Notice2026-18316
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 9, 2026
Effective
October 9, 2026
Issuing agencies
Health and Human Services DepartmentCenters for Medicare & Medicaid Services
Abstract
In accordance with the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS) is modifying an existing system of records maintained by the Centers for Medicare & Medicaid Services (CMS), titled "Hospice Item Set (HIS) System," System No. 09-70-0548. The amended System of Records Notice (SORN) reflects changes to now include real time data collection at the time of patient assessments to improve the understanding of patient care needs and care coordination. CMS is also changing the name of the system of records to "Hospice Outcomes and Patient Evaluation (HOPE)" and making other modifications which are explained in the Supplementary Information section. The HOPE system collects standardized hospice patient data to measure and improve care quality, support regulatory and reporting requirements, and enable research and policy functions.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 173 (Wednesday, September 9, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 173 (Wednesday, September 9, 2026)]
[Notices]
[Pages 57344-57347]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-18316]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
Privacy Act of 1974; System of Records
AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of
Health and Human Services (HHS).
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, as amended, the
Department of Health and Human Services (HHS) is modifying an existing
system of records maintained by the Centers for Medicare & Medicaid
Services (CMS), titled ``Hospice Item Set (HIS) System,'' System No.
09-70-0548. The amended System of Records Notice (SORN) reflects
changes to now include real time data collection at the time of patient
assessments to improve the understanding of patient care needs and care
coordination. CMS is also changing the name of the system of records to
``Hospice Outcomes and Patient Evaluation (HOPE)'' and making other
modifications which are explained in the Supplementary Information
section. The HOPE system collects standardized hospice patient data to
measure and improve care quality, support regulatory and reporting
requirements, and enable research and policy functions.
DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this modified
system of records notice is effective upon publication, with the
exception of the routine uses, which are effective October 9, 2026,
subject to comments received during the 30-day comment period.
ADDRESSES: The public should submit written comments on this notice, by
mail or email, to Barbara Demopulos, CMS Privacy Act Officer, 7500
Security Blvd., N1-14-56, Baltimore, MD 21244-1850, or
<a href="/cdn-cgi/l/email-protection#82e0e3f0e0e3f0e3ace6e7efedf2f7eeedf1c2e1eff1aceaeaf1ace5edf4"><span class="__cf_email__" data-cfemail="2c4e4d5e4e4d5e4d02484941435c5940435f6c4f415f0244445f024b435a">[email protected]</span></a>. Comments will be available for public
viewing at the same location. To review comments in person, please
contact Barbara Demopulos.
FOR FURTHER INFORMATION CONTACT: General questions about the modified
system of records should be addressed to: Jermama Keys, Health
Insurance Specialist, Division of Chronic and Post-Acute Care (DCPAC),
Center for Clinical Standards and Quality (CCSQ), Centers for Medicare
& Medicaid Services (CMS), 7500 Security Blvd., Mail Stop S3-02-01,
Baltimore, MD 21244-1850. Office: 410-786-7778 or email
<a href="/cdn-cgi/l/email-protection#711b14031c101c105f1a14080231121c025f1919025f161e07"><span class="__cf_email__" data-cfemail="7f151a0d121e121e51141a060c3f1c120c5117170c51181009">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
I. Reason for Modifying System of Records 09-70-0548
The primary reason for this modification is to highlight the
inclusion of real time data collection from hospice providers at the
time of patient assessments while the beneficiary is receiving hospice
services, and not only at the point of admissions and discharges from
hospice care.
II. Modifications Made to the System of Records Notice (SORN)
The modified SORN published in this notice differs from the
existing SORN in these respects:
<bullet> The name of the System of Records has been changed from
Hospice Item Set (HIS) System to Hospice Outcomes and Patient
Evaluation (HOPE).
<bullet> The Authority section has been corrected to cite sections
1814(i)(5)(C) and 1861(dd)(2)(G) of the Social Security Act (42 U.S.C.
1395f(i)(5)(C) and 1395x(dd)(2)(G), respectively) instead of section
1814(i).
<bullet> The Purpose(s) section now mentions that the records in
this system of records are collected in the HOPE tool by Medicare-
certified hospice providers, during scheduled patient assessments or at
the point of the patient's admission/discharge from hospice care, or at
other times, such as when entering data from the patient's medical
records. The list of secondary purposes for which the records are used
is now indicated as ``Hospice Quality Reporting Program (HQRP) and
patient health and safety purposes'', in accordance with information
collection activities authorized under section 1861(dd)(2)(G) of the
Social Security Act. (general purposes such as breach incident response
are no longer listed).
<bullet> The Categories of Individuals section has been revised to
refer to hospice patients as ``hospice patients, most of whom are
Medicare beneficiaries'' instead of as ``hospice
[[Page 57345]]
patients and Medicare beneficiaries''; to clarify that ``individual''
providers means ``sole practitioner'' providers, and that the providers
are ``Medicare-certified''; and to remove contact persons for a
hospice, because a record retrieved by a hospice contact person's name
or other personal identifier would be, for Privacy Act purposes, a
record about the hospice.
<bullet> The Categories of Records section now lists additional
data elements about hospice patients, i.e., ethnicity, preferred
language, and Medicare Beneficiary Identifier (MBI), and the data
element ``gender'' has been changed to ``sex.'' The data elements about
sole practitioner providers now includes signature.
<bullet> The Records Source Categories section no longer mentions
software and computer programs that a hospice may use to ``transmit''
the information to CMS (it is now limited to people and records that
are the ``sources'' of the information). It now lists the patient's
caregivers and the hospice provider's observations and assessments as
additional sources of information about a hospice patient, and it
mentions that information about a hospice patient may be collected
during scheduled assessments or at the point of the patient's
admission/discharge from hospice care, or at other times.
<bullet> The Routine Uses section has been revised as follows:
[cir] The introductory paragraph at the start of the section now
adds that the routine uses are in addition to other disclosures
authorized directly in the Privacy Act at 5 U.S.C. 552a(b), which can
also be made without the subject individual's consent.
[cir] The wording of routine use 4 has been improved. It authorizes
disclosures to support an individual or organization in conducting
research or in understanding and improving payment initiatives.
[cir] The wording of routine use 5 has been improved, including
clarifying a statutory cite to read ``Part B of Title XI of the Social
Security Act (42 U.S.C. 1320c et seq.)'' instead of ``Part B of Title
XI of the Act.'' It authorizes disclosures to support Quality
Improvement Organizations with various review and outreach activities.
[cir] Routine use 6, now describes how this disclosure assists
national accrediting organizations with approval for deeming authority
for Medicare requirements for hospice services.
[cir] In routine use 7, which authorizes disclosures to the
Department of Justice or a court or other adjudicatory body,
``litigation'' has been changed to ``litigation or other proceedings''
and redundant wording limiting the disclosures to information that is
``compatible with the purpose for which the agency collected the
records'' has been removed as redundant (it is redundant because it
repeats part of the definition of a routine use).
[cir] The two breach response-related routine uses that were added
to the SORN in 2018 are now numbered as routine uses 10 and 11.
[cir] The note at the end of the Routine Uses section is now titled
``Additional Circumstances Affecting All Routine Use Disclosures''
instead of ``Additional Circumstances Affecting Disclosure of PII
Data.''
<bullet> The Storage section now states that all records are
``stored electronically'' instead of ``on magnetic media.''
<bullet> The Retention and Disposal of Records section has been
updated to appropriately identify the applicable disposition authority,
DAA-0440-2015-0007-0001, Bucket 5, Beneficiary Records, which was
updated in 2017 and provides a retention period of ``10 years after
cutoff but longer retention is authorized.'' The Safeguards section now
mentions these additional safeguards that are used to protect the
records from unauthorized access: security guards, cameras, badges,
two-factor authentication, intrusion detection systems, privacy and
security training, and secure destruction methods.
<bullet> The Record Access Procedures, Contesting Record
Procedures, and Notification Procedures sections have been revised to
no longer mention providing Health Insurance Claim Number (HICN) or
Social Security number (SSN), but to require that requests include (in
addition to name) current address, email address or other contact
information, and signature, and the following information for identity
verification purposes: date and place of birth, and either notarization
of the signature or a statement signed under penalty of perjury.
<bullet> The SORN has been reformatted to conform to the ``Full''
SORN template prescribed in OMB Circular A-108, issued December 23,
2016.
Barbara Demopulos,
CMS Privacy Act Officer, Division of Security, Privacy Policy &
Oversight (DSPPO) Information Security and Privacy Group (ISPG), Office
of Information Technology (OIT), Centers for Medicare & Medicaid
Services (CMS).
SYSTEM NAME AND NUMBER:
Hospice Outcomes and Patient Evaluation (HOPE), 09-70-0548.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The address of the component responsible for the system of records
is: Centers for Medicare & Medicaid Services (CMS) Data Center, 7500
Security Blvd. North Building, First Floor, Baltimore, MD 21244-1850.
SYSTEM MANAGER(S):
The System manager is the Director, Division of Chronic & Post-
Acute Care, Quality Measurement & Health Assessment Group, Center for
Clinical Standards and Quality, Centers for Medicare & Medicaid
Services, 7500 Security Blvd., Mail Stop S3-02-01, Baltimore, MD 21244-
1850. Office: 410-786-7778 or email <a href="/cdn-cgi/l/email-protection#400403100103131401060600232d336e2828336e272f36"><span class="__cf_email__" data-cfemail="81c5c2d1c0c2d2d5c0c7c7c1e2ecf2afe9e9f2afe6eef7">[email protected]</span></a>.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The statutory authority to maintain this system of records is given
under sections 1814(i)(5) and 1861(dd)(2)(G) of the Social Security Act
(42 U.S.C. 42 U.S.C. 1395f(i)(5) and 1395x(dd)(2)(G)).
PURPOSE(S) OF THE SYSTEM:
The records in this system of records are collected in the HOPE
tool by Medicare-certified hospice providers during scheduled patient
assessments or at the point of the patient's admission/discharge from
hospice care, or at other times, such as, when entering data from the
patient's medical records. The records are used for the primary purpose
of addressing symptom management and improving the understanding of
patient care needs and coordinating patient care. The HOPE tool also
houses the data needed for the Hospice Quality Reporting Program
(HQRP), which collects, compiles, and eventually publishes data
measuring the quality of care provided to patients receiving hospice
care.
CMS will or may also use information from the records for secondary
HQRP purposes, including to: (1) support regulatory, reimbursement, and
policy functions performed by Agency contractors, consultants, or CMS
grantees; (2) assist Federal and state agencies and their fiscal agents
to perform the statutory functions of the HQRP; (3) assist hospices
with statutory reporting requirements; (4) support research,
evaluation, or epidemiological projects related to end-of-life care,
and for payment-related projects; (5) support the functions of Quality
Improvement Organizations; as well as other routine uses described
below.
[[Page 57346]]
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The records are about these categories of individuals who
participate in or are involved with the HQRP: (1) Hospice patients,
most of whom are Medicare beneficiaries, who receive health care
services coordinated and managed by hospices; and (2) any individual
(i.e., sole practitioner) provider of hospice services who is Medicare-
certified and whose name or other personal identifier is provided as
business-identifying information on the collection instrument.
CATEGORIES OF RECORDS IN THE SYSTEM:
Records maintained about a hospice patient include information
related to the patient's condition, selected covariates about the
condition, and patient/beneficiary identifying and demographic
information such as the patient's name, sex, date of birth, Social
Security Number (SSN), race, ethnicity, preferred language, Medicare
Beneficiary Identifier (MBI) or Health Insurance Claim Number (HICN),
and Medicaid number (MA number).
Records maintained about a sole practitioner provider of hospice
services include the provider's name, address, National Provider
Identifier (NPI), CMS Certification Number (CCN), personal contact
information, signature, and tax identification number (which may be the
provider's SSN, if used for business purposes).
RECORD SOURCE CATEGORIES:
Information about a hospice patient is collected by hospice
providers directly from the patient or from the patient's caregivers or
medical records or based on the hospice provider's observations and
assessments of the patient, during scheduled patient assessments or at
the point of the patient's admission/discharge from hospice care, or at
other times. Any information about an individual (sole practitioner)
provider is provided by that provider.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
The Privacy Act at 5 U.S.C. 552a(b)(3) allows us to disclose
information to parties outside the agency without the subject
individual's consent for a purpose that is compatible with the
purpose(s) for which the information was collected, if a description of
the disclosure is published as a ``routine use'' in the applicable
System of Records Notice (SORN). The disclosures authorized by routine
uses published pursuant to 5 U.S.C. 552a(b)(3) are in addition to other
disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b),
which can also be made without the subject individual's consent.
The following routine uses are published for this system of
records:
1. To support Agency contractors, consultants, or CMS grantees
engaged by the Agency to assist in the accomplishment of a CMS function
related to the purposes for this collection and need to have access to
the records to support CMS.
2. To assist another Federal Agency, an agency of a state
government, an agency established by State law, or its fiscal agents
with information that is necessary and/or required to perform the
statutory functions of the HQRP.
3. To provide hospices with information they need to meet any
statutory requirements of the HQRP, to assist with reports as required
by CMS, and to enable the implementation of quality standards.
4. To support an individual or organization in conducting research,
including evaluations and epidemiological projects related to end-of-
life care, or in understanding and improving payment initiatives.
5. To support Quality Improvement Organizations (QIOs) in
connection with review of claims, or in connection with studies or
other review activities conducted pursuant to Part B of Title XI of the
Social Security Act (42 U.S.C. 1320c et seq.), and in performing
affirmative outreach activities to assist individuals in establishing
and maintaining their entitlement to Medicare benefits or health
insurance plans.
6. To support national accrediting organizations with approval for
deeming authority for Medicare requirements for hospice services (i.e.,
The Joint Commission, the Accreditation Commission for Health Care,
Inc., and the Community Health Accreditation Program). Information will
be released to these organizations upon specific request, and only for
those facilities that they accredit, that participate in the Medicare
program, and that meet the following requirements:
a. Provide identifying information for hospices that have an
accreditation status with the requesting deemed organization;
b. Submit a finder file identifying beneficiaries/patients
receiving hospice services;
c. Complete a signed data exchange agreement or a CMS data use
agreement; and
d. Safeguard the confidentiality of the data and prevent
unauthorized access.
7. To provide information to the U.S. Department of Justice (DOJ)
or a court or other adjudicatory body when (a) the Agency or any
component thereof, or (b) any employee of the Agency in the employee's
official capacity, or (c) any employee of the Agency in the employee's
individual capacity where the DOJ has agreed to represent the employee,
or (d) the United State Government, is a party to litigation or other
proceedings or has an interest in the proceedings, and by careful
review, CMS determines that the records are both relevant and necessary
to the proceedings.
8. To assist a CMS contractor (including, but not limited to,
Medicare Administrative Contractors, fiscal intermediaries, and
carriers) that assists in the administration of a CMS-administered
health benefits program, or to a grantee of a CMS-administered grant
program, when disclosure is deemed reasonably necessary by CMS to
prevent, deter, discover, detect, investigate, examine, prosecute, sue
with respect to, defend against, correct, remedy, or otherwise combat
fraud, waste or abuse in such program.
9. To assist another Federal agency or an instrumentality of any
governmental jurisdiction within or under the control of the United
States (including any state or local governmental agency), that
administers or that has the authority to investigate potential fraud,
waste or abuse in a health benefits program funded in whole or in part
by Federal funds, when disclosure is deemed reasonably necessary by CMS
to prevent, deter, discover, detect, investigate, examine, prosecute,
sue with respect to, defend against, correct, remedy, or otherwise
combat fraud, waste or abuse in such programs.
10. To appropriate agencies, entities, and persons when (1) HHS
suspects or has confirmed that there has been a breach of the system of
records; (2) HHS has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, HHS (including
its information systems, programs, and operations), the federal
government, or national security; and (3) the disclosure made to such
agencies, entities, and persons is reasonably necessary to assist in
connection with HHS's efforts to respond to the suspected or confirmed
breach or to prevent, minimize, or remedy such harm.
11. To another federal agency or federal entity, when HHS
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed
[[Page 57347]]
breach or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the federal government, or national
security, resulting from a suspected or confirmed breach.
Additional Circumstances Affecting All Routine Use Disclosures: To
the extent that the subject individual claims records in this system
contain Protected Health Information (PHI) as defined by HHS regulation
``Standards for Privacy of Individually Identifiable Health
Information'' (45 CFR parts 160 and 164, Subparts A and E), disclosures
of such PHI that are otherwise authorized by these routine uses may
only be made if, and as, permitted or required by the ``Standards for
Privacy of Individually Identifiable Health Information'' (see 45 CFR
164.512(a)(1)).
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
The records are secured across both physical and digital
environments. Hard-copy records are maintained in restricted, locked
facilities accessible only to authorized personnel. Electronic records
are safeguarded using industry-standard encryption, firewalls, and
multi-factor access controls. Portable electronic media containing
personal data are strictly encrypted. All records are subject to strict
retention schedules and are permanently destroyed or de-identified when
no longer required.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Information may be retrieved by any of these personal identifiers:
provider's TIN (which could be an SSN); NPI; CMS Certification Number
(CCN); Patient's SSN or a Beneficiary's HICN; a patient's or
beneficiary's name in combination with the patient's or beneficiary's
date of birth.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
The applicable schedule approved by the National Archives and
Records Administration (NARA) is DAA-0440-2015-0007-0001 (Bucket 5,
Beneficiary Records), which provides for beneficiary claims records to
be cut off at the end of the calendar year and destroyed no sooner than
10 years after cutoff unless longer retention is authorized; however,
beneficiary claims records are currently subject to a document
preservation order and must be preserved indefinitely pending further
notice from the U.S. Department of Justice.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Safeguards conform to the HHS Information Security and Privacy
Program, <a href="https://www.hhs.gov/ocio/securityprivacy/index.html">https://www.hhs.gov/ocio/securityprivacy/index.html</a>.
Information is safeguarded in accordance with applicable laws, rules
and policies, including the HHS Policy for Information Security and
Privacy Protection (IS2P); the E-Government Act of 2002, which includes
the Federal Information Security Modernization Act (FISMA) of 2014, 44
U.S.C. 3551 through 3558; all pertinent National Institutes of
Standards and Technology (NIST) Special Publications (SP), and OMB
Circular A-130, Managing Information As a Strategic Resource.
Records are protected from unauthorized access through appropriate
administrative, physical, and technical safeguards. These safeguards
include protecting the facilities where records are stored or accessed
with security guards, badges and cameras, securing hard-copy records in
locked file cabinets, file rooms or offices during off-duty hours,
limiting access to electronic databases to authorized users based on
roles and two-factor authentication (or user identification (ID) and
password), using a secured operating system protected by encryption,
firewalls, and intrusion detection systems, requiring encryption for
records stored on removable media, and training personnel in Privacy
Act and information security requirements. Records that are eligible
for destruction are disposed of using destruction methods prescribed by
NIST SP 800-88, as revised.
RECORD ACCESS PROCEDURES:
An individual seeking access to records about the individual in
this system of records must submit a written access request to the
System Manager identified in the ``System Manager(s)'' section. An
access request must contain the individual's full name, current
address, email address or other contact information, and, for identity
verification purposes, signature and date and place of birth. In
addition, to verify the requester's identity, the signature must be
notarized, or the request must include the individual's written
certification that the individual is the person the individual claims
to be and understands that the knowing and willful request for or
acquisition of a record pertaining to an individual under false
pretenses is a criminal offense subject to a fine of up to $5,000. An
individual may also request an accounting of disclosures that have been
made of the records about the individual, if any.
CONTESTING RECORD PROCEDURES:
An individual seeking to amend a record about the individual in
this system of records must submit a written amendment request to the
System Manager identified in the ``System Manager(s)'' section. The
request must contain the same information required for an access
request, and must reasonably identify the record, specify the
information contested, state the corrective action sought, provide the
reasons for the amendment, and include any supporting justification or
documentation. The individual must verify his or her identity in the
same manner required for an access request. The right to contest
records is limited to information that is factually inaccurate,
incomplete, irrelevant, or untimely (obsolete).
NOTIFICATION PROCEDURES:
An individual who wishes to know if this system of records contains
records about the individual must submit a written request to the
System Manager identified in the ``System Manager(s)'' section. The
request must contain the same information required for an access
request, and the individual must verify their identity in the same
manner required for an access request.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
79 FR 19341 (Apr. 8, 2014); 83 FR 6591 (Feb.14, 2018)
[FR Doc. 2026-18316 Filed 9-8-26; 8:45 am]
BILLING CODE 4120-03-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 9, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.