Agency Information Collection Activities: Proposed Collection; Comment Request

AGENCY:

Centers for Medicare & Medicaid Services, HHS.

ACTION:

Notice.

SUMMARY:

The Centers for Medicare & Medicaid Services (CMS) is announcing an opportunity for the public to comment on CMS' intention to collect information from the public. Under the Paperwork Reduction Act of 1995 (the PRA), federal agencies are required to publish notice in the Federal Register concerning each proposed collection of information (including each proposed extension or reinstatement of an existing collection of information) and to allow 60 days for public comment on the proposed action. Interested persons are invited to send comments regarding our burden estimates or any other aspect of this collection of information, including the necessity and utility of the proposed information collection for the proper performance of the agency's functions, the accuracy of the estimated burden, ways to enhance the quality, utility, and clarity of the information to be collected, and the use of automated collection techniques or other forms of information technology to minimize the information collection burden.

DATES:

Comments must be received by May 17, 2019.

ADDRESSES:

When commenting, please reference the document identifier or OMB control number. To be assured consideration, comments and recommendations must be submitted in any one of the following ways:

1. Electronically. You may send your comments electronically to http://www.regulations.gov. Follow the instructions for “Comment or Submission” or “More Search Options” to find the information collection document(s) that are accepting comments.

2. By regular mail. You may mail written comments to the following address: CMS, Office of Strategic Operations and Regulatory Affairs, Division of Regulations Development, Attention: Document Identifier/OMB Control Number __, Room C4-26-05, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.

To obtain copies of a supporting statement and any related forms for the proposed collection(s) summarized in this notice, you may make your request using one of following:

1. Access CMS' website address at website address at https://www.cms.gov/Regulations-and-Guidance/Legislation/PaperworkReductionActof1995/PRA-Listing.html.

2. Email your request, including your address, phone number, OMB number, and CMS document identifier, to Paperwork@cms.hhs.gov.

FOR FURTHER INFORMATION CONTACT:

William N. Parham at (410) 786-4669.

SUPPLEMENTARY INFORMATION:

Contents

This notice sets out a summary of the use and burden associated with the following information collections. More detailed information can be found in each collection's supporting statement and associated materials (see ADDRESSES).

CMS-10157 The HIPAA Eligibility Transaction System (HETS)

Under the PRA (44 U.S.C. 3501-3520), federal agencies must obtain approval from the Office of Management and Budget (OMB) for each collection of information they conduct or sponsor. The term “collection of information” is defined in 44 U.S.C. 3502(3) and 5 CFR 1320.3(c) and includes agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. Section 3506(c)(2)(A) of the PRA requires federal agencies to publish a 60-day notice in the Federal Register concerning each proposed collection of information, including each proposed extension or reinstatement of an existing collection of information, before submitting the collection to OMB for approval. To comply with this requirement, CMS is publishing this notice.

Information Collection

1. Type of Information Collection Request: Revision of a currently approved collection; Title of Information Collection: The HIPAA Eligibility Transaction System (HETS); Use: HIPAA regulations require covered entities to verify the identity of the person requesting PHI and the person's authority to have access to that information. Under the HIPAA Security rules, covered entities, regardless of their size, are required under 45 CFR Subtitle A, Subpart C 164.312(a)(2)(i) to “assign a unique name and/or number for identifying and tracking user identity.” A 'user' is defined in 164.304 as a “person or entity with authorized access” Accordingly, the HIPAA Security rule requires covered entities to assign a unique name and/or number to each employee or workforce member who uses a system that receives, maintains or transmits electronic PHI so that system access and activity can be identified and tracked by user. This pertains to workforce members within small or large provider offices, health plans, group health plans, and clearinghouses. Federal law requires that CMS take precautions to minimize the security risk to the federal information system. Federal Information Processing Standards Publication(FIPS PUB) 1() 1-2 Paragraph 11.7—Security and Authentication states that: “Agencies shall employ risk management techniques to determine the appropriate mix of security controls needed to protect specific data and systems. The selection of controls shall take into account procedures required under applicable laws and regulations.” Accordingly, CMS requires that entities who wish to connect to the HETS application via the CMS Extranet and/or internet are uniquely identified. CMS is required to verify the identity of the person requesting the Protected Health Information (PHI) and the person's authority to have access to Medicare eligibility information. Furthermore, CMS requires that trading partners who wish to conduct eligibility transactions on a real-time basis with CMS provide certain assurances as a condition of receiving access to the Medicare eligibility information for the purpose of conducting real-time 270/271 inquiry/response transactions. Form Number: CMS-10157 (OMB control number: 0938-0960); Frequency: Yearly; Affected Public: Private Sector; Business or other for profits, Not-for-Profits Institutions; Number of Respondents: 1000; Total Annual Responses: 1000; Total Annual Hours: 250. (For policy questions regarding this collection contact Rupinder Singh at 410 786-7484.)