2024-11351. Privacy Act of 1974; Matching Program

AGENCY:

Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS)

ACTION:

Notice of a new matching program.

SUMMARY:

In accordance with subsection (e)(12) of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is providing notice of the establishment of a matching program between CMS and the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) for “Identification and Recovery of Duplicate Payments for Medical Claims.”

DATES:

The deadline for comments on this notice is June 24, 2024. The new matching program will commence not sooner than 30 days after publication of this notice, provided no comments are received that warrant a change to this notice. The matching program will be conducted for an initial term of 18 months (from approximately June 24, 2024 to December 23, 2025) and within 3 months of expiration may be renewed for one additional year if the parties make no change to the matching program and certify that the program has been conducted in compliance with the matching agreement.

ADDRESSES:

Interested parties may submit written comments on the new matching program to the CMS Privacy Act Officer by mail at: Division of Security, Privacy Policy & Governance, Information Security & Privacy Group, Office of Information Technology, Centers for Medicare & Medicaid Services, Location: N1-14-56, 7500 Security Blvd., Baltimore, MD 21244-1850, or by email at [e-mail].

FOR FURTHER INFORMATION CONTACT:

If you have questions about the matching program, you may contact Richard Mazur, CMS Technical Adviser, Division of Medicare Secondary Payer Operations, Financial Services Group, Office of Financial Management, Centers for Medicare & Medicaid Services, at 410-786-1418, by email at [e-mail], or by mail at 7500 Security Blvd., Baltimore, MD 21244.

SUPPLEMENTARY INFORMATION:

The Privacy Act of 1974, as amended (5 U.S.C. 552a) provides certain protections for individuals applying for and receiving federal benefits. The law governs the use of computer matching by federal agencies when records in a system of records (meaning, federal agency records about individuals retrieved by name or other personal identifier) are matched with records of other federal or non-federal agencies. The Privacy Act requires agencies involved in a matching program to:

1. Enter into a written agreement, which must be prepared in accordance with the Privacy Act, approved by the Data Integrity Board (DIB) of each source and recipient federal agency, provided to Congress and the Office of Management and Budget (OMB), and made available to the public, as required by 5 U.S.C. 552a(o), (u)(3)(A), and (u)(4).

2. Notify the individuals whose information will be used in the matching program that the information they provide is subject to verification through matching, as required by 5 U.S.C. 552a(o)(1)(D).

3. Verify match findings before suspending, terminating, reducing, or making a final denial of an individual's benefits or payments or taking other adverse action against the individual, as required by 5 U.S.C. 552a(p).

4. Report the matching program to Congress and the OMB, in advance and annually, as required by 5 U.S.C. 552a(o) (2)(A)(i), (r), and (u)(3)(D).

5. Publish advance notice of the matching program in the Federal Register as required by 5 U.S.C. 552a(e)(12).

This matching program meets these requirements.

Barbara Demopulos,

Privacy Act Officer, Division of Security, Privacy Policy and Governance, Office of Information Technology, Centers for Medicare & Medicaid Services.

Participating Agencies

The Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is the recipient agency, and the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is the source agency.

Authority for Conducting the Matching Program

The authority for the matching program is 42 U.S.C. 1320a-7k and 1395 et seq.; and 38 U.S.C. 1703 and 1725.

Purpose(s)

The purpose of the matching program is to identify dual enrolled beneficiaries and duplicate claims for the benefit of both CMS and VHA. The matching program will assist both agencies in identifying those VHA enrolled beneficiaries who are also enrolled as Medicare beneficiaries, the specific claims where VHA and CMS made duplicate payments for the same health care services, and potential fraud, waste, and abuse. The claims for which both agencies made payment for the same service(s) will be reviewed by both agencies, and recoupment action will be initiated against the providers as appropriate.

Although Privacy Act records about beneficiaries will be used to conduct the matches, the match results will be used to take actions affecting only providers and suppliers. Some providers and suppliers are solo practitioners (individuals), but they are not Privacy Act-covered individuals in this matching program, because the claims payment records to be used in this matching program are retrieved by beneficiary identifiers only.

Categories of Individuals

The categories of individuals whose information will be used in the matching program are: (1) Veterans enrolled in VHA healthcare, and (2) Medicare enrolled beneficiaries (Part A and B) identified as dual enrolled beneficiaries.

Categories of Records

The categories of records which will be used in the matching program are VHA beneficiary identifying information and Medicare beneficiary identifying information.

VHA Finder Files will include the following data elements about VHA beneficiaries:

a. Transaction type: Add or Update

b. SSN

c. Medicare Claim Number (if available)

d. Date of Birth

e. Beneficiary First Name

f. Beneficiary Last Name

g. Beneficiary Sex

h. Enrollment Category (Enrolled or Not Enrolled)

i. Enrollment Status

j. Enrollment time frames: effective date and/or, when applicable, end date

k. Date of Death (if applicable)

CMS Response Files will include the following data elements about Medicare beneficiaries identified as dual enrolled:

a. Action type: Add/Update/Delete Record

b. SSN

c. MBI

d. Date of Birth

e. Beneficiary First Name

f. Beneficiary Last Name

g. Beneficiary Sex code

h. Medicare Enrollment time frames: Effective and termination dates

i. Medicare and VHA Dual enrollment timeframes: Effective and termination dates

j. Date of death

System(s) of Records

The records used in the matching program will be disclosed from the following systems of records, as authorized by routine uses published in the system of records notices (SORNs) cited below:

A. Systems of Records Maintained by CMS

1. Common Working File (CWF), System No. 09-70-0526, last published in full at 71 FR 64955 (Nov. 6, 2006), and partially updated at 78 FR 23938 (Apr. 23, 2013), 78 FR 32257 (May 29, 2013), and 83 FR 6591 (Feb. 14, 2018). Routine uses 2a and 10 authorize disclosures to VHA to contribute to the accuracy of CMS' proper payment of Medicare benefits, and to investigate potential fraud, waste, or abuse.

2. Medicare Beneficiary Database (MBD), System No. 09-70-0536, last published in full at 71 FR 70396 (Dec. 4, 2006), and partially updated at 78 FR 23938 (Apr. 23, 2013), 78 FR 32257 (May 29, 2013), and 83 FR 6591 (Feb. 14, 2018). Routine uses 2a and 11 authorize disclosures to VHA to contribute to the accuracy of CMS's proper payment of Medicare benefits, and to investigate potential fraud, waste, or abuse.

3. Medicare Integrated Data Repository (IDR), System No. 09-70-0571, last published in full at 71 FR 74915 (Dec. 13, 2006), and partially updated 76 FR 65196 (Oct. 20, 2011), 78 FR 23938 (Apr. 23, 2013), 78 FR 32257 (May 29, 2013), and 83 FR 6591 (Feb. 14, 2019). Routine uses 2a and 11 authorize disclosures to VHA to contribute to the accuracy of CMS's proper payment of Medicare benefits, and to investigate potential fraud, waste, or abuse.

4. National Claims History (NCH), System No. 09-70-0558, last published in full at 71 FR 67137 (Nov. 20, 2006), and partially updated at 76 FR 65196 (Oct 20, 2011), 78 FR 23938 (Apr. 23, 2013), 78 FR 32257 (May 29, 2013), and 83 FR 6591 (Feb. 14, 2018). Routine uses 2a and 10 authorize disclosure to VHA to contribute to the accuracy of CMS's proper payment of Medicare benefits, and to investigate potential fraud, waste, or abuse.

B. Systems of Records Maintained by VHA

1. SOR 147VA10, entitled “Enrollment and Eligibility Record-VA,” last published at 86 FR 46090 (Aug. 17, 2021). Routine use 12 authorizes disclosures to federal agencies for purposes of preventing and detecting possible fraud or abuse by individuals in their operations and programs.

2. SOR 23VA10NB3, entitled “Non-VA Care (Fee) Records,” last published at 80 FR 45590 (July 30, 2015). Routine use 12 authorizes disclosures to CMS for its use in identifying potential duplicate payments for healthcare services paid by VA and CMS. Routine use 30 authorizes disclosure to assist in preventing and detecting possible fraud or abuse by individuals in federal programs.