Privacy Act of 1974; System of Records Notice

AGENCY:

Office of the Secretary (OS), Department of Health and Human Services (HHS).

ACTION:

Notice to establish a new Privacy Act system of records.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended (5 U.S.C. 552a), the Office of Medicare Hearings and Appeals (OMHA) within the Office of the Secretary of Health and Human Services (HHS) is establishing a new system of records, System No. 09-90-1501, entitled “Administrative Law Judge (ALJ) Working File, Office of Medicare Hearings and Appeals,” to cover OMHA ALJ working files previously maintained as part of the Social Security Administration's (SSA) ALJ Working File system of records 60-0005 (last published at 74 FR 19617). The working files covered under new System of Records Notice (SORN) 09-90-1501 are created and used by OMHA ALJs and members of their staffs for internal purposes, to document actions taken by OMHA at the hearing level in each Medicare appeal case that OMHA reviews. The working files are separate from the official case files, which are covered under other SORNs (i.e., HHS SORN 09-70-0566 covers case files on Medicare claims appeals, and SSA SORN 60-0089 covers case files on Medicare entitlement appeals).

DATES:

This system notice is effective immediately, with the exception of the routine uses. The routine uses will be effective 30 days after publication, unless HHS receives comments that warrant a revision to this Notice.

ADDRESSES:

Send public comments by mail or email to: Andrea Monson, Director, Division of Information Management and Systems, 1700 North Moore Street, Suite 1800, Arlington, VA 22209, 703-235-0635, andrea.monson@hhs.gov. Comments will be available for public inspection and copying at the above location.

FOR FURTHER INFORMATION CONTACT:

Andrea Monson, Director, Division of Information Management and Systems, 1700 North Moore Street, Suite 1800, Arlington, VA 22209, 703-235-0635, andrea.monson@hhs.gov.

SUPPLEMENTARY INFORMATION:

I. Background on New System of Records

The Medicare claims appeals process consists of four levels of administrative review within HHS, and a fifth level of review with the federal district courts after administrative remedies within HHS have been exhausted. The first two levels of review are administered by the Centers for Medicare & Medicaid Services (CMS) and conducted by Medicare contractors. The third level of review is administered by OMHA and is conducted by ALJs. Subsequent reviews are conducted at the fourth level of appeal within the Departmental Appeals Board (DAB), and at the fifth level by the federal district courts.

The Medicare entitlement and premium appeals process consists of three levels of administrative review, and a fourth level of review with the federal district courts after administrative remedies have been exhausted. The first level is the reconsideration level conducted by SSA. The second level of review is administered by OMHA and is conducted by ALJs. Subsequent reviews are conducted at the third level of appeal within the DAB and at the fourth level by the federal district courts.

The Department established OMHA in June, 2005, pursuant to section 931 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 108-173) (MMA), which required the transfer of responsibility for the ALJ hearing function of the Medicare claims and entitlement appeals process from SSA to HHS. The MMA requires a unified case tracking system that facilitates the maintenance and transfer of case-specific data across both the fee-for-service and managed care components of the Medicare program. HHS' CMS operates the unified case tracking system required by MMA, which is covered by CMS System of Record Notice No. 09-70-0566, entitled “Medicare Appeals System” (MAS SORN).

OMHA's adjudication process uses a “case file” comprising the official agency record, and an ALJ working file. The case file will continue to be covered by CMS' MAS SORN for Medicare claims appeals. The case file for Medicare entitlement and premium appeals will continue to be covered by the SSA Claims Folders System, Social Security Administration Claims Folders System, Social Security Administration, Office of the General Counsel, Office of Public Disclosure (60-0089). The case file is used throughout the administrative appeals process by the various levels of review.

Only OMHA's ALJ working files will now be covered in the new system of records established by this Notice, to reflect that they are used only by OMHA.

II. The Privacy Act

The Privacy Act (5 U.S.C. 552a) governs the means by which the U.S. Government collects, maintains, and uses information about individuals in a system of records. A “system of records” is a group of any records under the control of a federal agency from which information about an individual is retrieved by the individual's name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a system of records notice (SORN) identifying and describing each system of records the agency maintains, including the purposes for which the agency uses the information about individuals in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act (for example, to seek access to their records in the system).

SYSTEM NUMBER: 09-90-1501

SYSTEM NAME:

Administrative Law Judge (ALJ) Working File, Office of Medicare Hearings and Appeals (OMHA).

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Records are maintained at OMHA headquarters and field offices. Address information is available by accessing the OMHA Web site: http://www.hhs.gov/omha/. Electronic records will be stored in a secured, FedRAMP-compliant, cloud service provider. Source documents will be destroyed once they are scanned and converted to electronic records.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Records pertain to individuals involved in Medicare appeals adjudicated by OMHA, including Medicare beneficiaries or enrollees; physicians; providers; practitioners; suppliers; State Medicaid agencies; other individuals involved in furnishing items and services to health insurance beneficiaries or enrollees; and authorized or appointed representatives of such individuals.

CATEGORIES OF RECORDS IN THE SYSTEM:

OMHA administers nationwide ALJ hearings for appeals of Medicare Part A and Part B claim determinations, Part C organization determinations, Part D coverage determinations that are made by CMS contractors, and appeals of Medicare entitlement and monthly premium determinations made by SSA.

OMHA establishes ALJ working files as a record of actions taken on each particular appeal. The file may contain copies of information from the administrative record, such as the request for hearing, hearing recording, notice of hearing, decision, and exhibit list, as well as copies of post-adjudicative material received and any responses made. Official copies of these materials are placed in the official agency record (case file). The ALJ working file also may contain deliberative working papers such as notes taken during the hearing by the ALJ; case analyses prepared by field office employees; attorney work product; working papers of field office staff; and other case developmental and decision-related notes and instructional sheets. Information in these records that could pertain to individuals includes protected health information; Health Insurance Claim Number (HICN); Social Security Number (SSN); Provider Number, name, address, and other contact information; and billing, tax, and other financial information.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Authority for maintenance of the system is given under § 205 of Title II, §§ 1155 and 1156 of Title XI, §§ 1812, 1814, 1816, 1842, 1869, and 1872 of Title XVIII of the Social Security Act (the Act), as amended (42 United States Code (U.S.C.) sections 405, 1320c-4, 1320c-5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 1395ii). Additional authority for this system is given under Title IX, Subtitle D of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Public Law (Pub. L.) 108-173).

PURPOSE(S):

OMHA uses the records in this system of records to reference the actions OMHA takes in a particular case at the hearing level. For example, during the course of adjudication at the ALJ hearing level, ALJs and members of their staff often construct documents for internal purposes only regarding the evidence, testimony, legal theories, merits of the case, and opinions and advice regarding other factors involved in the case.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM OF RECORDS, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

Relevant information about an individual may be disclosed from this system of records to parties outside HHS, without the individual's prior, written consent, pursuant to these routine uses.

Note: Any information defined as “return or return information” under 26 U.S.C. 6103 of the Internal Revenue Code (IRC) will not be disclosed unless authorized by the IRC, the Internal Revenue Service (IRS), or IRS regulations.

1. To a Member of Congress or to a Congressional staffer in response to a written inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained. The Member of Congress does not have any greater authority to obtain records than the individual would have if requesting the records directly.

2. To the Department of Justice (DOJ), a court or other tribunal, or another party before such tribunal, when:

(a) HHS or any component thereof; or

(b) any HHS employee in his or her official capacity; or

(c) any HHS employee in his or her individual capacity where DOJ (or HHS where it is authorized to do so) has agreed to represent the employee; or

(d) the United States Government,

is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by DOJ, the court or other tribunal, or another party before such tribunal is deemed by HHS to be compatible with the purpose for which HHS collected the records.

3. To IRS, as necessary, for the purpose of auditing HHS's compliance with safeguard provisions of the IRC, as amended.

4. To contractors and other federal agencies that have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of the system of records and that have a need to have access to the records in order to assist HHS in performing the activity. Any contractor will be required to comply with the requirements of the Privacy Act of 1974.

5. To the National Archives and Records Administration (NARA) in records inspections conducted under the authority of 44 U.S.C. 2901 et seq.

6. To student volunteers and other workers performing functions for HHS but technically not having the status of agency employees, if they need access to the records in order to perform their assigned functions.

7. To federal, state, and local law enforcement agencies and private security contractors, as appropriate, if information is necessary

(a) to enable them to protect the safety of HHS employees and customers, the security of the HHS workplace, and the operation of HHS facilities; or

(b) to assist investigations or prosecutions with respect to activities that affect such safety and security or activities that disrupt the operation of HHS facilities.

8. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.

Information about an individual may also be disclosed to parties outside HHS without the individual's prior, written consent for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM—

STORAGE: Records are maintained in electronic and paper form. Currently, OMHA headquarters and field offices keep ALJ working files in paper form. New technology will allow OMHA to store information electronically in the Electronic Case Adjudication and Processing Environment (ECAPE). As a result, records in this system may be paper and electronic.

RETRIEVABILITY: Information is retrieved by name, Social Security Number (SSN), Health Insurance Claim Number (HICN), and assigned provider number or appeal number.

SAFEGUARDS: Only authorized OMHA personnel that have a need for the information in the performance of their official duties are permitted access to the information.

Security measures for electronic access include a minimum of a two-factor authentication solution (such as the use of a Personal Identity Verification (PIV) Card and Personal Identification Number (PIN)) to enter the computer system that will maintain the data, and storage of the computerized records in secured areas that are accessible only to employees who require the information in performing their official duties. Manually maintained records are kept in locked cabinets or in otherwise secure areas.

Personnel allowed access to the records have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system of records are instructed not to release data to an authorized recipient until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.

This system will conform to all applicable federal laws and regulations and federal and HHS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal and HHS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.

RETENTION AND DISPOSAL: OMHA will destroy electronic and paper records by deleting or shredding them 3 years after the final action is taken (see NARA-approved records schedule DAA-0468-2012-0003).

SYSTEM MANAGER AND ADDRESS:

Andrea Monson, Director, Division of Information Management and Systems, 1700 North Moore Street, Suite 1800, Arlington, VA 22209.

NOTIFICATION PROCEDURE:

An individual can determine if this system contains a record about him or her by making a written notification request to the System Manager, showing proof of identity, and providing the system name, the subject individual's name, HICN, address, date of birth, and gender. Furnishing the SSN is voluntary.

RECORD ACCESS PROCECURE:

An individual can obtain access to a record about him or her by using the same procedures outlined in Notification Procedures above and specifying the record contents sought.

CONTESTING RECORD PROCEDURE:

The requesting individual should contact the System Manager named above, and reasonably identify the records and specify the information contested. In addition, the individual should state the corrective action sought and the reasons for the correction and provide supporting justification.

RECORD SOURCE CATEGORIES:

Information in this system of records is obtained from individuals who complete a form requesting a Medicare hearing or appeal, from CMS and its contractors, and from SSA.

SYSTEM EXEMPTED FROM CERTAIN PROVISIONS OF THE PRIVACY ACT:

This system of records is not a type of system eligible to be exempted from certain Privacy Act requirements under subsections (j) and (k) of the Privacy Act (5 U.S.C. 552a(j)(k)); however, to the extent that records contained in the ALJ working files constitute material compiled in reasonable anticipation of a civil action or proceeding, they will be exempt from the Privacy Act's access requirement under 5 U.S.C. 552a(d)(5).