Privacy Act of 1974; Report of New System of Records

In accordance with the requirements of the Privacy Act of 1974, CMS is establishing a new system of records (SOR) titled, "Medicare and Medicaid Electronic Health Record (EHR) Incentive Program National Level Repository" System No. 09-70-0587. The final rule for the Medicare and Medicaid EHR Incentive Program implements the provisions of the American Recovery and Reinvestment Act of 2009 (the Recovery Act) (Pub. L. 111-5). Specifically, Title IV of Division B of the Recovery Act amends Titles XVIII and XIX of the Social Security Act (the Act) by establishing incentive payments to eligible professionals (EPs), eligible hospitals and critical access hospitals (CAHs) and Medicare Advantage (MA) Organizations participating in Medicare and Medicaid programs that adopt and successfully demonstrate meaningful use of certified electronic health record (EHR) technology. These Recovery Act provisions, together with Title XIII of Division A of the Recovery Act, may be cited as the "Health Information Technology for Economic and Clinical Health Act," or the "HITECH Act." The final rule specified the initial criteria EPs, eligible hospitals and CAHs, and MA Organizations must meet in order to qualify for an incentive payment; calculation of the incentive payment amounts; payment adjustments under Medicare for covered professional services and inpatient hospital services provided by EPs, eligible hospitals and CAHs failing to demonstrate meaningful use of certified EHR technology beginning in 2015; and other program participation requirements. Also, the Office of the National Coordinator for Health Information Technology (ONC) issued a closely related final rule that specified the initial set of standards, implementation specifications, and certification criteria for certified EHR technology. ONC has also issued a separate final rule on the establishment of certification programs for health information technology (HIT). To register for the Medicare and Medicaid EHR Incentive Program, EPs, eligible hospitals and CAHs, and MA Organizations will be required to provide the following information: Name, National Provider Identifier (NPI), business address and business phone for each EP, eligible hospital or CAH; Taxpayer Identification Number (TIN) to which the EP, eligible hospital or CAH wants the incentive payment to be made; For EPs, whether they choose to participate in the Medicare EHR Incentive Program or the Medicaid EHR Incentive Program; For eligible hospitals and CAHs, their CMS Certification Number (CCN); and other information as specified by CMS. EPs, eligible hospitals and CAHs will also have the option to provide their e-mail address at the time of registration. MA Organizations will be required to provide their contract number on behalf of their MA-affiliated EPs and hospitals. At this time, participation in the Medicare and Medicaid EHR Incentive Programs is voluntary for EPs, eligible hospitals and CAHs. Per section 1886(n)(4)(B) of the Act, as added by section 4102(c) of the HITECH Act, the Secretary will post on the Internet Web site of the Centers for Medicare & Medicaid Services, in an easily understandable format, a list of the names, business addresses, and business phone numbers of the Medicare EPs, eligible hospitals and CAHs who are meaningful EHR users in the Medicare EHR Incentive Program. Sections 1853(m)(5) and 1853(l)(7) of the Act, as added by sections 4101(c) and 4102(c) of the HITECH Recovery Act, require the Secretary to post the same information for EPs and eligible hospitals participating in the MA program as would be required if they were in the Medicare FFS program. Additionally, the Secretary must post the names of the qualifying MA Organizations receiving the incentive payment or payments. The routine uses established with this system contain a proper explanation as to the need for the disclosure provisions and provide clarity to CMS' intention to disclose provider- specific information contained in this system. The primary purpose of this system, called the National Level Repository or NLR, is to collect, maintain, and process information that is required for the Medicare and Medicaid EHR Incentive Program. Information in this system will also be disclosed to: (1) Support regulatory, incentive payments and policy functions such as evaluation and reporting, whether performed by the Agency or by an Agency contractor or consultant; (2) assist another Federal and/or state agency, agency of a state government, or an agency established by state law; (3) assist in making the individual physician-level participation data available through an Agency website and by various other means of data dissemination; (4) assist the Department's Office of the National Coordinator of Health Information Technology's (ONC's) grantees for the purpose of supporting "eligible professional" (EP) adoption and meaningful use of certified EHR technology; (5) support litigation involving the Agency; (6) combat fraud, waste, and abuse in certain health benefits programs, and (7) assist in a response to a suspected or confirmed breach of the security or confidentiality of information. We have provided background information about this new system in the "Supplementary Information" section below. Although the Privacy Act requires only that CMS provide an opportunity for interested persons to comment on the proposed routine uses, CMS invites comments on all portions of this notice. See "Effective Dates" section for information about the comment period.