2011-29282. Privacy Act of 1974: New System of Records

AGENCY:

U.S. Office of Personnel Management (OPM).

ACTION:

Notice of a revised system of records OPM Central-16, Health Claims Disputes External Review Services.

SUMMARY:

The Patient Protection and Affordable Care Act, Public Law 111-148, was enacted on March 23, 2010, and the Health Care and Education Reconciliation Act (the Reconciliation Act), Public Law 111-152, was enacted on March 30, 2010 (jointly referred to as “the Affordable Care Act”). The Affordable Care Act and implementing regulations (codified in Department of Heath and Human Services (HHS) amended interim final rules (IFR) at 45 CFR Part 147) require that non-grandfathered health insurance plans and issuers offering group and individual coverage have effective internal claims and appeals and external review processes. The effective date for these requirements is plan or policy years beginning on or after September 23, 2010. Regarding external review, the statute requires that health plans and issuers comply with either a state external review process or a process meeting standards issued by the Secretary of Health and Human Services (HHS) that is “similar to” a state process meeting requirements in section 2719 (of what?) (a “federal external review process”). The IFR now includes a transition period prior to January 1, 2012, during which time HHS will work with states to assist in making any necessary changes so that the state process will meet either the minimum consumer protections identified in 45 CFR 147.136 or, until January 1, 2014, the temporary standards listed in Technical Release 2011-02 that must be met in order for the state process to apply. Currently, the Office of Personnel Management (OPM) is administering an interim federal external review process for states that have not passed an external review law that was in effect on September 23, 2010. Beginning January 1, 2012, OPM will administer a federal external review process for all states that do not meet the required minimum consumer protections identified in the interim final regulations.

On September 16, 2010, OPM published a system of records that includes data relevant to external reviews entitled OPM Central 16, Health Claims Disputes External Review Services. OPM now proposes three changes to the system of records. First, OPM proposes expanding the categories of individuals covered by the system of records to include individuals covered by plans and issuers in all states that fail to comply with the minimum standards promulgated by HHS. In addition, the category of individuals that may utilize the external review process provided by OPM and covered by this system of records is further qualified—they must now be covered by a plan that has elected to participate in the external review process operated by OPM and the individual's claim must involve a rescission of coverage or medical judgment.

The second change to the system of records reflects OPM's requirement that claimants provide additional information necessary to determine whether the claimant is eligible for review. In some cases, much of this additional information may have already have been included under the original system of records notice because the information may be derived from documents provided by insurers. However, we have added three additional categories of information: The claimant's county name, an indication from the claimant of whether the external review request is for an urgent care claim, and an indication from the claimant of whether the external review request is related to a rescission of coverage or medical judgment.

Third, the routine uses have been expanded to include disclosure to a contractor for adjudication of the entire appeal. After October 1, 2011, the external review process may be administered by one or more Independent Review Organization(s) (IRO) under contract with OPM and under OPM's direction. This systems notice has also been modified to account for the possible involvement of IROs in this process. In accordance with specific contract provisions, the IRO(s) must comply with the requirements of The Privacy Act.

DATES:

This action will be effective without further notice on January 1, 2012 unless comments are received that would result in a contrary determination.

ADDRESSES:

Send written comments to the Office of Personnel Management, ATTN: Lynelle Frye, Health Claims Disputes External Review Services, 1900 E Street NW., Rm. 3415, Washington, DC 20415.

FOR FURTHER INFORMATION CONTACT:

Lynelle Frye, [phone].

SUPPLEMENTARY INFORMATION:

The program associated with this system of records is part of a broader initiative directed by HHS's Office of Consumer Information and Insurance Oversight (OCIIO) to implement Section 2719 of the Affordable Care Act. HHS has discretion under the Act in the manner in which it implements the external appeals process, OPM administers a health insurance appeals program as part of its Federal Employees Health Benefits Program, and OPM has offered to permit HHS/OCIIO to utilize its existing appeals processes and frameworks to administer the interim federal appeals process (as modified by an interagency agreement). HHS/OCIIO has accepted that offer. Consequently, OPM has authority to administer the program, using an arrangement under the Economy Act, 31 U.S.C. 1535.

U.S. Office of Personnel Management.

John Berry,

Director.

SYSTEM NAME:

OPM/Central-16 Health Claims Disputes External Review Services

SYSTEM LOCATION:

Office of Personnel Management, 1900 E Street NW., Washington, DC 20415.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

This system will contain records on adverse benefit determinations and final internal adverse benefit determinations for claimants who qualify for external review according to the IFR and choose to appeal to OPM. Individuals may only appeal to OPM (1) if they purchase a health insurance policy or a group health plan from a health insurance issuer in a state that does not have an external review law that complies with the minimum standards promulgated by HHS or if they are enrolled in a self-insured nonfederal governmental health plan, (2) if they are in a non-grandfathered plan, (3) if the plan or policy year begins on or after September 23, 2010, (4) if the plan or policy has elected to participate in the external review process operated by OPM, and (5) if the claim involves a rescission of coverage or medical judgment. Health insurance issuers must notify claimants upon notice of an adverse benefit determination or final internal adverse benefit determination as to how to initiate an external review by OPM if they choose to do so. This notice must meet the requirements of 45 CFR Part 147(b)(2)(ii)(E).

CATEGORIES OF RECORDS IN THE SYSTEM:

In order to adjudicate an appeal, OPM requires claimants or their authorized representatives to submit the following information:

a. The denial of benefits or coverage that the individual received from the insurance plan or issuer;

b. Name,

c. Insurance ID number,

d. Phone number and mailing address,

e. The state and county in which they are insured,

f. An indication whether the external review request is for an urgent care claim,

g. An indication whether the external request is for review of a rescission or termination of coverage or involves medical judgment,

h. A brief statement of the reason for the external review request,

i. The insurer's name,

j. The claim number,

k. In cases where an authorized representative requests the external review, evidence of authorization from the authorized representative; and

Any additional information necessary to process the request for review that may be required by HHS regulation or guidance. In addition, claimants may choose to submit additional information that will become part of the system of records. This information is likely to include the following:

a. A statement about why the claimant believes their health insurance issuer's decision was wrong, based on specific benefit provisions in the plan brochure or contract;

b. Copies of documents that support the claim, such as physicians' letters, operative reports, bills, medical records, and explanation of benefits (EOB) forms;

c. Copies of all letters the claimant sent to their insurance plan about the claim;

d. Copies of all letters the health insurance issuer sent to the claimant about the claim;

e. The claimant's daytime phone number and the best time to call; and

f. The claimant's email address if they would like to receive OPM's decision via email.

Health insurance issuers will provide additional information and documentation. Consequently, the records in the system may include all of the following information:

a. Personal Identifying Information (Name, Social Security Number, Date of Birth, Gender, Phone number etc).

b. Address (Current, Mailing).

c. Dependent Information (Spouse, Dependents and their addresses).

d. Employment information.

e. Health care provider information.

f. Health care coverage information.

g. Health care procedure information.

h. Health care diagnosis information.

i. Provider charges and reimbursement information on coverage, procedures and diagnoses.

j. Any other letters or other documents submitted in connection with adverse benefit determinations or final internal adverse benefit determinations by claimants, healthcare providers, or health insurance issuers.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

HHS has authority to administer the program under Sections 2701 through 2763, 2791, and 2792 of the Public Health Service Act (42 U.S.C. 300gg through 300gg-63, 300gg-91, and 300gg-92), as amended. HHS has discretion under the Act in the manner in which it implements the external appeals process, and it has entered an agreement with OPM under the Economy Act, 31 U.S.C. 1535, to provide such services.

PURPOSE:

The primary purpose of this system of records is to aid in the administration of external review of adverse benefit determinations and final internal adverse benefit determinations. OPM must have the capacity to collect, manage, and access health insurance benefits appeals information and documents on an ongoing basis in order for OPM to:

a. Determine eligibility for the federal external review process operated by OPM.

b. Review the adverse benefit determinations and final internal adverse benefit determinations to provide effective external review.

c. Track the progress of individual appeals and ensure that claimants do not submit duplicative appeals.

d. Make information available for any subsequent litigation related to a disputed external review decision.

e. Monitor whether health insurance issuers are providing benefits to which covered individuals are entitled.

f. Maintain records for parties to the dispute so that the covered individual and the insurance issuer can obtain a record of past appeals in which they were involved.

g. Track and report to HHS on the administration of the program.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed to authorized entities, as is determined to be relevant and necessary, including disclosures outside of OPM as a routine use under 5 U.S.C. 552a(b)(3) as follows:

a. For claims adjudication—To disclose information to agency contractors conducting claim reviews for the purpose of adjudicating an appeal.

b. For law enforcement purposes—To disclose pertinent information to the appropriate Federal, State, or local agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, where OPM becomes aware of an indication of a violation or potential violation of civil or criminal law or regulation.

c. For congressional inquiries—To provide information to a congressional office from the record of an individual in response to an inquiry from that congressional office made at the request of that individual.

d. For judicial/administrative proceedings—To disclose information to another Federal agency, to a court, or a party in litigation before a court or in an administrative proceeding being conducted by a Federal agency, when the Government is a party to the judicial or administrative proceeding. In those cases where the government is not a party to the processing, records may be disclosed if a subpoena has been signed by a judge.

e. For litigation purposes—To disclose to the Department of Justice or in a proceeding before a court, adjudicative body, or other administrative body before which OPM or HHS is authorized to appear, when:

1. OPM, HHS, or any component thereof; or

2. Any employee of OPM or HHS in his or her official capacity; or

3. Any employee of OPM or HHS in his or her individual capacity where the Department of Justice or OPM or HHS has agreed to represent the employee; or

4. The United States, when OPM or HHS determines that litigation is likely to affect OPM or HHS or any of their components; is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or OPM of HHS is deemed by OPM to be relevant and necessary to the litigation provided, however, that the disclosure is compatible with the purpose for which records were collected.

f. In the event of data breach—Records may be disclosed to appropriate Federal agencies and agency contractors that have a need to know the information for the purpose of assisting the agency's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records and the information disclosed is relevant and necessary for that assistance.

g. For National Archives and Records Administration or the General Services Administration—For use in records management inspections conducted pursuant to 44 U.S.C. 2904 and 2906.

h. Researchers in and outside the Federal government for the purpose of conducting research on health care and health insurance trends and topical issues. Only de-identified data will be shared.

POLICIES AND PRACTICES OF STORING, RETRIEVING, SAFEGUARDING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

Disclosure to consumer Reporting Agencies:

None.

Storage:

Paper records will be stored in a locked file cabinet within OPM and/or any contractors. Any electronic records will be maintained in electronic systems.

Retrievability:

Records will primarily be manipulated, managed and summarized using a unique number assigned to each appeal. However, information may also be accessible by name or social security number.

Safeguards:

Paper records will be delivered to a locked P.O. Box and kept in a locked file cabinet. Electronic records will be maintained on password protected computers and systems. All individuals with access to these records will receive a background check and privacy training before accessing any of the records. OPM also restricts access to the records on the databases to employees who have the appropriate clearance. OPM and/or any contractors will comply with the Health Insurance Portability and Accountability Act (HIPAA); The Federal Information Security Management Act (FISMA); the Privacy Act; and Section 508 of the U.S. Rehabilitation Act. Contractors must also complete or have completed a security control assessment that conforms to the specifications provided in NIST SP 800-53, ISO 27001, or most recent DIACAP.

Retention and Disposal:

OPM and/or any contractors shall retain files for 75 calendar days before considering offsite storage in the event of judicial review. OPM and/or any contractors will maintain the records for 6 years. All records must be destroyed at the end of 6 years after OPM and/or any contractor issues a final decision on the review. Any computer records will be destroyed by electronic erasure. Any hard copies of records will be destroyed by shredding. A records retention schedule will be established with NARA.

System Manager and Address:

Edward DeHarde, U.S. Office of Personnel Management, Healthcare and Insurance, 1900 E Street NW., Washington, DC 20415.

Notification Procedure:

Individuals wishing to determine whether this system of records contains information about them may do so by writing to the U.S. Office of Personnel Management, FOIA Requester Service Center, 1900 E Street NW., Room 5415, Washington, DC 20415-7900 or by emailing [e-mail].

Individuals must furnish the following information for their records to be located:

a. Full name.

b. Date and place of birth.

c. Social Security Number.

d. Signature.

e. Available information regarding the type of information requested, including the name of the insurance plan involved in any appeal and the approximate date of the appeal.

f. The reason why the individual believes this system contains information about him/her.

g. The address to which the information should be sent.

Individuals requesting access must also comply with OPM's Privacy Act regulations regarding verification of identity and access to records (5 CFR part 297). In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

• If executed outside the United States: `I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on [date]. [Signature].'
• If executed within the United States, its territories, possessions, or commonwealths: `I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on [date]. [Signature].'

Contesting Record Procedure:

Individuals wishing to obtain a copy of their records or to request amendment of records about them should write to the Office of Personnel Management, ATTN: Lynelle Frye, Policy Analyst, Planning and Policy Analysis, Health Claims Disputes External Review Services, Room 3415, Washington, DC 20415, and furnish the following information for their records to be located:

a. Full name.

b. Date and place of birth.

c. Social Security Number.

d. Signature.

e. Available information regarding the type of information that the individual seeks to have amended, including the name of the insurance plan involved in any appeal and the approximate date of the appeal.

Individuals requesting amendment must also follow OPM's Privacy Act regulations regarding verification of identity and amendment to records (5 CFR part 297). In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

• If executed outside the United States: `I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on [date]. [Signature].'
• If executed within the United States, its territories, possessions, or commonwealths: `I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on [date]. [Signature].'

Record Source Categories:

Information in this system of records is obtained from:

a. Individuals who request OPM review.

b. Authorized representatives of covered individuals.

c. Health care providers.

d. Health insurance plans.

e. Medical professionals providing expert medical review under contract with OPM.

System Exemptions:

None.