Privacy Act of 1974; System of Records for the Evaluation of the Supportive Services Demonstration
| Published date | 19 March 2019 |
| Citation | 84 FR 10113 |
| Record Number | 2019-05175 |
| Section | Notices |
| Court | Housing And Urban Development Department |
Federal Register, Volume 84 Issue 53 (Tuesday, March 19, 2019)
[Federal Register Volume 84, Number 53 (Tuesday, March 19, 2019)]
[Notices]
[Pages 10113-10117]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-05175]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT
[Docket No. FR-6146-N-03]
Privacy Act of 1974; System of Records for the Evaluation of the
Supportive Services Demonstration
AGENCY: Office of Policy Development and Research.
ACTION: Notice of a new System of Records.
-----------------------------------------------------------------------
SUMMARY: Pursuant to the Privacy Act of 1974, as amended, notice is
hereby given that the Office of Policy Development and Research (PD&R),
U.S. Department of Housing and Urban Development (HUD), provides public
notice regarding its System of Records for the Evaluation of the
Supportive Services Demonstration (SSD). The SSD is a three-year
demonstration sponsored by HUD to test the impact of a new model of
housing-based supportive services on the healthcare utilization and
housing stability of low-income older adults. HUD's Office of Policy
Development and Research contracted with Abt Associates Inc. (Abt) to
evaluate the SSD. The evaluation entails matching administrative data
already being collected on demonstration participants by HUD, the
Centers for Medicare and Medicaid Services (CMS) in the Department of
Health and Human Services (HHS), state Medicaid agencies in seven
states, and The Lewin Group (the implementation contractor for the
demonstration). The various administrative data sets will be matched to
demonstration participants and linked using personally identifying
information (PII) collected by HUD. The evaluation dataset that results
from the administrative data matching will include PII and protected
health information (PHI) and is the proposed system of records.
DATES: This notice will become effective April 18, 2019.
Comments Due Dates: April 18, 2019.
ADDRESSES: You may submit comments, identified by docket number and
title, by one of the following methods: Interested persons are invited
to submit comments regarding this notice to the Rules Docket Clerk,
Office of General Counsel, Department of Housing and Urban Development,
451 Seventh Street
[[Page 10114]]
SW, Room 10139, Washington, DC 20410. Comments may be filed
electronically by accessing: www.regulations.gov. Regulations.gov
provides clear instructions on how to submit a public comment on a
rule. Communications should refer to the above docket number and title.
Faxed comments are not accepted. A copy of each communication submitted
will be available for public inspection and copying between 8 a.m. and
5 p.m. weekdays at the above address.
FOR FURTHER INFORMATION CONTACT: John Bravacos, Senior Agency Official
for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of
Housing and Urban Development; Washington, DC 20410-0001; telephone
number 202-708-3054 (this is not a toll-free number). Individuals who
are hearing- or speech-impaired may access this telephone number via
TTY by calling the Federal Relay Service at 800-877-8339 (this is a
toll-free number).
SUPPLEMENTARY INFORMATION: The new System of Records will encompass
administrative data assembled by HUD's contractor, Abt Associates Inc.,
for the Evaluation of the Supportive Services Demonstration, which is
designed to assess the implementation and impact of a new approach to
help low-income seniors in HUD-assisted multifamily developments
successfully age in place. In January 2016, HUD solicited applications
for the Supportive Services Demonstration for Elderly Households in
HUD-Assisted Multifamily Housing. The Notice of Funding Availability
(NOFA) offered grant funding to multifamily property owners to
implement the Integrated Wellness in Supportive Housing (IWISH) model
over a three-year period. A total of 124 HUD-assisted properties,
housing approximately 13,000 elderly residents, are participating in
the demonstration. These properties are located in seven states:
California, Illinois, Maryland, Massachusetts, Michigan, New Jersey,
and South Carolina.
The evaluation will collect qualitative information through
questionnaires, interviews, and focus groups to assess the
implementation of the demonstration. The data will not be store and
retrieved using PII, and therefore will not be records in the system.
The evaluation will also measure the impacts of the demonstration by
obtaining pre-existing administrative data for residents of the 124
demonstration properties and matching those data to create a linked
evaluation dataset. The data sources that will be part of the linked
dataset and will be records in the system are:
Data from HUD's Tenant Rental Assistance Certification
System (TRACS) system. The TRACS data are available for all residents
of the 124 properties and provides the PII used to retrieve information
on demonstration participants from the other data sources.
Medicare claims and enrollment data collected by CMS and
made available for research through CMS's Research Data Assistance
Center (ResDAC).
Medicaid claims and enrollment data collected by the seven
states in the study
Self-reported demographic and health and social status
information collected by The Lewin Group for demonstration participants
who enroll in the Integrated Wellness in Supportive Housing (IWISH)
pilot program. These data are collected via the Population Health
Logistics (PHL) platform, which is covered by a separate SORN, ``HUD
Supportive Services Demonstration/Integrated Wellness in Supportive
Housing: Privacy Act of 1974; System of Records,'' published in the
Federal Register on February 15, 2018 (83 FR 6875).
The evaluation will use the PII contained in the TRACS data to link
HUD administrative records for demonstration participants to Medicaid
and Medicare claims data and select data from the PHL platform. The
evaluation supports HUD's mission by fulfilling legislatively mandated
requirements for evaluation and evaluating the effectiveness of the
Supportive Services Demonstration. The demonstration and evaluation
support HUD's mission of meeting the need for quality affordable rental
homes and utilizing housing as a platform for improving quality of
life.
The new notice states the name and location of the record system,
the authority for and manner of its operations, the categories of
individuals that it covers, the type of records that it contains, the
sources of the information for the records, the routine uses made of
the records, and the types of exemptions in place for the records. The
notice also includes the business address of the HUD officials who will
inform interested persons of how they may gain access to and/or request
amendments to records pertaining to themselves.
Publication of this notice allows the Department to provide new
information about its system of records notices in a clear and cohesive
format. The new system of records will incorporate Federal privacy
requirements and Department's policy requirements. The Privacy Act
places on Federal agencies principal responsibility for compliance with
its provisions, by requiring Federal agencies to safeguard an
individual's records against an invasion of personal privacy; protect
the records contained in an agency system of records from unauthorized
disclosure; ensure that the records collected are relevant, necessary,
current, and collected only for their intended use; and adequately
safeguard the records to prevent misuse of such information. In
addition, this notice demonstrates the Department's focus on industry
best practices to protect the personal privacy of the individuals
covered by this SORN.
Pursuant to the Privacy Act and the Office of Management and Budget
(OMB) guidelines, a report of the system of records was submitted to
OMB, the Senate Committee on Homeland Security and Governmental
Affairs, and the House Committee on Oversight and Government Reform, as
instructed by paragraph 7a of OMB Circular No. A-108, ``Federal Agency
Responsibilities for Review, Reporting, and Publication under the
Privacy Act,'' December 23, 2016.
SYSTEM NAME AND NUMBER:
Administrative Dataset for the Evaluation of HUD's Supportive
Services Demonstration Evaluation.
SECURITY CLASSIFICATION:
No information in the system is classified.
SYSTEM LOCATION:
Abt Associates has headquarters at 6130 Executive Blvd., Rockville,
MD 20852. Records are stored in Abt's Analytic Computing Environment
(ACE 3), which meets NIST SP 800-53 Revision 4 FISMA Moderate
Standards, and utilizes FedRAMP Moderate accredited services from
Amazon as infrastructure. Amazon is located at 410 Terry Ave. N,
Seattle, WA 98109. HUD's Office of Policy Development and Research,
Program Evaluation Division, is located at 471 Seventh Street SW, Room
8120, Washington, DC 20410.
SYSTEM MANAGER(S):
Carol S. Star, Program Evaluation Division, Office of Policy
Development and Research, U.S. Department of Housing and Urban
Development, 451 7th Street SW, Washington, DC 20410; telephone number
202-402-6139 (this is not a toll-free number).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Sec. 501 and 502 of the Housing and Urban Development Act of 1970
(Pub. L. 91-609), 12 U.S.C. 1701z-1, 1701z-2.
[[Page 10115]]
PURPOSE(S) OF THE SYSTEM:
The purpose of the system is to allow the Department to study
information gathered on Supportive Services Demonstration IWISH pilot
program participants in comparison to other participants receiving HUD-
assisted elderly housing. The system will be used to link, store, and
analyze the administrative data collected through the SSD evaluation
(HUD data, Medicare data, Medicaid data, and PHL data). Use of this
system is essential to the successful implementation of the evaluation
because analyzing person-level linked health and housing data is the
main way the evaluation will measure the impacts of the demonstration
on participating residents. Matching existing data from different
federal and state government agencies is an innovative and cost-
effective evaluation method that minimizes data collection burden on
the public.
HUD and policy makers will use the information collected through
the evaluation to understand the effectiveness and outcomes of the
IWISH model. The evaluation will provide insight to Congress, HUD,
grantee states, and other interested parties on issues to consider in
providing housing-based supportive services. It will also provide
rigorous, quantitative data on the impact of housing-based supportive
services on healthcare utilization and housing stability among older
adults in HUD-assisted housing.
The goal of the IWISH pilot being evaluated is to help low-income
seniors to age in their own homes and delay or avoid the need for
nursing home care. IWISH features a full-time Resident Wellness
Director (RWD) with a part-time Wellness Nurse (WN) at each property.
The RWD and WN work together to implement a formal strategy for
coordinating services to help residents meet their needs. This strategy
includes six key components:
Resident engagement and a program rollout process to
maximize participation.
Standardized assessment with all participants after
program enrollment and periodically throughout demonstration.
A healthy aging plan for each participant and each
property to address identified needs and interests, and a wellness and
service coordination process to implement plans and address other
resident needs.
A centralized, web-based platform for tracking and
monitoring resident and program data.
Partnerships with appropriate local social service and
health providers.
Use of appropriate evidence-based health and wellness
programs.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Residents of 124 HUD-assisted multifamily housing properties in
California, Illinois, Maryland, Massachusetts, Michigan, New Jersey and
South Carolina. Most individuals will be low-income seniors aged 62 or
older.
CATEGORIES OF RECORDS IN THE SYSTEM:
HUD-Tenant Rental Assistance Certificate System (TRACS):
Tenant-level data on HUD-assisted residents. Data include age, race,
ethnicity, household size, income, housing cost, and length of tenure,
as well as PII (name, DOB, SSN) for purposes of data matching to
Medicare, Medicaid, and PHL data.
CMS/ResDAC Data (Medicare): Medicare fee-for-service (FFS)
claims, Master Beneficiary Summary File (Enrollment Database), and
Minimum Data Set 3.0 (MDS) from ResDAC. The data in these files
include: inpatient, outpatient, skilled nursing facility, hospice, home
health, carrier and Durable Medical Equipment Center (DMERC) claims,
Part D event files, and nursing home assessment data. Data include PII
and PHI. We will obtain the data through a Data Use Agreement with
ResDAC, the contractor that manages external data requests on behalf of
CMS.
State Medicaid Data: Medicaid enrollment, fee-for-service
(FFS) claims, and managed care encounter data. Data include PII and
PHI. We will obtain data through separate Data Use Agreements with each
of the seven states featured in the study.
PHL Data: Self-reported demographic and health and social
status information data on demonstration participants enrolled in IWISH
collected by The Lewin Group. The main data items are (for each
participant) an assessment of health and wellness, individual healthy
aging plan, and data on the services and programs used. Includes PII
and PHI. Data will be obtained through a Data Use Agreement with The
Lewin Group, which is covered by a separate SORN, ``HUD Supportive
Services Demonstration/Integrated Wellness in Supportive Housing:
Privacy Act of 1974; System of Records,'' published in the Federal
Register on February 15, 2018 (83 FR 6875).
RECORD SOURCE CATEGORIES:
HUD will obtain the records from one federal agency (HHS/CMS);
state Medicaid agencies in seven states (California, Illinois,
Maryland, Massachusetts, Michigan, New Jersey and South Carolina); and
one private entity, HUD's contractor for the implementation of the
demonstration, The Lewin Group. The focus groups and interviews
conducted for the evaluation are not a source of records for the
purposes of the SORN.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
Section 552a(b) of the Privacy Act, all or a portion of the records or
information contained in this system may be disclosed outside HUD as a
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
1. To contractors, experts, consultants with whom HUD has a
contract, service agreement, or other assignments of the Department,
when necessary to utilize relevant data for purposes of testing new
technology and systems designed to enhance program operations and
performance.
2. To appropriate agencies, entities, and persons when (1) HUD
suspects or has confirmed that there has been a breach of the system of
records; (2) HUD has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, HUD (including
its information systems, programs, and operations), the Federal
Government, or national security; and (3) the disclosure made to such
agencies, entities, and persons is reasonably necessary to assist in
connection with HUD's efforts to respond to the suspected or confirmed
breach or to prevent, minimize, or remedy such harm.
3. To another Federal agency or Federal entity, when HUD determines
that information from this system of records is reasonably necessary to
assist the recipient agency or entity in (1) responding to a suspected
or confirmed breach or (2) preventing, minimizing, or remedying the
risk of harm to individuals, the recipient agency or entity (including
its information systems, programs, and operations), the Federal
Government, or national security, resulting from a suspected or
confirmed breach.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Abt provides all project staff with HIPAA Rules of the Road--
Practical Information for Ensuring Compliance; IRB 101 Training;
General Security Awareness Training; and CITI Human
[[Page 10116]]
Subjects Training. All study team members also undergo project specific
training on maintaining privacy and safe data storage and handling
procedures.
All study team members will be made aware of the project-specific
data regulations and best practices associated with handling data for
the study. These practices are incorporated in the study protocol and
will be detailed in training plans for interviewers, support staff, and
data analytic staff. Abt will receive PII information from HUD TRACS
data, including full name, date of birth, gender, SSN, address, for all
residents of the 124 HUD-assisted multifamily properties in the
demonstration.
HUD will transmit the data to Abt through either Huddle, Abt's
FedRAMP Moderate accredited file transfer service for moving data in
and out of the system, or another secure file transfer system (SFTP) of
HUD's choice. Abt will access the data through its Analytic Computing
Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA
Moderate Standards, and utilizes FedRAMP Moderate accredited services
from Amazon as infrastructure. Only authorized Abt staff will have
access to the data on ACE 3 and to the project-specific folder on
Huddle.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Once records are stored in Abt's database, records will be
retrieved by Abt staff that are listed in data agreements as the
individuals that can handle the data when PII or PHI is included in
that data. Sessions are marked inactive when users log out of the
system or stop working in the system for more than fifteen minutes.
Records with PII will primarily be retrieved to obtain data from ResDAC
and the State Medicaid agencies and to merge the four types of data:
HUD TRACS, Medicare, Medicaid, and PHL into one evaluation data set.
The personal identifiers used for these additional data sources are
SSN, first and last name, and date of birth. Identifiers will only be
retained where necessary for analysis. Any identifiers not needed for
analysis (such as SSN) will be removed from the evaluation data set
before analysis begins.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
The system of records will be retained by the contractor for no
later than three years after the completion of the contract. After this
time, no copies of or extracts from the person-level administrative
data files, including names, address information, social security
numbers, birthdates, or other identifiers shall be retained by the
contractor. No later than three years after the completion of the
contract, and pursuant to the terms of the individual data use
agreements, the contractor will destroy the person-level administrative
data obtained for the study from entities other than HUD. This
includes:
Medicare claims data provided by CMS/ResDAC
Medicaid claims data provided by the seven states in the
study
PHL data (provided by The Lewin Group)
The contractor will return to HUD the person-level administrative
database file obtained from HUD's TRACS system, with appended
information on whether an individual was enrolled at any time in the
IWISH program, the date of the resident's enrollment, and the date (if
applicable) of the residents dis-enrollment from the program. (The
information on enrollment will be obtained from the PHL data and will
be included in the data use agreement with The Lewin Group.)
The contractor will also provide to HUD the programming code used
to merge the database files and to conduct the analysis for the final
reports, as part of the replication protocol described below. Published
reports will be posted on HUDUser.gov. The replication protocol will be
archived in perpetuity.
The retention and disposal procedures are in keeping with HUD's
records management policies as described in 44 U.S.C. 3101 and 44
U.S.C. 3303 and with HUD's Records Disposition Schedule 67 for PD&R,
Item 6. (https://portal.hud.gov/hudportal/documents/huddoc?id=22256x67ADMH.pdf).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
The study's approved data security plan describes the safeguarding
of any hardcopy, recorded, and electronic information on human subjects
that will be a part of the study. All study team members are aware of
the project-specific data regulations and best practices associated
with handling data for the study. These practices are incorporated in
the study protocol and will be detailed in training plans for
interviewers, support staff, and data analytic staff. All staff who
will have access to the data containing PII or PHI information sign a
confidentiality agreement per the requirements of all data use
agreements.
Abt will guarantee this level of restricted access by only using
secure transfer mechanisms, such as Huddle, Abt's FedRAMP Moderate
accredited file transfer service for moving data in and out of the
system, or another secure file transfer system (SFTP) of the
transferring agency's choice. Abt will also only access the data
through its restricted access folder on the Analytic Computing
Environment, ACE 3, which meets NIST SP 800-53 Revision 4 FISMA
Moderate Standards, and utilizes FedRAMP Moderate accredited services
from Amazon as infrastructure.
RECORD ACCESS PROCEDURES:
For information, assistance, or inquiry about records, contact John
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW,
Room 10226; U.S. Department of Housing and Urban Development;
Washington, DC 20410-0001, telephone number 202-6064 (this is not a
toll-free number). When seeking records about yourself from this system
of records or any other Housing and Urban Development (HUD) system of
records, your request must conform with the Privacy Act regulations set
forth in 24 CFR part 16. You must first verify your identity, meaning
that you must provide your full name, address, and date and place of
birth. You must sign your request, and your signature must either be
notarized or submitted under 28 U.S.C. 1746, a law that permits
statements to be made, under penalty of perjury, as a substitute for
notarization. If your request is seeking records pertaining to another
living individual, you must include a statement from that individual
certifying their agreement for you to access their records. Without the
above information, the HUD FOIA Office may not conduct an effective
search, and your request may be denied due to lack of specificity or
lack of compliance with regulations.
CONTESTING RECORD PROCEDURES:
The Department's rules for contesting contents of records and
appealing initial denials appear in 24 CFR part 16, Procedures for
Inquiries. Additional assistance may be obtained by contacting John
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW,
Room 10139; U.S. Department of Housing and Urban Development;
Washington, DC 20410-0001, or the HUD Departmental Privacy Appeals
Officers; Office of General Counsel; U.S. Department of Housing and
Urban Development; 451 7th Street SW, Washington, DC 20410-0001.
NOTIFICATION PROCEDURES:
Individuals seeking notification of and access to any record
contained in this system of records, or seeking to contest its content,
may submit a request in writing to the component's FOIA Officer, whose
contact
[[Page 10117]]
information can be found at http://www.hud.gov/foia under ``contact.''
if an individual believes more than one component maintains Privacy Act
records concerning him or her the individual may submit the request to
the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139,
Washington, DC 20410.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
None.
Dated: March 13, 2019.
John Bravacos,
Senior Agency Official for Privacy.
[FR Doc. 2019-05175 Filed 3-18-19; 8:45 am]
BILLING CODE 4210-67-P
