2011-21285. Privacy Act of 1974; System of Records

AGENCY:

Office of the Secretary of Defense, Department of Defense (DoD).

ACTION:

Notice to add a system of records.

SUMMARY:

The Office of the Secretary of Defense proposes to add a system of records to its inventory of record systems subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended.

DATES:

This proposed action would be effective without further notice on September 21, 2011 unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number and title, by any of the following methods:

• Federal Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Mail: Federal Docket Management System Office, 1160 Defense Pentagon, Washington, DC 20301-1160.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Ms. Cindy Allard, Chief, OSD/JS Privacy Office, Freedom of Information Directorate, Washington Headquarters Services, 1155 Defense Pentagon, Washington, DC 20301-1155, or by phone at [phone].

SUPPLEMENTARY INFORMATION:

The Office of the Secretary of Defense notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the address in FOR FURTHER INFORMATION CONTACT.

The proposed system report, as required by 5 U.S.C. 552a(r) of the Privacy Act of 1974, as amended, was submitted on August 12, 2011, to the House Committee on Oversight and Government Reform, the Senate Committee on Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996 (February 20, 1996, 61 FR 6427).

Dated: August 15, 2011.

Aaron Siegel,

Alternate OSD Federal Register Liaison Officer, Department of Defense.

DHA 23

System name:

Pharmacy Data Transaction Service (PDTS).

System location:

Primary: Emdeon Business Services, LLC, 2045 Midway Drive, Twinsburg, OH 44087-1933.

Alternate: Emdeon Business Services, LLC, 3993 Suite B, Crowfarn Drive, Memphis, TN 38118-7326.

Categories of individuals covered by the system:

Members of the uniformed services (and their dependents) and retired military members (and their dependents), contractors participating in military deployments or related operations, DoD civilian employees (to include non-appropriated fund employees), and other individuals who receive or have received drug prescriptions dispensed and/or filled at military treatment facilities, via TRICARE mail-order, the TRICARE retail pharmacy network, and commercial pharmacies.

Categories of records in the system:

Electronic data extracted from an individual's pharmacy and prescription records.

Patient Data:

Name, Social Security Number (SSN)and/or DoD Identification (ID) Number (or foreign identification number), visit date and time, date of birth, mailing address, home telephone number, family member prefix (if appropriate), relationship to policy holder, and service branch classification.

Sponsor Data:

This includes name, SSN and/or DoD ID Number, date of birth, relationship to policy holder, gender, insurance policy holder name, and data on Health Care Delivery Program Plan coverage.

Employer Data:

Employer's name, address, and telephone number.

Other Data:

Primary care manager, primary care manager network provider, copayment factor, primary care manager region, and pharmacy coverage, if applicable; ancillary information related to an individual's prescriptions, including prior authorizations and certificates of medical necessity; Medicare and Medicaid coverage data; and data on enrollment in various health care programs within the DoD and contracted health care programs provided through commercial prescription benefit managers and through Medicare Part D.

Authority for maintenance of the system:

10 U.S.C. chapter 55, Medical and Dental Care; 32 CFR 199.17, TRICARE Program; 45 CFR part 160, Health and Human Services, General Administrative Requirements; 45 CFR part 164, Security & Privacy; DoD Instruction 6015.23, Delivery of Healthcare at Military Treatment Facilities; and E.O. 9397 (SSN), as amended.

Purpose(s):

To establish a central repository for coordination of benefits of pharmacy records pertaining to prescriptions dispensed and/or filled at military treatment facilities, via TRICARE mail-order, the TRICARE retail pharmacy network, and privately owned pharmacies.

To improve efficiency and patient safety by reducing the likelihood of drug adverse reactions and abuse involving prescription medications and to discourage prescription shopping.

To provide data necessary to conduct Prospective Drug Utilization Review on inbound dispensing transactions and returns alerts when encountering drug/drug interactions, therapeutic duplication, or other clinical circumstances as defined by system requirements.

To provide a data warehouse component to support operational, clinical, and economic studies of TRICARE prescription activity.

Information may also be used as a management tool for statistical analysis, tracking, reporting, evaluating program effectiveness, and conducting research.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, as amended, these records may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

To the Centers for Medicare and Medicaid Services and to the Department of Veterans Affairs for coordination of benefits.

The DoD `Blanket Routine Uses' set forth at the beginning of the Office of the Secretary of Defense (OSD) compilation of systems of records notices apply to this system.

Note 1:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation (DoD 6025.18-R), issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most such health information. DoD 6025.18-R may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974, as amended, or mentioned in this system of records notice.

Note 2:

Personal identity, diagnosis, prognosis or treatment information of any patient maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States is, except as per 42 U.S.C. 290dd-2, treated as confidential and disclosed only for the purposes and under the circumstances expressly authorized under 42 U.S.C. 290dd-2.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Electronic storage media.

Retrievability:

Records are retrieved by patient's name, SSN and/or DoD ID Number, date of birth, family member prefix or dependent suffix; or sponsor's name, Social Security Number (SSN) and/or DoD ID Number.

Safeguards:

Records are maintained in a controlled area accessible only to authorized personnel. Entry is further restricted to personnel with a valid requirement and authorization. Physical entry is restricted by the use of locks and passwords and administrative procedures which are changed periodically.

This system collects and distributes records on a system-to-system basis that does not require end-user direct interaction. However, in the rare instances when a record must be retrieved by a qualified individual, such access is through the system's Pharmacy Operations Center. Access to personally identifiable information in this system of records is restricted to those who require the data in the performance of the official duties, and have received proper training relative to the Privacy Act of 1974, as amended, 45 CFR part 160, Health and Human Services, General Administrative Requirements; and 45 CFR part 164, Security & Privacy, and DoD Information Assurance Regulations.

Auditing:

Audit trail records from all available sources are enabled and available for review at all times for indications of inappropriate or unusual activity. Suspected violations of information assurance policies are analyzed and reported in accordance with DoD and Military Health System/TRICARE Management Activity specific information system information assurance procedures.

Retention and disposal:

Records are retained for two years and then deleted.

System manager(s) and address:

Director, DoD Pharmacy Informatics, TRICARE Management Activity, Pharmaceutical Operations Directorate, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3201.

Notification procedure:

Individuals seeking to determine whether information about themselves is contained in this system should address written inquiries to the TRICARE Management Activity, Department of Defense, ATTN: TMA Privacy Officer, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3206.

Requests should contain the full names of the beneficiary and sponsor, sponsor's SSN and/or DoD ID Number, sponsor's service, beneficiary's date of birth, beneficiary's gender, and treatment facility(ies) that have provided care.

If requesting health information of a minor (or legally incompetent person), the request must be made by that individual's parent, guardian, or person acting in loco parentis. Written proof of the capacity of the requestor may be required.

Record access procedures:

Individuals seeking access to records about themselves contained in this system of records should address written inquiries to TRICARE Management Activity, Attention: Freedom of Information Act Requester Service Center, 16401 East Centretech Parkway, Aurora, CO 80011-9066.

Requests should contain the full names of the beneficiary and sponsor, sponsor's SSN and/or DoD ID Number, sponsor's service, beneficiary date of birth, beneficiary gender, and treatment facility(ies) that have provided care, the name and number of this system of records notice and be signed.

If requesting health information of a minor (or legally incompetent person), the request must be made by that individual's parent, legal guardian, or person acting in loco parentis. Written proof of the capacity of the requestor may be required.

Contesting record procedures:

The OSD rules for accessing records, for contesting contents and appealing initial agency determinations are published in OSD Administrative Instruction 81; 32 CFR part 311, or may be obtained from the system manager.

Record source categories:

Information is obtained from Military Departments' medical treatment facilities, commercial healthcare providers under contract to the Military Health System, the Defense Enrollment Eligibility Reporting System, the Uniformed Service Treatment Facility Managed Care System, commercial pharmacies, and the Department of Veterans Affairs.

Exemptions claimed for the system:

None.