Defense Privacy and Civil Liberties Office

U.S. Department of Defense

System of Record Notices (SORNs)

DOD Component Notice

Defense Health Agency

EDHA 06

SYSTEM NAME:

Designated Provider Managed Care System Records  (November 18, 2013,  78 FR 69076)

SYSTEM LOCATION:

Primary location: Office of the Assistant Secretary of Defense (Health Affairs), Deputy Director (TRICARE Management Activity), Chief, Health Plan Operations, Deputy Chief TRICARE Operations, Director Program Operations, Designated Provider Program Manager, Skyline Five, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3201.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals eligible to participate in, and who have elected to enroll in the Uniformed Services Family Health Plan (USFHP) of the Department of Defense Military Health Services of Manage Care System.

CATEGORIES OF RECORDS IN THE SYSTEM:

Enrollment Records: Electronic files containing beneficiary ID, name, Social Security Number(SSN), date of birth, gender, sponsor status (active duty or retired), relationship to sponsor, sponsor pay grade, sponsor name and Social Security Number (SSN), state/country, zip code, and program enrollment information (i.e., date of enrollment, expiration of enrollment, program enrolled in, etc.).

Management Clinical Data Records: Electronic files containing Uniformed Services Family Health Plan of the Department of Defense Military Health Services of Manage Care System, System identifier, beneficiary ID, name, Social Security Number (SSN), other demographics (i.e., county, state, zip code, coverage area for Uniformed Services Family Health Plan, healthcare services, healthcare provider, and financial information (e.g., Diagnosis-Related Groups and uniformed service beneficiaries cost share.)

Medicare Claims Records: Electronic files containing claim identifiers, beneficiary ID, county, state, zip code, healthcare services, healthcare provider, and cost of healthcare and procedure retained for two years for analysis of cost trends.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

DoD 6025.18-R, DoD Health Information Privacy Regulation; Pub L. 104-201, § 722 - 726; Health Insurance Portability and Accountability Act of 1996 (HIPAA); 10 U.S.C. 1102, Confidentiality of Medical Quality Assurance Records: Qualified Immunity for Participants; and E.O. 9397 (SSN).

PURPOSE(S):

The system is used to administer the Uniformed Services Family Health Plan of the Department of Defense Military Health Services of Managed Care System. It identifies eligible beneficiaries enrolled in Uniformed Services Family Health Plan managed care programs and records healthcare services provided and payments made on behalf of eligible uniformed services health beneficiaries. Additional management functions enable DoD Healthcare Officials to use information in the system at individual and aggregate levels to monitor quantity and type of healthcare provided and to analyze and study the cost effectiveness of the Uniformed Services Family Health Plan of the Department of Defense Military Health Services of Managed Care System.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

Disclosures to Center for Medicare and Medicaid Services (CMS), to detect duplicate or overlapping payments made by Medicare.

Disclosures to National Oceanic Service, United States Public Health Service, United States Coast Guard, and National Oceanic and Atmospheric Administration to track services provided to their uniformed service personnel and beneficiaries.

The 'Blanket Routine Uses' set forth at the beginning of OSD's compilation of systems of records notices also apply to this system.

Note: This system of records contains individually identifiable health information. The DoD 6025.18-R, "DoD Health Information Privacy Regulation" issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most such health information and may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:


STORAGE:

Electronic storage media and paper records in file folders.

RETRIEVABILITY:

Patient or sponsor's surname and/or Social Security Number (SSN).

SAFEGUARDS:

Records are maintained in a controlled area accessible only to authorized personnel. Entry to this area is restricted to personnel with a valid requirement and authorization to enter. Physical entry is restricted by the use of a cipher lock on the entrance to the room. Personal data maintained at the back-up site is stored in a secure area. Access to personal data records is restricted to those individuals who require the records in the performance of official duties and to those records that are the subject of official duties. Access is restricted by passwords that are changed every ninety days.

RETENTION AND DISPOSAL:

Paper records are closed out at the end of the calendar year in which finalized and held six additional years and then destroyed. Where hard copy records have been converted to electronic, microfilm, imaging, or optical formats, the hard copy record is destroyed and the electronic, microfilm, imaging, or optical format is kept by the contractor for six years after claim is processed to completion and then destroyed. Storage media containing data with personal identifiers will be erased (degaussed) after the inactive record retention. Paper records are forwarded to the National Records Archives, and are maintained.

SYSTEM MANAGER(S) AND ADDRESS:

Designated Program Manager, TRICARE Management Activity, Skyline 5, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3238.

NOTIFICATION PROCEDURE:

Individuals seeking to determine whether information about themselves is contained in this system should address written inquiries to the Deputy Chief, TRICARE Operations, Skyline 5, Suite 810, 5111 Leesburg Pike, Falls Church, VA 22041-3238.

The request should contain the full name of the patient and sponsor, sponsor's Social Security Number (SSN), patient's date of birth, Defense Enrollment/Eligibility Reporting System dependent suffix, gender, treatment facility(ies), and calendar year(s) of interest.

RECORD ACCESS PROCEDURES:

Individuals seeking access to information about themselves contained in this system should address written inquiries to the OSD/JS FOIA Requester Service Center, 1155 Defense Pentagon, Washington, D.C. 20301-1155.

The request should contain the full names of the patient and sponsor, sponsor's Social Security Number (SSN), patient's date of birth, Defense Enrollment/Eligibility Reporting System dependent suffix, gender, treatment facility(ies), and calendar year(s) of interest.

CONTESTING RECORD PROCEDURES:

The OSD's rules for accessing records, for contesting contents and appealing initial agency determinations are published in OSD Administrative Instruction 81; 32 C.F.R. 311, Office of the Secretary of Defense, OSD Privacy Program; or may be obtained from the system manager.

RECORD SOURCE CATEGORIES:

Uniformed Services Family Health Plan enrollment records; medical/hospital information systems, and/or billing systems; eligibility information from the Defense Enrollment/Eligibility Reporting System; claim information from the Center for Medicare and Medicaid; beneficiary information from National Oceanic and Atmospheric Administration; National Oceanic Service; U.S. Coast Guard; and U.S. Public Health Service.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

None.

FEDERAL REGISTER HISTORY:

November 12, 2008, 73 FR 66854; November 18, 2013, 78 FR 69076