Privacy Act of 1974; Report of New System of Records
Federal Register, Volume 79 Issue 108 (Thursday, June 5, 2014)
Federal Register Volume 79, Number 108 (Thursday, June 5, 2014)
Notices
Pages 32547-32550
From the Federal Register Online via the Government Printing Office www.gpo.gov
FR Doc No: 2014-13012
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
Privacy Act of 1974; Report of New System of Records
AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).
ACTION: Notice of a New System of Records (SOR).
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of 1974, CMS is establishing a new SOR titled, ``Open Payments,'' System No. 09-70-0507, to implement the requirements in Section 6002 of the Patient Protection and Affordable Care Act of 2010 (ACA) (Pub. L. 111-
148), which added section 1128G to the Social Security Act (the Act). The Open Payments program requires applicable manufacturers and applicable Group Purchasing Organizations (GPOs) to report payments and other transfers of value to covered physician recipients as defined by 42 CFR 403.902, as well as certain ownership or investment interests held by physicians and/or their immediate family members in such applicable manufacturers and/or applicable GPOs. CMS is required to publish the data submitted by applicable manufacturers or GPOs on a public Web site.
DATES: Effective Dates: July 7, 2014. Written comments should be submitted on or before the effective date. HHS/CMS/Center for Program Integrity (CPI) may publish an amended SORN in light of any comments received.
ADDRESSES: The public should address comments to: CMS Privacy Officer, Privacy Policy Compliance Group, Office of E-Health Standards & Services, Office of Enterprise Management, CMS, 7500 Security Boulevard, Baltimore, MD 21244-1870, Mailstop: S2-24-25, Office: (410) 786-5357, Email: walter.stone@cms.hhs.gov. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9:00 a.m.-3:00 p.m., Eastern Time zone.
FOR FURTHER INFORMATION CONTACT: Data Sharing and Partnership Group, Center for Program Integrity, Centers for Medicare & Medicaid Services, 7210 Ambassador Road, Mail Stop AR-18-50, Baltimore, MD 21244. Email: veronika.peleshchukfradlin@cms.hhs.gov.
SUPPLEMENTARY INFORMATION: Applicable Manufacturers and/or applicable GPOs are required to report payments and other transfers of value to covered physician recipients. Additionally, applicable manufacturers and/or applicable GPOs are required to report information pertaining to certain ownership or investment interests held by physicians and/or their immediate family members in such applicable manufacturers and/or applicable GPOs. Such reports are to be made annually to CMS in an electronic format. Applicable Manufacturers and/or applicable GPOs are subject to civil monetary penalties for failing to comply with the reporting requirements. CMS will publish the reported data on a public Web site. The data must be downloadable, easily searchable, and aggregated. In addition, CMS must submit annual reports to the Congress and each state summarizing the data reported.
Title 42 Code of Federal Regulations (CFR) 403.908(g) provides covered physician recipients and physicians who are owners or investors a 45-day review period to review data submitted about them and submit corrections prior to the data becoming available to the public. Additionally, 42 CFR 403.908(g)(3)(iv) and (v) provides covered physician recipients and physicians who are owners or investors an opportunity to dispute the accuracy of such information. Covered physician recipients and physician owners or investors will indicate which information regarding a specific payment or other transfer of value is being disputed. Applicable Manufacturers and/or applicable GPOs will receive a notification that a covered physician recipient and/or a physician who is an owner or investor is disputing reported information. The dispute resolution process is between the applicable manufacturers and/or the applicable GPOs, and the covered physician recipients and physicians who are owners or investors. If a dispute is resolved or if errors/omissions are discovered, the applicable manufacturer or applicable GPO is required to submit corrected data to CMS. Upon receipt, CMS notifies the affected covered physician recipient and/or the physician who is an owner or investor that the additional information has been submitted and is available for review. CMS updates the Web site at least once annually with corrected information.
The Privacy Act
The Privacy Act governs the collection, maintenance, use, and dissemination of certain information about individuals by agencies of the Federal Government.
Page 32548
A ``SOR'' is a group of any records under the control of a Federal agency from which information about individuals is retrieved by name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a description of the type and character of each system of records that the agency maintains, and the routine uses that are contained in each system to make agency recordkeeping practices transparent, to notify individuals regarding the uses to which their records are put, and to assist individuals to more easily find such files within the agency.
System Number: 09-70-0507
System Name:
Open Payments System.
Security Classification:
Unclassified.
System Location:
Lockheed Martin's Virtual Data Center hosted by Terremark Network Access Point (NAP) of the National Capital Region (NCR) facility located at Culpeper, Virginia and CMS Data Center, Baltimore, Maryland 21244-1850.
Categories Of Individuals Covered By The System:
The system will contain information about the following categories of individuals covered by the Open Payments program: (1) Physicians and authorized representatives of physicians and teaching hospitals and, (2) any applicable manufacturers and applicable GPO system users.
Categories Of Records In The System:
Information collected about applicable manufacturers or applicable GPOs includes but is not limited to profile information for the company and users interacting with the Open Payments system on the applicable manufacturers or applicable GPOs' behalf. Such information includes but may not be limited to user first name and last name, business contact information and job title.
Information collected about physicians in the Open Payments system includes but is not limited to physician's name, specialty, business address, business phone number, National Provider Identifier (NPI) number, state license numbers, types and descriptions as to the nature and form of payments received from applicable manufacturers or applicable GPOs, amounts of payments, natures and context of payments and dates of payments. With respect to payments that were made in relation to a particular covered drug, device, biological, or medical supply, the name of that covered drug, device, biological, or medical supply shall also be reported. With respect to physicians who hold certain ownership or investment interests in such manufacturers and/or GPOs, or who have immediate family members who hold such ownership or investment interests in such manufacturers and/or GPOs, collected information will include the dollar amount invested; the value and terms of such ownership or investment, and information pertaining to any payment or other transfer of value provided to a physician holding such an ownership interest.
Teaching hospital information also includes profile information for the users interacting with the Open Payments system on the hospital's behalf. Such information includes but may not be limited to user's first name and last name, business contact information, and job title.
Authority For Maintenance Of The System:
Authority for the SOR is given by Title 42 U.S.C. Sec. 1128G 42 U.S.C. 1320a-7h.
Purpose(S) Of The System:
The purpose(s) of this SOR is to maintain information submitted by applicable manufacturers and/or applicable GPOs regarding payments or other transfers of value provided to covered physician recipients, as well as certain ownership or investment interests in such entities held by physicians and/or their immediate family members. CMS may use information from this system to: (1) Support regulatory, reimbursement, and policy functions performed by Agency contractors, consultants, or CMS grantees; (2) assist Federal agencies and their fiscal agents in performing the statutory functions of the Open Payments; (3) assist applicable manufacturers or applicable GPOs with the statutory reporting requirements; (4) comply with the requirements of 42 U.S.C. 1320a-7h, and publish the information submitted on a public Web site; (5) support research and program evaluation activities; (6) support litigation involving the agency; (7) assist with fraud, waste, and abuse detection and prevention activities; (8) assist agencies, entities, contractors, or persons tasked with the response and remedial efforts in the event of a breach of information, and (9) assist the U.S. Department of Homeland Security (DHS) cyber security personnel.
Routine Uses Of Records Maintained In The System, Including Categories Or Users And The Purposes Of Such Uses:
These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from Open Payments without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish the following routine use disclosures of information maintained in the system:
-
To support Agency personnel, contractors, consultants, or CMS grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this collection and who need to have access to the records in order to assist CMS.
-
To assist another Federal, agency of a State government, an agency established by State law, or its fiscal agents with information that is necessary and/or required in order to perform the statutory functions of Open Payments.
-
To provide applicable manufacturers and applicable GPOs with information they need to meet any statutory requirements of the program, assist with other reports as required by CMS, and to assist in the implementation of statutory reporting requirements.
-
To comply with the requirements of Section 6002 of the ACA and 42 CFR Part 403 to publish payment or other transfers of value and investment interest information submitted by applicable manufacturers or applicable GPOs on a public Web site. CMS will notify covered recipients, physician owners and investors, and applicable manufacturers or applicable GPOs when data are available for public viewing via a public announcements and listserv messages.
-
To support an individual or organization for research, program evaluation or epidemiological projects related to transparency initiatives around financial relationships between drug and medical device manufacturers and physicians, and teaching hospitals.
-
To provide information to the U.S. Department of Justice (DOJ), a court, or an adjudicatory body when (a) the Agency or any component thereof, or (b) any employee of the Agency in his or her official capacity, or (c) any
Page 32549
employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court, or adjudicatory body is compatible with the purpose for which the agency collected the records;
-
To assist a CMS contractor (including, but not limited to Medicare Administrative Contractors, fiscal intermediaries, and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program;
-
To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs;
-
To disclose records to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance; and
-
To assist the U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program.
Policies And Practices For Storing, Retrieving, Accessing, Retaining, And Disposing Of Records In The System.
Storage:
All records are stored is a relational database in CMS Virtual Data Center hosted by Terremark Network Access Point (NAP) of the National Capital Region (NCR) facility located at Culpeper, Virginia.
Retrievability:
Information about physicians and their authorized representatives may be retrieved by any of these personal identifiers: physicians' name, address, license number, or National Provider Identifier (NPI). Profile information about applicable manufacturer and GPO system users may be retrieved by these identifiers: applicable manufacturers or applicable GPOs' DUNS, name and address. Information may be extracted through a backend database access or through a business intelligence reporting tool by authorized personnel.
Safeguards:
Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
Access to records in the Open Payments database system will be limited to CMS personnel and contractors through password security, encryption, firewalls, and secured operating system. Any electronic copies which contain information about an individual at CMS and contractor locations will be kept in secure electronic files.
Retention And Disposal:
All records in the Open Payments database will be maintained for a period of up to 10 years from the end of the calendar year in which files were made publically available on CMS Web site. Any records that are needed longer, such as audit or other exceptions, will be retained until such matters are resolved.
System Manager And Address:
Director, Data Sharing and Partnership Group, Center for Program Integrity, Centers for Medicare & Medicaid Services, 7210 Ambassador Road, Mail Stop AR-18-50, Baltimore, MD 21244.
Notification Procedure:
Physician covered recipients and physicians who are owners or investors, as well as members of their immediate families will be notified by CMS via an online posting and notifications on CMS's listservs. They may also register with CMS to receive notification about the review processes.
Record Access Procedure:
Physician covered recipients and physicians who are owners or investors, as well as representatives from teaching hospitals, applicable manufacturers and GPOs will be able log into the Open Payments system through a secure Web site to directly view records pertaining to them for the previous reporting year as well as access their profile information.
Contesting Record Procedures:
Title 42 Code of Federal Regulations (CFR.) Sec. 403.908(g) provides covered physician recipients and physicians who are owners or investors, as well as teaching hospitals, a 45-day review period to review data submitted about them and dispute its accuracy and completeness prior to the data becoming available to the public. Additionally, 42 CFR 403.908(g) (3) (iv) and (v) provides covered physician recipients and physicians who are owners or investors an opportunity to dispute the accuracy of such information. Covered recipients and physicians who are owners or investors will indicate which information regarding a specific payment or other transfer of value is being disputed. Applicable Manufacturers and/or applicable GPOs will receive a notification that a covered recipient or physician owner or investor is disputing reported information. The dispute resolution process is between applicable manufacturers, applicable GPOs, covered recipients and physician owners or investors. When a dispute is resolved and/or errors or omissions are discovered, 42 C.F.R Sec. 403.908(g)(4) and (h)(1) require the applicable manufacturer or applicable GPO to submit corrected data to CMS. Upon receipt, CMS notifies the affected covered recipient or physicians who are owner or investor that the additional information has been submitted and is available for review. CMS updates the Web site at least once annually with corrected information after the initial publication.
Record Source Categories:
Information collected and maintained in this database is submitted by applicable manufacturers and/or applicable GPOs.
Exemptions Claimed For This System:
None.
Page 32550
Dated: May 30, 2014.
Niall Brennan,
Acting Director, Offices of Enterprise Management, Centers for Medicare & Medicaid Services.
FR Doc. 2014-13012 Filed 5-30-14; 5:00 pm
BILLING CODE 4120-03-P
