2015-20224. Privacy Act of 1974: Report of New System of Records

AGENCY:

Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS)

ACTION:

Notice of New System of Records (SOR).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, we are proposing to establish a new SOR titled, “CMS Risk Adjustment Suite of Systems (RASS),” System No. 09-70-0508. Payments to Medicare Advantage (MA) organizations, Part D sponsors, and Program of All Inclusive Care for the Elderly (PACE) organizations (collectively referred to as “MA organizations and other entities”) are adjusted based on the health status of enrolled Medicare beneficiaries (“enrollees”). RASS is established to receive, process, and store the data used to risk-adjust payments based on enrollee health status. The data will be used specifically to develop risk adjustment models and to calculate the risk score for each enrollee.

Each MA organization and other entity must submit data to CMS in accordance with CMS regulations and instructions. “Risk adjustment data” refers to data submitted in two separate formats: comprehensive data equivalent to Medicare fee-for-service data (often referred to as encounter data); and data in abbreviated formats (often referred to as RAPS data). The MA risk adjustment data addressed by this SOR includes RAPS data submitted by a MA organization in an abbreviated format, as referenced at § 422.310(d)(1), and similar abbreviated risk adjustment data submitted by other MA organizations and other entities. Encounter data has a separate SOR (System No. 09-70-0506).

DATES:

Effective 30 days after publication. Written comments should be submitted on or before the effective date. HHS/CMS/CM may publish an amended system of records notice (SORN) in light of any comments received.

ADDRESSES:

The public should address comments to: CMS Privacy Officer, Division of Security, Privacy Policy & Governance, Information Security & Privacy Group, Office of Enterprise Information, CMS, 7500 Security Boulevard, Baltimore, MD 21244-1870, Mailstop: N1-24-08, Office: [phone], email: [e-mail]. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9 a.m.-3 p.m., Eastern Time zone.

FOR FURTHER INFORMATION CONTACT:

Risk Adjustment Mailbox Coordinator, Division of Encounter Data and Risk Adjustment Operations, Medicare Plan Payment Group, Center for Medicare, CMS, Mail Stop C1-13-07, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. The email is [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background on the Risk Adjustment Suite of Systems (RASS)

The new RASS system of records is being established to cover data used to create risk adjustment scores needed to risk-adjust payments to Medicare and Medicaid provider entities, based on beneficiary demographics and health status. Risk-adjusted payments will implement reformatory provisions of the Social Security Act at sections 1853(a), 1860D-15(c), and 1894(d)(2) (42 U.S.C. 1395w-23, 1395w-115, and 1395eee), intended to collect and accurately calculate scores based on a beneficiary's demographics and health status. RASS will cover data housed in two existing information systems: The Risk Adjustment Processing System (RAPS), and the Risk Adjustment System (RAS). RAS will contain data extracted from RAPS and from two other IT systems (CME and NMUD), as more fully explained below:

○ RAPS will receive abbreviated current risk adjustment data, consisting of diagnosis data about each beneficiary and the beneficiary's health care provider type, submitted by the relevant payee entity through the Front-End Risk Adjustment System (FERAS); RAPS will use the data to create an enrollee diagnosis data file for each beneficiary (See Categories of Records for data elements).

○ RAS will extract the enrollee diagnosis data files from RAPS and will receive current demographic, enrollment and diagnoses data and past medical history data for each enrollee from two other CMS systems (CME and NMUD); RAS will use the RAPS, CME, and NMUD data to calculate risk factors and create a Risk Adjustment Factor (RAF) file, containing the risk score of each beneficiary:

Common Medicare Environment (CME): RAS will extract current individual demographic and enrollment data about each enrollee (See Categories of Records for data elements).

National Claims History files housed in the National Medicare Utilization Database (NMUD): RAS will extract current Medicare Fee-for-service (FFS) diagnoses information submitted on Inpatient, Outpatient, and Physician claims for each enrollee (See Categories of Records for data elements).

○ RAS will transmit the Risk Adjustment Factor (RAF) file created in RAS to CMS' payment processing system for purposes of calculating and adjusting payments to payee entities, as follows:

CMS pays MA organizations on a monthly prospective amount for each beneficiary enrolled (enrollee) in a Part C plan.

CMS pays Part D sponsors a monthly prospective amount that reflects the plan sponsor's estimate of the revenue needed to cover a plan's costs for the risk portion of basic prescription drug coverage. The direct subsidy is adjusted based on the beneficiary's risk score, which reflects expected prescription drug expenditures for the coverage year (relative to a national average of 1.0), based on demographic and health status information for that person.

CMS pays PACE organizations a monthly capitation amount based on the Part A and Part B payment rates established for purposes of payment to Medicare Advantage organizations pursuant to 1894(d)(2). CMS will ensure that payments take into account the comparative frailty of PACE enrollees relative to the general Medicare population.

In addition to providing the file used to calculate risk adjustment payments, the RASS also provides reports for CMS based on the analysis of RAF files and other criteria; these reports include MA plan file submission transactions (acceptance rates, rejection rates, error rates, etc.) on a daily, weekly, monthly, and quarterly basis.

II. The Privacy Act

The Privacy Act governs the collection, maintenance, use, and dissemination of certain information about individuals by agencies of the Federal Government.

A “SOR” is a group of any records under the control of a Federal agency from which information about individuals is retrieved by name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register notice of the existence and character of each SOR that the agency maintains. The System of Records Notice (SORN) identifies or describes the laws authorizing the system to be maintained; the types and sources of records in the system; the categories of individuals to whom the records pertain; the purposes for which the records are used within the agency; the routine uses for which a record maybe disclosed to parties outside the agency without the individual's prior, written consent; agency policies and procedures for safeguarding, storing, retrieving, accessing, retaining, and disposing of the records; the procedures for an individual to follow to make notification, access, and amendment requests to the System Manager; and whether the SOR is exempt from certain Privacy Act requirements.

System Number:

09-70-0508

System Name:

CMS Risk Adjustment Suite of Systems (RASS), HHS/CMS/CM.

Security Classification:

Unclassified.

System Location:

RASS (RAS/RAPS) Location: CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.

Categories of Individuals Covered by the System:

Information collected and maintained in this system pertains to: (1) Medicare beneficiaries enrolled in a Part C MA plan, MA-PD plan, PDP or PACE organization (“enrollees”) and (2) the health care provider(s), supplier(s), physician(s), or other practitioner(s) (“Providers”) who provide health care items and services to these enrollees.

Categories of Records in the System:

The MA plans, MA-PDs, PDPs and PACE organizations (“MA organizations and other entities”) receive the data from the providers which is then submitted to RAPS via FERAS. The data received from the MA organizations and other entities are primarily diagnosis data extracted from claims information. Additional FFS and utilization data regarding those submissions are received from the CME and NCH data systems to complete the enrollee data requirements.

Records will consist of the risk score for each enrollee and the data used to calculate the score, contained in Risk Adjustment Factor (RAF) files created in CMS' Risk Adjustment System (RAS), using data extracted from three other CMS IT systems:

• RAPS data: Diagnosis data files containing abbreviated current diagnosis data submitted by payee entities to CMS's Risk Adjustment Processing System (RAPS):

○ Health Insurance Claim Number (HICN)

○ Provider Type

○ Service From Date

○ Service Through Date

○ Plan Number (MAO contract number)

○ Diagnosis Code

○ Diagnosis Delete Date

○ RAS Diagnosis Indicator

○ NCH Category Equitable BIC

○ Accrete Data

○ Delete Plan Number

○ Submitter ID

○ Daily File Code, and

○ Delete File Code

• CME data: Current demographic and enrollment data from CMS's Common Medicare Environment (CME):

○ Beneficiary Link Key Partition number

○ Beneficiary Link Identifier

○ Health Insurance Claim Number (HICN)

○ Beneficiary Social Security Number

○ Beneficiary Birth Date

○ Beneficiary Death Date

○ Beneficiary Sex Code

○ Beneficiary Race Code

○ Beneficiary First Name

○ Beneficiary Middle Name

○ Beneficiary Last Name

• NCH data: Current diagnosis data [and past medical history data] from National Claims History Files in CMS's National Medicare Utilization Database (NMUD):

○ Health Insurance Claim Number (HICN)

○ NCH Category Equitable BIC

○ Diagnosis code

○ Service Through Date

○ Service From Date

○ Beneficiary Link Identifier

○ Provider Number

Authority for Maintenance of the System:

This system was established pursuant to sections 1853(a), 1860D-15(c), and 1894(d)(2)of the Social Security Act (42 U.S.C. 1395w-23, 1395w-115, 1395eee).

Purpose(s) of the System:

Records will be used within the agency to develop risk adjustment models and to calculate the risk score for each Medicare beneficiary enrolled in the Medicare health plan. The risk score will be reported to the system that CMS uses to process payments, and ultimately will be used to adjust payments to MA organizations, Part D sponsors, and PACE organizations, based on beneficiary health status. (Note that payment records are not covered under this system of records.)

Information retrieved from this SOR will be used for the following purposes:

• To determine the risk adjustment factors used to adjust payments to MA organizations and other entities, as required under 42 CFR 422.304(a) and (c), 423.329 and 460.180
• to update risk adjustment models
• to calculate Medicare Disproportionate Share Hospital (DSH) percentages
• to conduct quality review and improvement activities for Medicare coverage purposes
• to conduct evaluations and other analysis to support the Medicare program (including demonstrations)
• to support public health initiatives and other health care-related research
• for activities to support the administration of the Medicare program
• for activities conducted to support program integrity
• for purposes authorized by applicable law

Routine Uses of Records Maintained in the System, Including Categories or Users and the Purposes of Such Uses:

Records may be disclosed to parties outside HHS, without the individual record subject's prior, written consent, for the following purposes:

1. To determine the risk adjustment factors used to adjust payments, as required under §§ 422.304(a) and (c), 423.329, and 460.180, to update risk adjustment models, to calculate Medicare DSH percentages, to conduct quality review and improvement activities, for Medicare coverage purposes, to conduct evaluations and other analysis to support the Medicare program (including demonstrations) and to support public health initiatives, for activities conducted to support program integrity, and for purposes authorized by applicable law.

2. To support CMS contractors, consultants, or grantees that have been contracted by the Agency when necessary to assist in accomplishment of a CMS function relating to the purposes for this system or a purpose listed in paragraph 1.

3. To support an individual or organization for research to support the Medicare program and public health initiatives, and otherwise related to health care, such as evaluation or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or for understanding and improving payment projects.

4. To provide information to the U.S. Department of Justice (DOJ), a court, or an adjudicatory body when (a) the Agency or any component thereof, or (b) any employee of the Agency in his or her official capacity, or (c) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or (d) the United State Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court, or adjudicatory body is compatible with the purpose for which the agency collected the records.

5. To assist a CMS contractor (including, but not limited to Medicare Administrative Contractors, fiscal intermediaries, and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.

6. To assist another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.

7. To assist Medicare Advantage organizations, Part D Sponsors and PACE organizations with improving the quality of required risk adjustment data obtained from the provider that furnished the item or service. CMS will be analyzing the data received and advising MA organizations, Part D Sponsors and PACE organizations of trends and data analysis results to help improve the accuracy and completeness of data received from the provider.

8. To assist appropriate Federal agencies and CMS contractors and consultants that have a need to know the information for the purpose of assisting CMS' efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided that the information disclosed is relevant and necessary for that assistance.

Note:

CMS may disclose information from this system of records, without the individual record subject's consent, for any of the following purposes referenced directly in the Privacy Act: 5 U.S.C. 552a(b)(1), (3)-(8), and (12). CMS must also disclose information from this system of records, without the individual record subject's consent, for any of the following purposes referenced directly in the Privacy Act: 5 U.S.C. 552a(b)(2), and (b)(9)-(11).

Additional Provisions Affecting Routine Use Disclosures:

This system contains Protected Health Information (PHI) as defined by HHS regulation “Standards for Privacy of Individually Identifiable Health Information” (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), subparts A and E). Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the “Standards for Privacy of Individually Identifiable Health Information.”

In addition, our policy will be to prohibit release even of data that is not directly identifiable, except if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).

Note:

Information collected or obtained under § 1860D-15 (i.e., risk adjustment data used to pay Part D plan sponsors) will be used and disclosed only in accordance with the statutory limitations under § 1860D-15(f)(2).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM Storage:

Archived records will be stored on magnetic tapes. Data that is currently in use is stored in the RAPS database.

Retrievability:

Records will be retrieved by National Provider Identifier (NPI), beneficiary provider name, or beneficiary Health Insurance Claim Number.

Safeguards:

Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational, and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems; and to prevent unauthorized access. Access to records in the RASS will be limited to CMS personnel and contractors through password security, encryption, firewalls, and secured operating system(s).

Retention and Disposal:

Records (i.e., enrollee diagnosis data files created in RAPS, and Risk Adjustment Factor (RAF) files created in RAS) will be maintained for a period of up to 10 years after date of creation. Any such records that are needed longer, such as to resolve claims and audit exceptions or to prosecute fraud, will be retained until such matters are resolved. Enrollee claims records are currently subject to a document preservation order and will be preserved indefinitely pending further notice from the U.S. Department of Justice (DOJ).

System Manager and Address:

Director, Division of Encounter Data and Risk Adjustment Operations, Medicare Plan Payment Group, Center for Medicare, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.

Notification Procedure:

Individuals (i.e., the beneficiary or provider) wishing to know if this system contains records about them should write to the system manager and include pertinent personally identifiable information (encrypted and properly transmitted) to be used for retrieval of their records (i.e., NPI or Health Insurance Claim Number).

Record Access Procedure:

Individuals seeking access to records about them in this system should follow the same instructions indicated under “Notification Procedure” and reasonably specify the record content being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).

Contesting Record Procedures:

Individuals seeking to contest the content of information about them in this system should follow the same instructions indicated under “Notification Procedure.” The request should: reasonably identify the record and specify the information being contested; state the corrective action sought; and provide the reasons for the correction, with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)

Record Source Categories:

RASS processes data extracted from RAPS and RAS IT systems to calculate the risk scores used to adjust payments to Medicare Advantage organizations, Part D plan sponsors and PACE plans. RAS receives the most current data for each Medicare Part C and Part D beneficiary from the following sources: RAPS, Common Medicare Environment (CME) also known as Medicare Beneficiary Database (MBD/CME), and National Medicare Utilization Database (NMUD). RAPS receives risk adjustment data from MA organizations and other entities defined above.

Systems Exempted from Certain Provisions of the Act:

None.

Celeste Dade-Vinson,

Health Insurance Specialist, Centers for Medicare & Medicaid Services.