Deliverable Administration, Report, and Repository Tool

PIA Unique Identifier:

P-4994757-105380

Name:

Deliverable Administration, Report, and Repository Tool

The subject of this PIA is which of the following?

Major Application

Identify the Enterprise Performance Lifecycle Phase of the system.

Operate

Is this a FISMA-Reportable system?

Yes

Does the system include a Website or online application available to and for the use of the general public?

No

Identify the operator:

Contractor

Is this a new or existing system?

Existing

Does the system have Security Authorization (SA)?

Yes

Date of Security Authorization

4/28/2022

Indicate the following reason(s) for updating this PIA. Choose from the following options.

PIA Validation (PIA Refresh/Annual Review)

Describe in further detail any changes to the system that have occurred since the last PIA.

There are no new changes to the system, however, DARRT is in the Operations and Maintenance stage which includes bug fixes and software security fixes. The system has not been requested to collect new Personally Identifiable Information (PII) or Protected Health Information (PHI) elements. 

Describe the purpose of the system

The Deliverable Administration Review and Repository Tool (DARRT) is a cloud-based solution providing a program management tool for CMS and Quality Improvement Organization (QIO) users.  DARRT is operational and provides the following functions:

Deliverables - provides CMS Center for Clinical Standards and Quality for the Centers (CCSQ) contractors, CCSQ Central Office staff and CMS Regional Office staff a central location for the submission, review and storage of Quality Improvement contractor related artifacts and including but not limited to Contract Deliverables and Quality Measure Reports 

Quality Improvement Initiative (QII) - initiation and tracking 

As defined in 42 CFR 476.1, a Quality Improvement Initiative (QII) is any formal plan designed to assist a provider(s) and/or practitioner(s) in identifying the root cause of a confirmed quality of care concern, develop a framework in which to address the concern and improve a process or system. The improvements may relate to safety, healthcare, health, and value and involve providers, practitioners, beneficiaries, and/or communities. QIIs may consist of system-wide (organization-based) and/or non-system-wide (practitioner-based) activities. System-wide QIIs are improvement activities that may require technical assistance and interventions as defined in 42 CFR 476.1. Non-system-wide QIIs may not warrant technical assistance or interventions, but the Beneficiary and Family Centered Care-Quality Improvement Organizations (BFCC-QIO) shall propose recommendations regarding the quality-of-care concern.

Describe the type of information the system will collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements)

Deliverable Administration, Review, and Repository Tool (DARRT) stores contract deliverable information such as task orders, result documentation, periodic reports, deliverable definitions, and submission files. The type of Personal Identifiable Information (PII)/Protected Health Information (PHI) that could be uploaded to DARRT includes Name Phone Number Medical Notes Date of Birth Medical Records Number Medical notes such as patient diagnosis, lab results, and provider information DARRT has warning banners in place to let users know not to upload PII/PHI to the system. There is a chance that documents needed by the application for documentation may contain PII or PHI. This could be name, phone number, date of birth, medical record number, medical notes such as patient diagnosis, lab results, and provider information reflected in the Quality Improvement Initiative (QII) Referral Documentation section of DARRT. Any Personal Identifiable Information (PII) that is uploaded as a comment or attachment is not used by the application. Any attachments that are uploaded to DARRT are encrypted at rest using industry best practices. Login credentials (User ID and password) are handled and stored by Okta (CMS single sign on provider) via the Healthcare Quality Information System (HCQIS) Access Roles and Profile (HARP) system managed by Alcor. DARRT maintains user authorization mapping as well, for the purposes of determining what a user has access to read or write upon accessing the system.

Provide an overview of the system and describe the information it will collect, maintain (store), or share, either permanently or temporarily.

QIOs, who are direct contractors, monitor the appropriateness, effectiveness, and quality of care provided to Medicare beneficiaries. QIOs provide critical support by submitting reports to the Centers for Medicare and Medicaid Services (CMS) that contain quality indicators and information for health plans, providers, and practitioners to improve the quality of care provided to Medicare beneficiaries. The Deliverable Administration, Review, and Repository Tool (DARRT) system stores non-PII (Personal Identifiable Information) data, specifically that pertaining to Deliverable Definitions, which is just metadata about the Submission File. As stated earlier, a deliverable is a requirement that contractors must meet in a timely manner. Specific deliverables are listed in the Schedule of Deliverables. Contractors submit documents to a deliverable. The Contracting Officer (COR) reviews the files submitted to the deliverable and determines if the files meet the criteria for the deliverable. When uploading submission files, it is possible that end users may add data that contains PII/PHI. DARRT currently has a warning banner in place to remind users not to upload any data that may contain PII/PHI.

Does the system collect, maintain, use or share PII?

Yes

Indicate the type of PII that the system will collect or maintain.

• Name

• Phone Numbers

• Medical Notes

• Date of Birth

• Medical Records Number

• Other - Provider information, medical diagnosis, and lab results.

Indicate the categories of individuals about whom PII is collected, maintained or shared.

Patients

How many individuals' PII in the system?

<100

For what primary purpose is the PII used?

The Personal Identifiable Information (PII) is not used by the application. It is possible that documents needed by the application for documentation may contain PII or Protected Health Information (PHI). This could be First/Last names of patients, patient diagnosis, lab results, name of providers.

Describe the secondary uses for which the PII will be used (e.g. testing, training or research)

There are no secondary uses for the Personal Identifiable Information (PII) since we do not encourage PII to be entered into Deliverable Administration, Review, and Repository Tool (DARRT).

Describe the function of the SSN.

Not Applicable

Cite the legal authority to use the SSN.

Not Applicable

Identify legal authorities​ governing information use and disclosure specific to the system and program.

The statutory authority for this system is given under the provisions of sections 226A, 1875, and 1881 of the Social Security Act (the Act) (Title 42 United States Code (U.S.C.), section s 426-1, 1395ll, and 1395rr) and 5 USC 301, Departmental Regulations.

Are records on the system retrieved by one or more PII data elements?

No

Identify the sources of PII in the system: Directly from an individual about whom the information pertains

Online

Identify the sources of PII in the system: Government Sources

Within the OPDIV

Identify the sources of PII in the system: Non-Government Sources

Other - Other - Documents uploaded to DARRT relating to QII (Quality Improvement Initiative) Referrals are not supposed to contain PII/PHI but may contain it as the system does not check for PII/PHI. We also have QIO confidential information that is an additional layer of confidential information. Note: Provider and individual physician names may be uploaded to the following areas within DARRT. This is not traditional PHI or PII, but it is still confidential information. QII Referral Documentation(s) Deliverable D.14 reports the results of focused reviews. Deliverable D.16 is the monitoring and reporting requirements, Livanta provides a monthly report of its sanction's activities.

Identify the OMB information collection approval number and expiration date

Not Applicable

Is the PII shared with other organizations?

No

Describe the process in place to notify individuals that their personal information will be collected. If no prior notice is given, explain the reason.

Not Applicable 

Is the submission of the PII by individuals voluntary or mandatory?

Voluntary

Describe the method for individuals to opt-out of the collection or use of their PII. If there is no option to object to the information collection, provide a reason.

Not Applicable

Describe the process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changes since the notice at the time of original collection). Alternatively, describe why they cannot be notified or have their consent obtained.

Not Applicable

Describe the process in place to resolve an individual's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate. If no process exists, explain why not.

Not Applicable

Describe the process in place for periodic reviews of PII contained in the system to ensure the data's integrity, availability, accuracy and relevancy. If no processes are in place, explain why not.

To ensure the system's data integrity, the application encrypts all data in transit as well as data at rest using the department of defense's best practice encryption standards. To ensure data availability, the system is hosted with Amazon's cloud datacenter and has backup zones in the case that the datacenter suffers failure. To ensure data accuracy, DARRT creates reports within the application that give metrics on the data contained within the application. We do not encourage Protected Health Information (PHI) or Personal Identifiable Information (PII) to be entered into DARRT. There is a chance that documents needed by the application for documentation may contain PII or PHI. This could be name, phone number, date of birth, medical record number, medical notes such as patient diagnosis, lab results, and provider information reflected in the Quality Improvement Initiative (QII) Referral Documentation section of DARRT. Any Personal Identifiable Information (PII) that is uploaded as a comment or attachment is not used by the application. Any attachments that are uploaded to DARRT are encrypted at rest using industry best practices. Currently there is no process in place to conduct periodic reviews of PII contained in the system. All attachments are encrypted at rest the moment they are uploaded to the DARRT application.

Identify who will have access to the PII in the system and the reason why they require access.

• Users: If data with PII or PHI is accidentally uploaded to DARRT for documentation purposes related to the Referral Documentation section, the users who review the QII referral would see the information to perform their job duties as it relates to the Quality Improvement Initiative.

• Administrators: Administrators would be able to see the documents uploaded to the referral documentation section of DARRT that could contain lab analysis results or other related data. They have access to the upload section due to the way the application business logic functions.

Describe the procedures in place to determine which system users (administrators, developers, contractors, etc.) may access PII.

Not Applicable 

Describe the methods in place to allow those with access to PII to only access the minimum amount of information necessary to perform their job.

Not Applicable 

Identifying training and awareness provided to personnel (system owners, managers, operators, contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained.

All system users are required to take the annual CMS Cyber Awareness Challenge Computer Based Training (CBT) as well as the annual Identifying and Safeguarding Personally Identifiable Information training required by CMS. These satisfy security awareness training for the system owners. In addition, personnel with security roles are required to take security role-based training annually. These trainings cover technical concepts specific to developers and engineers.

Describe training system users receive (above and beyond general security and privacy awareness training)

Security and Privacy Awareness training is offered to all users. Direct contractors that have elevated levels of access, such as system or database administrators, must take 4 hours of additional role-based security training as required by CMS on an annual basis.

Do contracts include Federal Acquisition Regulation and other appropriate clauses ensuring adherence to privacy provisions and practices?

Yes

Describe the process and guidelines in place with regard to the retention and destruction of PII. Cite specific records retention schedules.

DARRT follows the CMS Record Schedule, published April 2015, under the Health Care Quality Improvement Systems (HCQIS) Disposition Authority: N1-440-09-3- Temporary. Delete/destroy after 4 survey cycles or 10 years whichever is later.

Describe, briefly but with specificity, how the PII will be secured in the system using administrative, technical, and physical controls.

Administrative controls include, but not limited to contingency plans and annual testing, backups of all files, offsite storage of backup files, background checks for all personnel, incident response procedures for timely response to security and privacy incidents, initial security training with refresher courses annually, and annual role-based security training for personnel with assigned security roles. The physical security of the data center where the system resides includes the use of access cards for entry, security guards, and video monitoring. Technical controls include but are not limited to user authentication with least privilege authorization, firewalls, intrusion Detection and Prevention systems, encrypted communication (data at rest and data is accessed using FIPS 140-2 requirements). Hardware configured with a deny all/except approach, auditing, and correlation of audit logs from all systems. Management Controls include but are not limited to: Certification and Accreditation (C&A), annual security assessments, monthly management of outstanding corrective action plans, ongoing risk assessments, and automated continuous monitoring.