD. This includes:

• Medicare claims data provided by CMS/ResDAC
• Medicaid claims data provided by the seven states in the study
• PHL data (provided by The Lewin Group)

The contractor will return to HUD the person-level administrative database file obtained from HUD's TRACS system, with appended information on whether an individual was enrolled at any time in the IWISH program, the date of the resident's enrollment, and the date (if applicable) of the residents dis-enrollment from the program. (The information on enrollment will be obtained from the PHL data and will be included in the data use agreement with The Lewin Group.)

The contractor will also provide to HUD the programming code used to merge the database files and to conduct the analysis for the final reports, as part of the replication protocol described below. Published reports will be posted on HUDUser.gov. The replication protocol will be archived in perpetuity.

The retention and disposal procedures are in keeping with HUD's records management policies as described in 44 U.S.C. 3101 and 44 U.S.C. 3303 and with HUD's Records Disposition Schedule 67 for PD&R, Item 6. (https://portal.hud.gov/​hudportal/​documents/​huddoc?​id=​22256x67ADMH.pdf).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The study's approved data security plan describes the safeguarding of any hardcopy, recorded, and electronic information on human subjects that will be a part of the study. All study team members are aware of the project-specific data regulations and best practices associated with handling data for the study. These practices are incorporated in the study protocol and will be detailed in training plans for interviewers, support staff, and data analytic staff. All staff who will have access to the data containing PII or PHI information sign a confidentiality agreement per the requirements of all data use agreements.

Abt will guarantee this level of restricted access by only using secure transfer mechanisms, such as Huddle, Abt's FedRAMP Moderate accredited file transfer service for moving data in and out of the system, or another secure file transfer system (SFTP) of the transferring agency's choice. Abt will also only access the data through its restricted access folder on the Analytic Computing Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA Moderate Standards, and utilizes FedRAMP Moderate accredited services from Amazon as infrastructure.

RECORD ACCESS PROCEDURES:

For information, assistance, or inquiry about records, contact John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10226; U.S. Department of Housing and Urban Development; Washington, DC 20410-0001, telephone number 202-6064 (this is not a toll-free number). When seeking records about yourself from this system of records or any other Housing and Urban Development (HUD) system of records, your request must conform with the Privacy Act regulations set forth in 24 CFR part 16. You must first verify your identity, meaning that you must provide your full name, address, and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made, under penalty of perjury, as a substitute for notarization. If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying their agreement for you to access their records. Without the above information, the HUD FOIA Office may not conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:

The Department's rules for contesting contents of records and appealing initial denials appear in 24 CFR part 16, Procedures for Inquiries. Additional assistance may be obtained by contacting John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of Housing and Urban Development; Washington, DC 20410-0001, or the HUD Departmental Privacy Appeals Officers; Office of General Counsel; U.S. Department of Housing and Urban Development; 451 7th Street SW, Washington, DC 20410-0001.

NOTIFICATION PROCEDURES:

Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the component's FOIA Officer, whose contact information can be found at http://www.hud.gov/​foia under “contact.” if an individual believes more than one component maintains Privacy Act records concerning him or her the individual may submit the request to the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

None.

Dated: March 13, 2019.

John Bravacos,

Senior Agency Official for Privacy.