Medicare Program: Expanding Uses of Medicare Data by Qualified Entities
Federal Register, Volume 81 Issue 130 (Thursday, July 7, 2016)
Federal Register Volume 81, Number 130 (Thursday, July 7, 2016)
Rules and Regulations
Pages 44455-44482
From the Federal Register Online via the Government Publishing Office www.gpo.gov
FR Doc No: 2016-15708
Page 44455
Vol. 81
Thursday,
No. 130
July 7, 2016
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
Centers for Medicare & Medicaid Services
-----------------------------------------------------------------------
Medicare Program: Expanding Uses of Medicare Data by Qualified Entities; Final Rule
Page 44456
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
CMS-5061-F
RIN 0938-AS66
Medicare Program: Expanding Uses of Medicare Data by Qualified Entities
AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This final rule implements requirements under Section 105 of the Medicare Access and CHIP Reauthorization Act of 2015 that expand how qualified entities may use and disclose data under the qualified entity program to the extent consistent with applicable program requirements and other applicable laws, including information, privacy, security and disclosure laws. This rule also explains how qualified entities may create non-public analyses and provide or sell such analyses to authorized users, as well as how qualified entities may provide or sell combined data, or provide Medicare claims data alone at no cost, to certain authorized users. In addition, this rule implements certain privacy and security requirements, and imposes assessments on qualified entities if the qualified entity or the authorized user violates the terms of a data use agreement required by the qualified entity program.
DATES: These regulations are effective on September 6, 2016.
FOR FURTHER INFORMATION CONTACT: Allison Oelschlaeger, (202) 690-8257. Kari Gaare, (410) 786-8612.
SUPPLEMENTARY INFORMATION:
-
Background
On April 16, 2015, the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) (Pub. L. 114-10) was enacted. The law included a provision, Section 105, Expanding the Availability of Medicare Data, which takes effect on July 1, 2016. This section expands how qualified entities will be allowed to use and disclose data under the qualified entity program, including data subject to section 1874(e) of the Social Security Act (the Act), to the extent consistent with other applicable laws, including information, privacy, security and disclosure laws.
The Qualified Entity program was established by Section 10332 of the Patient Protection and Affordable Care Act (Affordable Care Act) (Pub. L. 111-148). The implementing regulations, which became effective January 6, 2012, are found in subpart G of 42 CFR part 401 (76 FR 76542). Under those provisions, CMS provides standardized extracts of Medicare Part A and B claims data and Part D drug event data (hereinafter collectively referred to as Medicare claims data) covering one or more geographic regions to qualified entities at a fee equal to the cost of producing the data. Under the original statutory provisions, such Medicare claims data must be combined with other non-
Medicare claims data and may only be used to evaluate the performance of providers and suppliers. The measures, methodologies and results that comprise such evaluations are subject to review and correction by the subject providers and suppliers, after which the results are to be disseminated in public reports.
Those wishing to become qualified entities are required to apply to the program. Currently, fourteen organizations have applied and received approval to be a qualified entity. Of these organizations, two have completed public reporting while the other twelve are in various stages of preparing for public reporting. While we have been pleased with the participation in the program so far, we expect that the changes required by MACRA will increase interest in the program.
Under section 105 of MACRA, effective July 1, 2016, qualified entities will be allowed to use the combined data and information derived from the evaluations described in 1874(e)(4)(D) of the Act to conduct non-public analyses and provide or sell these analyses to authorized users for non-public use in accordance with the program requirements and other applicable laws. In highlighting the need to comply with other applicable laws, we particularly note that any qualified entity that is a covered entity or business associate as defined in the Health Insurance Portability and Accountability Act of 1996 (``HIPAA'') regulations at 45 CFR 160.103 will need to ensure compliance with any applicable HIPAA requirements, including the restriction on the sale of protected health information (PHI) without authorization at 45 CFR 164.502(a)(5)(ii).
In addition, qualified entities will be permitted to provide or sell the combined data, or provide the Medicare claims data alone at no cost, again, in accordance with the program requirements and other applicable laws, to providers, suppliers, hospital associations, and medical societies. Qualified entities that elect to provide or sell analyses and/or data under these new provisions will be subject to an assessment if they or the authorized users to whom they disclose patient-identifiable data in the form of analyses or raw data act in a manner that violates the terms of a program-required Qualified Entity Data Use Agreement (QE DUA). Furthermore, qualified entities that make analyses or data available under these new provisions will be subject to new annual reporting requirements to aid CMS in monitoring compliance with the program requirements. These new annual reporting requirements will only apply to qualified entities that choose to provide or sell non-public analyses and/or provide or sell combined data, or provide Medicare claims data alone at no cost.
We believe these changes to the qualified entity program will be important in driving higher quality, lower cost care in Medicare and the health system in general. We also believe that these changes will increase interest in the qualified entity program, leading to more transparency regarding provider and supplier performance and innovative uses of data that will result in improvements to the healthcare delivery system while still ensuring appropriate privacy and security protections for beneficiary-identifiable data.
-
Provisions of the Proposed Regulations and Responses to Public Comments
In the February 2, 2016 Federal Register (81 FR 5397), we published the proposed rule entitled, ``Expanding Uses of Medicare Data by Qualified Entities.'' We provided a 60-day public comment period.
In the proposed rule, to implement the new statutory provisions of section 105 of MACRA, we proposed to amend and make conforming changes to part 401, subpart G, ``Availability of Medicare Data for Performance Measurement.'' We received approximately 50 comments on the proposed rule from a wide variety of individuals and organizations. Many of the comments were from providers or suppliers, or organizations representing providers and suppliers. We also received a number of comments from organizations engaged in performance measurement or data aggregation, some of whom are already qualified entities and others who may apply to be qualified entities in the future. Other comments came from registries, state Medicaid agencies, issuers, and individuals.
Many of the comments were positive and praised CMS for the proposed
Page 44457
changes to the qualified entity program. Commenters also had a range of suggestions for changes to program requirements around the provision or sale of non-public analyses and data. We received a number of comments on expanding the data available to qualified entities to include claims data under Medicaid and the Children's Health Insurance Program (CHIP). In addition, we received a number of comments on the disclosure of data to qualified clinical data registries for quality improvement and patient safety activities.
A more detailed summary of the public comments and our responses can be found below in the appropriate sections of this final rule.
-
Non-Public Analyses
In accordance with Section 105(a)(1) of MACRA, we proposed to allow for the qualified entity's use of the combined data or information derived from the evaluations described in section 1874(e)(4)(D) of the Act to create non-public analyses and provide for the provision or sale of these analyses to authorized users in accordance with the program requirements discussed later in this section, as well as other applicable laws.
Comment: Commenters generally supported the proposal to allow qualified entities to create non-public analyses and either provide or sell these analyses. One commenter suggested that CMS expressly state at Sec. 401.716(a) that qualified entities may provide or sell the non-public analyses. Another commenter recommended that CMS clarify that the non-public analyses are not subject to discovery or admittance into evidence in any judicial or administrative proceeding.
Response: We thank commenters for their support of the provision or sale of non-public analyses. Since the intent of this section is to allow qualified entities to both provide and sell non-public analyses in accordance with program requirements and other applicable laws, we have made changes to the regulation text to expressly state as much.
The statute, at 1874(e)(4)(D) of the Act, explicitly states, ``data released to a qualified entity under this subsection shall not be subject to discovery or admission as evidence in judicial or administrative proceedings without consent of the applicable provider or supplier.'' We believe this statutory shield only applies to data released to the qualified entity under 1874(e) and when that data is in the possession of the qualified entity. Once the Medicare data is used to create non-public analyses and those non-public analyses are shared with authorized users, we do not believe the statutory shield applies.
-
Additional Analyses
In the proposed rule, we defined combined data as a set of CMS claims data provided under subpart G combined with a subset of claims data from at least one of the other claims data sources described in Sec. 401.707(d). We did not propose to establish a minimum amount of data that must be included in the combined data set from other sources.
Comment: We received numerous comments on the definition of combined data. Many commenters recommended that CMS alter the definition of combined data to allow qualified entities to combine the Medicare data with clinical data for the creation of non-public analyses. These commenters stated that clinical data can help facilitate more appropriate analyses of provider resource use than just claims data alone. One commenter suggested that the definition of combined data also include consumer, socio-demographic, and other types of patient and provider-level data. Other commenters suggested that CMS clarify that combined data must, at a minimum, be comprised of CMS claims data merged with claims data from other sources, but other data may also be included in this combined data. One commenter agreed with the proposed definition of combined data.
Response: Section 105(a)(1)(A) of MACRA requires that the non-
public analyses be based on the combined data described in 1874(e)(4)(B)(iii) as ``data made available under this subsection with claims data from sources other than claims data under this title''. Given these statutory limitations, we do not believe we can modify the definition of combined data.
However, we do recognize the value of combining claims data with clinical data for the development of non-public analyses and believe the use of clinical data in non-public analyses can significantly improve the value of these analyses to support quality and patient improvement activities. Clinical data such as laboratory test results or radiology and pathology reports, can add useful information about a patient's chronic condition burden, health status, and other factors that are not available in claims data. We can also see some value in combining consumer, socio-demographic, and other types of patient and provider level data with the Medicare data. As a result, we do want to clarify, that combined data requires at a minimum that the CMS claims data be combined with other sources of claims data, but that this does not prevent the qualified entity from merging other data (for example, clinical, consumer, or socio-demographic data) with the combined data for the development of non-public analyses.
Comment: Several commenters suggested that CMS require qualified entities to make public a list of the claims data it receives from CMS and the data it intends to combine with the CMS claims data for non-
public analyses. One commenter suggested that this public release of information also include the percent of the cohort for analysis that each source is contributing.
Response: We are very committed to greater data transparency and all qualified entities are required to publicly report on provider performance as part of their participation in the program. However, we do not see significant value in requiring qualified entities to publicly report on the other sources of data used in non-public analyses since the analyses themselves will not be released publicly.
Comment: Several commenters stated that they supported the proposal not to establish a threshold for the minimum amount of data that must be included in the combined data set from other sources.
Response: We thank commenters for their support.
Comment: A few commenters recommended that the requirement to use combined data not preclude Medicare-only analyses. These commenters stated that Medicare-only analyses such as segmenting provider and supplier performance evaluations by payer type or conducting longitudinal analysis of differences in cost and quality for certain conditions by payer type would have significant value for many authorized users.
Response: We recognize the value of Medicare-only analyses, especially to help providers and suppliers understand how quality and costs differ across their patient population. In addition, as the CMS Innovation Center continues to develop and test new models of care, qualified entities may play a role in conducting analyses to help providers and suppliers better manage patient outcomes and costs under a different payment model. As a result, we want to clarify that the requirement to use combined data does not prevent qualified entities from providing or selling analyses that allow the authorized user to drill down by payer type to Medicare-only results. For example, a qualified entity may provide or sell a provider a report that includes the provider's overall score on certain
Page 44458
quality and resource use measures (using combined data) and then presents scores for each of these measures by payer type (including a Medicare fee-for-service category).
-
Limitations on the Qualified Entities With Respect to the Sale and Provision of Non-Public Analyses
In accordance with section 105(a)(1) of MACRA, we proposed a number of limitations on qualified entities with respect to the sale and provision of non-public analyses.
First, we proposed to limit qualified entities to only providing or selling non-public analyses to issuers after the issuer provides the qualified entity with claims data that represents a majority of the issuers' covered lives in the geographic region and during the time frame of the non-public analyses requested by the issuer.
Comment: Many commenters supported the requirement of issuers to submit data to the qualified entity in order to receive analyses, but commenters had differing recommendations on the threshold of a majority of the issuers' covered lives. A number of commenters stated that CMS should not impose a threshold on the amount of data issuers must submit to a qualified entity to receive analyses. These commenters stated that the responsibility to ensure appropriate sample size for analyses should rest with the qualified entity. However, another commenter recommended that CMS require an issuer to provide the qualified entity with data on all of its covered lives for the geographic region and during the time frame of the non-public analyses requested. This commenter stated that requiring 100 percent of an issuer's covered lives would allow for more complete analyses. One commenter supported the threshold of the majority of an issuers covered lives, but stated that CMS should allow a health insurance issuer to request a non-public analysis for a geographic region outside the issuer's area of coverage, provided the issuer supplies claims data for a majority of the covered lives for the time period requested in all regions where it provides coverage. This commenter noted that analyses for other geographic regions may be beneficial to smaller, regional health insurance issuers interested in cost and utilization in a comparable region or looking to expand their areas of coverage. Another commenter supported the threshold, but recommended that CMS create an exceptions process for cases where legitimate and important analyses, such as identifying providers treating orphan diseases or analysis fundamental for a health plan issuer to enter a new market, that could not meet the proposed threshold. Finally, one commenter stated that CMS should allow qualified entities discretion to provide or sell analyses to health insurance issuers who have made a good faith commitment to providing the qualified entity with claims data that represents a majority of the health insurance issuer's covered lives by a certain future date.
Response: As we stated in the proposed rule, we considered not applying a threshold on the amount of data being provided by the issuer, but decided that specifying a threshold would encourage issuers to submit data to the qualified entity to be included in the public performance reports, increasing the reports' reliability. We believe this rationale still applies, and we still believe that there are a number of situations where requiring the issuer to provide 100 percent of their data for a given time period and geographic region is not feasible for the issuer. Based on comments, we revisited whether, on balance, requiring issuers to submit data that represents a majority of their covered lives in the geographic region and during the time frame of the non-public analyses requested by the issuer is generally the most appropriate threshold. In doing so, we recognized that in some cases an issuer may wish to have analyses for a geographic region where it does not provide coverage. However, we believe that in those instances the issuer should not be able to receive analyses due to the requirement at section 105(a)(1)(B)(ii) of MACRA, that a qualified entity may only provide or sell analyses to issuers that have provided the qualified entity with data. Therefore, we are modifying our proposed requirement around the issuer's claims data submission threshold to clarify that qualified entities may not provide or sell analyses to issuers when the analyses include geographic areas where the issuer does not offer coverage.
We would like to clarify, however, that the requirement that an issuer provide the qualified entity with claims data for at least 50 percent of its covered lives for the time period and geographic region covered by the analyses does not mean that all analyses provided or sold to the issuer would need to be based on analyses that considered at least 50 percent of the issuers' covered lives. So long as Medicare data is combined with other claims data to create the analyses, certain analyses, such as those on rare diseases, could be based only on a subset of the Medicare claims data and other claims data collected by the qualified entity. For example, an issuer could provide data for at least 50 percent of their covered lives for the time period and geographic region of the non-public analyses to a qualified entity. The qualified entity could then use a subset of that data, such as patients with a specific rare disease, combine it with Medicare data for patients with that rare disease, and provide or sell analyses about patients with the rare disease to the issuer. We would like to note, however, that qualified entities will need to be careful when producing analyses for issuers based on small populations and limited claims data to ensure that the resulting analyses truly are patient de-identified.
We understand the desire to create an exceptions process to allow issuers who do not contribute a majority of their covered lives in the geographic region and during the timeframe of the non-public analyses requested by the issuer to receive analyses. However, we believe that imposing a standard threshold for issuer covered lives across all qualified entities and issuers is the simplest and least administratively burdensome method to ensure equal treatment of qualified entities and issuers under this program.
We also understand the interest in allowing qualified entities to provide or sell analyses to health insurance issuers who have made a good faith commitment to provide the qualified entity with claims data for the majority of their covered lives in the geographic region and during the time frame of the non-public analyses requested by the issuer. However, we believe that this type of policy could reduce the incentives for issuers to share their data with the qualified entity.
Comment: Several commenters recommended that CMS provide additional clarity around the requirements for issuers' claims data submissions to the qualified entity. One commenter stated that qualified entities should be allowed to meet the covered lives threshold regardless of whether they have obtained the claims information directly from the issuer or indirectly from a third party. Several commenters recommended that CMS provide additional details on the term covered lives to clarify how this would be assessed in certain circumstances, such as when an issuer is a secondary payer or a member is not enrolled for a full year.
Response: Qualified entities may only provide or sell analyses to an issuer if it receives claims data from the issuer. Such data can be provided directly by the issuer, or it can be submitted on the
Page 44459
issuer's behalf by an issuer's business associate. Regardless, the qualified entity is responsible for ensuring that the issuer or the issuer's business associate is truly providing the qualified entity with claims data for a majority of the issuer's covered lives in the geographic region and during the timeframe of the non-public analyses requested by the issuer.
We recognize the desire to allow use of data from other sources to meet the issuer's claims submission threshold. However, due to the statutory limits on to whom the qualified entity may release patient identifiable data, we do not believe it would be possible for an issuer to ever verify whether the data the qualified entity holds is representative of the majority of the issuer's covered lives in the applicable geographic region during the applicable time frame unless the issuer or its business associate was the source of such data.
Regarding the definition of covered lives, we recognize that there is no commonly accepted definition of covered lives. We plan to rely on the methods of calculating covered lives established in regulations promulgated by the Internal Revenue Service (IRS) in December of 2012. These regulations at 26 CFR 46.4375-1(c)(2) offer issuers four methods for calculating the average number of lives covered under a specified health insurance policy--(1) the actual count method, (2) the snapshot method, (3) the member months method, and (4) the state form method--
and provide both the calculation method and an example for each of the four methods for counting covered lives. These calculations all only apply to health insurance policies and we would like to clarify that the calculation of covered lives for purposes of the qualified entity program does not include dental, disability, or life insurance policies. We have modified the regulatory text at Sec. 401.716(b)(1) to refer directly to the IRS regulations.
Second, we proposed that except when patient-identifiable non-
public analyses are shared with the patient's provider or supplier, all non-public analyses must be patient de-identified using the de-
identification standards in the HIPAA Privacy Rule at 45 CFR 164.514(b). Additional information on the HIPAA de-identification standards can be found on the HHS Office for Civil Rights Web site at http://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html. We also proposed a definition for patient.
Comment: Many commenters stated that they agreed with CMS' proposal that analyses must be de-identified unless the recipient is the patient's provider or supplier. One commenter suggested that CMS allow other authorized users to receive patient-identifiable analyses, stating that patient-identifiable data will be equally valuable to the additional proposed authorized users, and that patients can also directly benefit from the sharing of patient-identifiable data beyond suppliers and providers.
Response: We thank commenters for their support. While we can see some advantages to sharing patient-identifiable analyses with other types of authorized users, the statutory language at Section 105(a)(3)(B) of MACRA states that analyses may not contain any information that individually identifies a patient unless the analyses are provided or sold to the patient's provider or supplier. Given the statutory requirements, we are finalizing our proposal that patient-
identifiable analyses should only be shared with the patient's provider or supplier.
Comment: Many commenters stated that they agreed with the proposal to use the de-identification standards in the HIPAA Privacy Rule. However, one commenter suggested that CMS modify the HIPAA de-
identification standards to allow inclusion of full patient five-digit zip code without population thresholds and inclusion of the month element for all dates directly related to a patient, including date of death but excepting date of birth. This commenter stated that this additional information would empower providers and suppliers to fully evaluate their care and quality improvement efforts on a timely and ongoing basis with insight into geographic and temporal factors and patterns.
Response: The framework for de-identification that is described in the HIPAA Privacy Rule represents an industry standard for de-
identification of health information. Additional information on the HIPAA de-identification standards can be found on the HHS Office for Civil Rights Web site at http://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html. We believe that modifying this framework for the purposes of the qualified entity program would be likely to create confusion among qualified entities and authorized users, many of whom are or will be HIPAA covered entities or their business associates.
Comment: One commenter noted a technical issue at Sec. 401.716(b)(3) where the text inappropriately referenced Sec. 401.716(c)(2). One commenter suggested CMS clarify whether the data used in the analysis needs to be de-identified at the time of the analysis or whether the analysis itself has to be de-identified at the time it is shared with an authorized user.
Response: We thank the commenter for noting this technical issue and have fixed the reference to Sec. 401.716(b)(2). We would also like to clarify that the data used by the qualified entity to conduct the analyses does not need to be de-identified, but the analyses must be patient de-identified before they are shared with or sold to an authorized user unless the recipient is the patient's provider or supplier.
Comment: We received a number of comments on the definition of a patient. Many commenters stated that the time period of 12 months for a face-to-face or telehealth appointment was not sufficient. One commenter recommended extending the period to 18 months, while several other commenters suggested a timeframe of 24 months. These commenters noted that stabilized patients do not necessarily visit their physician every year. Another commenter suggested that a patient be defined as an individual who has visited the provider or supplier at least once during the timeframe for which the analysis is being conducted.
Response: We acknowledge that healthy patients may not visit a provider or supplier every year. As a result, we are changing the definition of a patient to have a timeframe of the past 24 months for a face-to-face or telehealth appointment.
Comment: One commenter recommended that the definition of a patient be expanded beyond an affiliation with a provider or supplier to an affiliation with an issuer, employer, or state agency or any other authorized user.
Response: As noted above, we believe Section 105(a)(3)(B) of MACRA only permits patient-identifiable information to be shared by a qualified entity with the patient's provider or supplier.
Third, we proposed to bar qualified entities' disclosure of non-
public analyses that individually identify a provider or supplier unless: (a) The analysis only individually identifies the singular recipient of the analysis or (b) each provider or supplier who is individually identified in a non-public analysis that identifies multiple providers/suppliers has been afforded an opportunity to review the aspects of the analysis about them, and, if applicable, request error correction. We describe the proposed appeal and error correction process in more detail in section II.A.4 below.
Comment: Several commenters recommended that providers and
Page 44460
suppliers should not have the opportunity to review and request error correction for analyses that individually identify the provider or supplier. These commenters noted in particular that analyses identifying fraud or abuse should not be reviewed by the provider in advance of being shared with the authorized user. One commenter suggested that a review and error corrections process for non-public reports only be triggered when a provider or supplier is individually identified and his or her performance is evaluated in the manner described in section 1874(e)(4)(C). Another commenter recommended that when a group of providers are identified as part of a practice group (that is, part of the same Tax Identification Number), and prior consent by the providers has been obtained, the practice group should be considered the entity that can receive analyses for the individual providers in the practice.
Response: We believe that Section 105(a)(6) of MACRA requires that qualified entities allow providers and suppliers an opportunity to review analyses that individually identify the provider or supplier and, if necessary, and, when needed, request error correction in the analyses. In addition, regardless of the statutory requirements, we believe that providers and suppliers should not be evaluated by a qualified entity without having a chance to review and, when needed, request error correction in the analyses. For example, it would not be fair for an issuer to move a provider to a different network tier based on analyses that did not correctly attribute patients to that provider. We recognize that the review and corrections process may lead to some limitations in the development of certain types of analyses, such as those identifying fraud and abuse. However, we believe that creating different standards for different types of analyses would be too administratively complex to implement, and could create tensions between providers and suppliers and qualified entities over whether an analysis warranted review by the provider or supplier before it was shared with an authorized user.
However, we recognize that in many cases providers or suppliers may wish to allow certain authorized users to receive analyses without the need for a review process. For example, clinicians that are part of a group practice may want to allow their practice manager, who may be functioning as the clinician's business associate, to receive analyses without first going through a provider/supplier review or being subject to a request for correction. We believe that the decision about who should be able to receive analyses that individually identify a provider or supplier without such review and opportunity to correct should rest with the individual provider or supplier. As a result, we are adding a third exception to the bar on disclosure of non-public analyses that individually identify a provider or supplier to allow providers or suppliers to designate, in writing, the authorized user(s) that may receive analyses from the qualified entity without first giving the provider or supplier individually identified in the analysis/es the opportunity to review the analyses, and, if applicable, request error correction.
Comment: One commenter recommended that CMS add clarity to what it means to ``individually identify'' a provider or supplier and stated that the definition should indicate that to individually identify means to use direct identifiers such as name or provider number for a provider or supplier that is an individual person. This commenter suggested that naming a physician group or clinic that is not itself a provider or supplier (but that may be comprised of individual providers or suppliers) would not count as individually identifying a provider or supplier. Another commenter suggested that the review and corrections process only apply to the entity that the analyses focus on. For example, if the qualified entity is conducting analyses of episodes of care for patients with joint replacement at a given hospital, the analyses may include findings on many different providers and suppliers, such as surgeons, skilled nursing facilities, home health agencies, and others. In this case, the commenter recommended that only the hospital be given the opportunity to review and request correction of errors.
Response: Regardless of whether they are an individual clinician, group practice, or facility and regardless of whether they are the direct subject of the report, we believe section 105(a)(6) of MACRA requires that qualified entities allow providers and suppliers the opportunity to review and request correction of errors in analyses that identify the provider or supplier. Group practice and facility-level providers and suppliers, as well as those indirectly evaluated in analyses, face as much reputational harm from the dissemination of incorrect information about care delivery and costs as individual clinicians or those directly evaluated in the analyses. We have added language to clarify this requirement at Sec. 401.716(b)(4).
Comment: One commenter suggested that CMS implement a process to proactively educate providers and suppliers regarding the review, corrections, and appeals process for non-public analyses.
Response: We believe that many qualified entities that decide to disclose analyses that individually identify a provider or supplier will choose to do an education campaign with providers and suppliers in their region to ensure that any necessary review and error correction processes go smoothly. This will allow the qualified entity to build a direct relationship with the provider or supplier. In addition, since providers and suppliers are one of the types of authorized users that qualified entities can provide or sell non-public analyses and data to, we believe that qualified entities will proactively attempt to build strong relationships with the provider and supplier community in their region. As a result, while we see a small role for CMS to play in educating providers and suppliers about the review and error correction process through our usual provider outreach channels, we believe qualified entities will play the main role in provider and supplier education about the review, corrections, and appeals process.
Comment: Several commenters suggested additional limitations that CMS should impose on qualified entities with respect to the disclosure of non-public analyses. One commenter recommended that CMS require qualified entities to provide authorized users with a detailed methodology of statistical analyses to ensure their validity. This commenter also stated that CMS should require qualified entities to follow an appropriate methodology in attributing costs to providers. Another commenter suggested that evaluations of physician performance should be required to have data from at least two sources.
Response: With regard to the suggestions around statistical validity and cost attribution, we believe that these are issues that the qualified entity should discuss directly with the authorized user who is receiving or purchasing the analyses. We expect that most, if not all, authorized users will expect the qualified entity to include some description of the methodology for the analyses along with the report, but that the level of detail and content needed by each authorized user may vary. In addition, authorized users may have different ideas about the most appropriate method for cost attribution and we believe that they should be able to work with the qualified entity to make a determination for how to
Page 44461
attribute costs to providers and suppliers. On the issue of requiring at least two sources of data, we believe that section 105(a)(1)(A) of MACRA requires that the non-public analyses be based on the combined data described in 1874(e)(4)(B)(iii) as ``data made available under this subsection with claims data from sources other than claims data under this title''.
-
Limitations on the Authorized User
We proposed to require the qualified entity's use of legally binding agreements with any authorized users to whom it provides or sells non-public analyses. For non-public analyses that only include patient de-identified data, we proposed to require the qualified entity to enter into a contractually binding non-public analyses agreement with any authorized users as a pre-condition to providing or selling such non-public analyses.
Comment: Several commenters stated that they supported the use of a legally binding agreement between the qualified entity and the authorized user. One commenter suggested that CMS develop a standard non-public analyses agreement for qualified entities to use with authorized users.
Response: We thank commenters for their support of this proposal. We believe that many qualified entities will have existing agreements with authorized users that cover the use and disclosure of analyses related to their claims data from other sources. While there may be some value in providing organizations new to this type of work a template for the agreement, we believe that qualified entities would be better served by engaging with their own legal counsel to ensure the agreement meets their specific needs.
For non-public analyses that include patient identifiable data, we proposed to require the qualified entity to enter into a qualified entity Data Use Agreement (QE DUA) with any authorized users as a pre-
condition to providing or selling such non-public analyses. As we also proposed to require use of the QE DUA in the context of the provision or sale of combined data, or the provision of Medicare data at no cost, we discuss our proposals related to the QE DUA and associated comments in the data disclosure discussion in section II.B below.
Requirements in the Non-Public Analyses Agreement
The statute generally allows qualified entities to provide or sell their non-public analyses to authorized users for non-public use, but it bars use or disclosure of such analyses for marketing (see section 105(a)(3)(c) of MACRA). We proposed additional limits on the non-public analyses, given the expansive types of non-public analyses that could be conducted by the qualified entities if no limits are placed on such analyses, and the potential deleterious consequences of some such analyses.
First, we proposed that the non-public analyses agreement require that non-public analyses conducted using combined data or the information derived from the evaluations described in section 1874(e)(4)(D) of the Act may not be used or disclosed for the following purposes: Marketing, harming or seeking to harm patients and other individuals both within and outside the healthcare system regardless of whether their data are included in the analyses (for example, an employer using the analyses to attempt to identify and fire employees with high healthcare costs), or effectuating or seeking opportunities to effectuate fraud and/or abuse in the healthcare system (for example, a provider using the analyses to identify ways to submit fraudulent claims that might not be caught by auditing software). We also proposed to adopt the definition of marketing at 45 CFR 164.501 in the HIPAA Privacy Rule.
Comment: Many commenters stated that they supported the proposed restrictions on the use of the non-public analyses. One commenter suggested that CMS provide greater clarification on what would constitute harm to patients and other individuals both within and outside the healthcare system. This commenter suggested that harm should include activities that would create overly tiered networks that could exclude high quality providers, as well as efforts to limit patient access to certain treatments or drugs or steer patients to certain practices based solely on cost.
Response: We thank commenters for their support of the restrictions on the use of the analyses. On further consideration, we agree that the industry may benefit from additional guidance regarding these restrictions. Therefore, we anticipate providing additional sub-
regulatory guidance on the standards adopted in this rule for the Qualified Entity Certification Program Web site at https://www.qemedicaredata.org/SitePages/home.aspx.
As we did not receive any comments on the proposed definition of marketing, we will finalize the definition without modification.
Second, in accordance with section 105(a)(1)(B)(i) of MACRA, we proposed to require that any non-public analyses provided or sold to an employer may only be used by the employer for the purposes of providing health insurance to employees and retirees of the employer. We also further proposed that if the qualified entity is providing or selling non-public analyses to an employer that this requirement be included in the non-public analyses agreement. We did not receive any comments on this proposal, so are finalizing it without modification.
We also proposed to require qualified entities to include in the non-public analysis agreement a requirement to limit re-disclosure of non-public analyses or derivative data to instances in which the authorized user is a provider or supplier, and the re-disclosure is as a covered entity would be permitted under 45 CFR 164.506(c)(4)(i) or 164.502(e)(1). Accordingly, a provider or supplier may only re-disclose -identifiable health information to a covered entity for the purposes of the covered entity's quality assessment and improvement or for the purposes of care coordination activities, where that entity has a patient relationship with the individual who is the subject of the information, or to a business associate of such a covered entity under a written contract. We also generally proposed to require qualified entities to use a non-public analyses agreement to explicitly bar authorized users that are not providers or suppliers from re-disclosure of the non-public analyses or any derivative data except to the extent a disclosure qualifies as a ``required by law'' disclosure.
Comment: Several commenters suggested that authorized users be allowed to re-disclose analyses in order to publish research findings provided the analyses do not individually identify a provider. These commenters noted that public health interests can be served by allowing the disclosure of research findings to the public. One commenter recommended allowing broad re-disclosure of analyses when the information is beneficiary de-identified, stating that this is necessary to reduce cost and improve patient care across the healthcare system. Several commenters suggested that authorized users be allowed to re-disclose analyses for the purposes of developing products or services, such as analytic tools, algorithms, and other innovations for improving health outcomes.
Response: The statutory language at section 105(a)(5) of MACRA states that authorized users may not re-disclose or make public any analyses, with the exception of allowing providers and suppliers to re-
disclose analyses, as determined by the Secretary, for the
Page 44462
purposes of care coordination and performance improvement activities. As a result, we are finalizing the proposed language on re-disclosure of analyses without modification. However, we would like to note that CMS currently makes data available to researchers outside of this qualified entity program, including those interested in developing products or tools. Individuals and organizations interested in accessing CMS data for research purposes should visit the Research Data Assistance Center (ResDAC) at www.resdac.org for more information.
Fourth, we proposed to require qualified entities to impose a legally enforceable bar on the authorized user's linking de-identified analyses (or data or analyses derived from such non-public analyses) to any other identifiable source of information or in any other way attempting to identify any individual whose de-identified data is included in the analyses or any derivative data.
Comment: One commenter stated that an authorized user should be allowed to link the analyses that contain patient identifiers or any derivative data with other sources when this information is limited to their own patients.
Response: We would like to highlight that the restriction on linking analyses only applies to de-identified analyses. To the extent providers and suppliers are receiving identifiable information on their own patients, the restriction on linking to any other identifiable source of information does not apply.
Finally, we proposed to require qualified entities to use their non-public analyses agreements to bind their non-public analyses recipients to reporting any violation of the terms of that non-public analyses agreement to the qualified entity. We did not receive any comments on this proposal, so are finalizing it without modification.
-
Confidential Opportunity To Review, Appeal, and Correct Analyses
In accordance, with section 105(a)(6) of MACRA, we proposed that the qualified entity must follow the confidential review, appeal, and error correction requirements established at 401.717(f) under section 1874(e)(4)(C)(ii) of the Act.
Comment: We received a wide-ranging set of comments on the proposed review and corrections process. Several commenters supported the proposed review and corrections process. Many commenters suggested changes to the review process for non-public analyses. In general these commenters cited the burden of the proposed process for qualified entities and recommended options to make the process less burdensome. However, other commenters focused on the need for providers and suppliers to have enough time to ensure the analyses are accurate.
Several commenters suggested provider or supplier notification as the first step for review of non-public analyses. One commenter recommended creating an alternative approach to individualized appeals, such as an accreditation process. Another commenter suggested that when a non-public analysis is released to one or more authorized users, or when a non-public analysis is subsequently used for a public report, the qualified entity need only provide an opportunity for the provider or supplier to have reviewed and, if necessary, requested error correction once before the initial release of the analysis. Another commenter recommended that providers and suppliers only be given one chance to request error correction of the underlying data, after which the data could be used in any future non-public analyses.
A few commenters suggested that a 60-day period to review the analyses may not be sufficient. On the other hand, several commenters suggested a 30-day review period for non-public analyses, while another commenter suggested giving providers and suppliers an ongoing right to review the analyses and request error correction.
Response: We appreciate commenters' concerns about allowing providers and suppliers the necessary time to review analyses as well as the concerns about the burden on qualified entities of implementing the public reporting review and corrections process for non-public analyses. However, as noted in the proposed rule, we also believe using the same process for review and error correction for both the non-
public analyses and the public reports creates continuity and a balance between the needs and interests of providers and suppliers and those of the qualified entities, authorized users, and the public.
That said, on further consideration, we believe that the addition of a procedural step whereby the qualified entity would confidentially notify a provider or supplier about the non-public analyses and give the provider or supplier the opportunity to opt-in to the review and error correction process established at Sec. 401.717(a) through (e) is both consistent with the statute and has the potential to reduce the burden on both qualified entities and providers and suppliers. In some cases, notification may be sufficient to meet the needs of a provider or supplier and, as a result, the provider or supplier will choose not to opt-in to the review and correction process, reducing the paperwork and resource burden for both the qualified entity and the provider/
supplier. In addition, where the analyses are similar to previous analyses or use data the provider or supplier has already corrected, the provider or supplier may also choose not to review the analyses.
Under this procedural step, a qualified entity must confidentially notify a provider or supplier that non-public analyses that individually identify the provider or supplier are going to be released at least 65 calendar days before disclosing the analyses to the authorized user. The first five days of the 65 day period is intended to allow time to notify the provider or supplier, and to allow them time to respond to the qualified entity. The next sixty days are reflective of the sixty day review period in Sec. 401.717(a) through (e). The confidential notification about the non-public analyses should include a short summary of the analyses (which must include the measures being calculated, but does not have to include the methodologies and measure results), the process for the provider or supplier to request the analyses, the authorized users receiving the analyses, and the date on which the qualified entity will release the analyses to the authorized users. This notification can cover multiple non-public analyses that use different datasets and measures. The 65-
day period begins on the date the qualified entity sends or emails the notification to providers and suppliers. As we presume some qualified entities may utilize National Provider Identifier (NPI) data as a means of contacting providers and suppliers, we would like to use this opportunity to remind providers and suppliers of the need to keep their NPI information up-to-date.
At any point during this 65-day period, the qualified entity must allow the provider or supplier to opt-in to the review and error correction process established at Sec. 401.717(a) through (e) and request copies of the analyses and, where applicable, access to the data used in the analyses, and to request the correction of any errors in the analyses. However, if the provider or supplier chooses to opt-in to the review and correction process more than 5 days into the notification period, the time for the review and correction process is shortened from regulatory 60 days in Sec. 401.717(a) through (e) to the number of days remaining between the provider or supplier opt-in date and the release
Page 44463
date specified in the confidential notification.
We understand the desire to create an alternative approach to individualized appeals, such as an accreditation process, however, we believe the statutory language at Section 105(a)(6) of MACRA requires that qualified entities allow providers and suppliers an opportunity to review analyses that individually identify the provider or supplier and, if necessary, and, when needed, request error correction in the analyses. In addition, as stated above, regardless of the statutory requirements, we believe that providers and suppliers should not be evaluated by a qualified entity without having a chance to review and, when needed, request error correction in the analyses.
Comment: One commenter recommended that qualified entities not be allowed to provide or sell analyses to an authorized use while an error correction request is outstanding.
Response: We acknowledge the interest of providers and suppliers in ensuring that any analyses correctly represent their care delivery patterns and costs. However, we are concerned that providers and suppliers may make spurious requests for error correction in order to prevent the authorized user from receiving the analyses. As a result, we will maintain the provisions that allow qualified entities to release the non-public analyses after the 65-day period regardless of the status of error corrections. As with the public reporting, the qualified entity must inform the authorized user if a request for error correction is outstanding when the analyses are delivered to the authorized user, and, if applicable, provide corrected analyses if corrections are ultimately made.
-
-
Dissemination of Data and the Use of QE DUAs for Data Dissemination and Patient-Identifiable Non-Public Analyses
Subject to other applicable law, section 105(a)(2) of MACRA expands the permissible uses and disclosures of data by a qualified entity to include providing or, where applicable, selling combined data for non-
public use to certain authorized users, including providers of services, suppliers, medical societies, and hospital associations for use in developing and participating in quality and patient care improvement activities. Section 105(a)(3)(B) of MACRA. Subject to the same limits, it also permits a qualified entity to provide Medicare claims data for non-public use to these authorized users; however, a qualified entity may not charge a fee for providing such Medicare claims data. In addition, in order to provide or sell combined data or Medicare data, section 105(a)(4) of MACRA instructs the qualified entity to enter into a DUA with their intended data recipient(s).
-
General Requirements for Data Dissemination
To implement the provisions in Section 105(b) of MACRA, we proposed to provide that, subject to other applicable laws (including applicable information, privacy, security and disclosure laws) and certain defined program requirements, including that the data be used only for non-
public purposes, a qualified entity may provide or sell combined data or provide Medicare claims data at no cost to certain authorized users, including providers of services, suppliers, medical societies, and hospital associations. Where a qualified entity is a HIPAA-covered entity or is acting as a business associate, compliance with other applicable laws will include the need to ensure that it fulfills the requirements under the HIPAA Privacy Rule, including the restriction on the sale of PHI at 45 CFR 164.502(a)(5)(ii).
Comment: Several commenters stated that CMS should provide additional clarity on the term no cost as it relates to the provision of Medicare data. For example, commenters stated that qualified entities may wish to charge a fee for entering into a data use agreement with an authorized user, but then not charge for the data. In addition, some of these commenters recommended that CMS allow qualified entities to recoup the costs associated with providing Medicare data at no cost. These commenters stated that there is a cost associated with providing claims data to authorized users, such as staff time to create the data extract and encrypt the file.
Response: We understand that qualified entities will face costs providing Medicare data to authorized users. However, section 105(a)(2)(C) of MACRA expressly states that, if a qualified entity were to elect to make Medicare claims data available, such data must be ``provided'' at no cost. We believe that the paperwork and processing costs associated with accepting and fulfilling Medicare claims data requests are an integral part of the ``provision'' of data. As such, qualified entities may not charge authorized users for the Medicare data itself or any activity associated with requests for or the fulfillment of Medicare data requests (such as the processing of a data use agreement). However, we also note that the qualified entity is not required to offer authorized users the opportunity to request Medicare claims data. Qualified entities may choose to only offer authorized users the opportunity to receive or purchase combined data. Qualified entities may also choose not to allow authorized users to request data at all.
Comment: One commenter suggested that CMS require qualified entities to sell the combined data at a reasonable price which reflects their actual cost.
Response: We appreciate the commenter's interest in ensuring qualified entities charge authorized users reasonable fees for combined data. However, we believe that qualified entities should be allowed to determine the appropriate fee to charge authorized users for access to the combined data. If qualified entities set their prices too high authorized users have the choice of not buying the data, or potentially obtaining the data from another qualified entity with more reasonable pricing.
Comment: One commenter recommended that CMS provide additional clarity on the threshold for the amount of other data that must be combined with the Medicare data in order for the qualified entity to sell the combined data.
Response: As discussed above, we have not established a threshold for the amount of other data that must be combined with the Medicare data. It is our expectation that qualified entities will use sufficient claims data from other sources to ensure validity and reliability.
-
Limitations on the Qualified Entity Regarding Data Disclosure
In accordance with section 105(a)(2), we proposed to place a number of limitations on the sale or provision of combined data and the provision of Medicare claims data by qualified entities, including generally barring the disclosure of patient-identifiable data obtained through the qualified entity program.
Comment: Several commenters stated that CMS should provide additional clarity around whether the data must go through a review and corrections process before it is disclosed to an authorized user. One commenter recommended that providers and suppliers be allowed to review, appeal, and correct the data before it is disclosed.
Response: Section 105(a)(6) of MACRA only requires a review and corrections process when a qualified entity is providing or selling an analysis to an authorized user. While we understand that some providers and
Page 44464
suppliers may wish to ensure that their data is correct before it is shared with an authorized user, we believe that this process would be very rigorous and burdensome for the qualified entity and would have little value for most providers and suppliers.
We proposed to require any combined data or Medicare claims data that is provided to an authorized user by a qualified entity under subpart G be beneficiary de-identified in accordance with the de-
identification standards in the HIPAA Privacy Rule at 45 CFR 164.514(b). We also proposed an exception that would allow a qualified entity to provide or sell patient-identifiable combined data and/or provide patient-identifiable Medicare claims data at no cost to an individual or entity that is a provider or supplier if the provider or supplier has a patient relationship with every patient about whom individually identifiable information is provided and the disclosure is consistent with applicable law.
Comment: Several commenters agreed with the proposal to only allow identifiable data to be disclosed to providers or suppliers with whom the identified individuals have a patient relationship. One commenter suggested that qualified entities be allowed to share limited data sets (as defined in HIPAA) with providers and suppliers for individuals who are not their patients. Another commenter recommended that qualified entities be allowed to disclose patient-identifiable data to health plans.
Response: Section 105(a)(3) of MACRA requires that data disclosed to an authorized user not contain information that individually identifies a patient unless the data is being shared with that patient's provider or supplier. We further note that limited data sets include indirect identifiers, and, as such, are subject to that mandate. While we can imagine that health systems would be interested in conducting population-wide analyses that look at disease incidence or care delivery patterns, we believe these types of analyses can be conducted using de-identified data. In addition, authorized users that may not receive patient-identifiable data, such as issuers, could ask the qualified entity to conduct analyses on these topics, and purchase or receive the patient-deidentified analyses that result from such efforts.
Second, we proposed to require qualified entities to bind the recipients of their data to a DUA that will govern the use and, where applicable, re-disclosure of any data received through this program prior to the provision or sale of such data to an authorized user.
Comment: Several commenters stated that they agreed with the proposal to require qualified entities to bind authorized users who receive data to a DUA. One commenter recommended that when the required ``QE DUA'' (the DUA between the Qualified Entity (QE) and the Authorized User) provisions already exist in another contract between the qualified entity and the authorized user, the qualified entity should not be required to re-paper those terms.
Response: We thank commenters for their support of this proposal. In cases where all the terms of the QE DUA at Sec. 401.713(d) are contained in a contractually binding agreement between the qualified entity and the authorized user, we do not intend to require the qualified entity to re-paper that agreement as a QE DUA.
-
Data Use Agreement (DUA)
A qualified entity must enter a DUA with CMS as a condition of receiving Medicare data. Furthermore, in accordance with Section 105(a)(4) of MACRA, we proposed to require the execution of a DUA as a precondition to a qualified entity's provision or sale of data to an authorized user. As discussed above, we also proposed to require the qualified entity to enter into a DUA with any authorized user as a pre-
condition to providing or selling non-public analyses that include patient-identifiable data. To help differentiate the DUA between CMS and the qualified entity from the DUAs between the qualified entity and the authorized user, we proposed certain clarifying changes that recognize that there are now two distinct DUAs in the qualified entity program--the CMS DUA, which is the agreement between CMS and a qualified entity, and what we will refer to as the QE DUA, which will be the legally binding agreement between a qualified entity and an authorized user.
Comment: Several commenters had overall comments on the QE DUA. One commenter recommended that CMS create a standard QE DUA. Another commenter stated that the data released to authorized users should not be subject to discovery or admitted into evidence without the provider or supplier's consent. A few commenters suggested that the QE DUA include a provision that prevents the disclosure of competitively sensitive data, such as Part D bid information. Finally, one commenter suggested that authorized users should have some direct responsibility for actions that run afoul of contractual requirements.
Response: As noted above, qualified entities may have existing agreements with authorized users where all required QE DUA elements are covered, and we are not requiring re-papering in those instances. Furthermore, also as noted above, we believe that qualified entities without existing agreements would be better served by engaging with their own legal counsel to ensure the QE DUA meets their specific needs.
As discussed above, we believe the statutory requirement that data not be subject to discovery or admitted into evidence without the provider or supplier's consent only applies to data released to the qualified entity under 1874(e) and when that data is in the possession of the qualified entity.
Regarding concerns about disclosure of competitively sensitive information, qualified entities only receive Medicare Parts A and B claims data and certain Part D drug event data from CMS. In addition, we only provide qualified entities with aggregated Part D cost information, not the proprietary individual component costs. As a result, we do not believe there is a risk that qualified entities would be in a position to disclose competitively sensitive information to authorized users.
Finally, as we stated in the proposed rule, we only have authority to impose requirements on the qualified entity. As a result, we must rely on the qualified entity to impose legally enforceable obligations on the authorized user.
Requirements in the QE DUA
In Sec. 401.713(d), we proposed a number of contractually binding provisions that would be included in the QE DUA. First, we proposed to require that the QE DUA contain certain limitations on the authorized user's use of the combined data and/or Medicare claims data and/or non-
public analyses that contain patient-identifiable data and/or any derivative data (hereinafter referred to as data subject to the QE DUA) to those purposes described in the first or second paragraph of the definition of ``healthcare operations'' under 45 CFR 164.501, or that which qualifies as ``fraud and abuse detection or compliance activities'' under 45 CFR 164.506(c)(4). We also proposed to require that all other uses and disclosures of data subject to the QE DUA be prohibited except to the extent a disclosure qualifies as a ``required by law'' disclosure. We did not receive any comments on our proposal to allow authorized users to use the data subject to the QE DUA for the purposes described in the first or second paragraph of the definition of ``healthcare operations'' under 45 CFR
Page 44465
164.501. Therefore, we are finalizing our proposal. In doing so, we identified inadvertent drafting errors in the proposed regulatory text at Sec. 401.713(d)(1)(i)(A) and (B) (mis-identifying which activities fell into which paragraphs of 45 CFR 164.501). We have therefore corrected those draft regulatory provisions to conform the new 42 CFR 401.713(d)(1)(i)(A) and (B) with the content of the first and second paragraphs of the definition of health care operations under 45 CFR 164.501.
Comment: We received several comments on allowing authorized users to use the data subject to the QE DUA for purposes which qualify as ``fraud and abuse detection or compliance activities'' under 45 CFR 164.506(c)(4). Several commenters stated that the allowing use of the data subject to the QE DUA for fraud and abuse detection is unwarranted and without basis in the statutory text. However, another commenter explicitly supported use of the data subject to the QE DUA to bolster efforts to fight fraud. One commenter suggested the addition of ``waste'' detection as an allowed use of the data subject to the QE DUA.
Response: We believe that section 105(a)(3)(A)(ii) of MACRA is illustrative (providing for certain non-public uses ``including'' certain cross-referenced activities). It does not prevent use of the data for fraud and abuse detection and compliance activities. As a result, we are finalizing our proposal to allow authorized users to use the data subject to the QE DUA for fraud and abuse detection. While we can understand the interest in adding waste detection to the list of allowed uses of the data subject to the QE DUA, we believe it is best to stay consistent with the language established in HIPAA since many of other authorized users receiving data subject to the QE DUA are also HIPAA covered entities.
Comment: One commenter suggested that authorized users also be allowed to use the data subject to the QE DUA for ``treatment'' as defined under 45 CFR 164.501.
Response: We agree that use of the data subject to the QE DUA for treatment purposes is a valid possible use of the data and consistent with the statute. As a result, we have modified the language at Sec. 401.713(d)(1)(i) to include treatment.
We also proposed to require qualified entities to use the QE DUA to contractually prohibit the authorized users from using the data subject to the QE DUA for marketing purposes. We did not receive any comments on this proposal, and are finalizing it without modification.
We proposed at Sec. 401.713(d)(3) to require qualified entities to contractually bind authorized users using the QE DUA to protect patient-identifiable data subject to the QE DUA, with at least the privacy and security protections that would be required of covered entities and their business associates under the HIPAA Privacy and Security Rules. We proposed to require that the QE DUA contain provisions that require that the authorized user maintain written privacy and security policies and procedures that ensure compliance with these HIPAA-based privacy and security standards and the other standards required under this subpart for the duration of the QE DUA. We also proposed to require QE DUA provisions detailing such policies and procedures survive termination of the QE DUA, whether for cause or not.
Comment: One commenter suggested that CMS clarify that the QE DUA by itself does not make the authorized user a covered entity or business associate under HIPAA if the authorized user does not otherwise meet those definitions.
Response: We wish to clarify that this rule does not comment on whether an entity is a covered entity or business associate under HIPAA. We are simply requiring the authorized users to comply with the privacy and security protections required of covered entities and their business associates under the HIPAA Privacy and Security Rules (that is, the authorized users must comply with those provisions as if they were acting in the capacity of a covered entity or business associate dealing with protected health information). We feel that such standards represent an industry-wide standard for the protection of patient-
identifiable data, and note that this requirement would be in keeping with section 105(a)(4) of MACRA.
We also proposed at Sec. 401.713(d)(7) to require that the qualified entity use the QE DUA to contractually bind an authorized user as a condition of receiving data subject to the QE DUA under the qualified entity program to notify the qualified entity of any violations of the QE DUA. We did not receive any comments on this proposal, so are finalizing it without modification.
In addition, we proposed at Sec. 401.713(d)(4) to require that the qualified entity include a provision in its QE DUAs that prohibits the authorized user from re-disclosing or making public data subject to the QE DUA except as provided in paragraph (d)(5). We proposed at Sec. 401.713(d)(5) to require that the qualified entity use the QE DUA to limit provider's and supplier's re-disclosures to a covered entity pursuant to 45 CFR 164.506(c)(4)(i) or 164.502(e)(1). Therefore, a provider or supplier would generally only be permitted to re-disclose data subject to the QE DUA to a covered entity or its business associate for activities focused on that covered entity's quality assessment and improvement, including the review of provider or supplier performance. We also proposed to require re-disclosure when required by law.
Comment: Several commenters stated that they supported CMS' proposals related to re-disclosure of data. One commenter suggested that providers and suppliers be allowed to re-disclose data for direct patient care and issues of patient safety. Another commenter recommended that any authorized user be allowed to re-disclose de-
identified data for the purposes of publishing de-identified statistical results.
Response: We thank commenters for their support of the re-
disclosure proposals. While we can understand interest in explicitly referencing issues of patient safety, we do not believe it is necessary given that the first paragraph of the definition of healthcare operations includes patient safety activities and, thus issues of patient safety are permitted reasons for re-disclosure of the data. However, we recognize that as proposed, providers and suppliers would not be allowed to re-disclose the data subject to the QE DUA for treatment purposes. As a result, we are modifying the language at Sec. 401.713(d)(5)(i) to allow providers and suppliers to re-disclose data subject to the QE DUA as a covered entity would be permitted to disclose PHI under 45 CFR 164.506(c)(2), which allows a covered entity to disclose data for the treatment activities of a healthcare provider.
Regarding the recommendation to allow for re-disclosure of de-
identified data in order to publish statistical results, we do not believe that this purpose is consistent with section 105(a)(5)(A) of the MACRA statute, which explicitly states that an authorized user who is provided or sold data shall not make public such data or any analysis using such data.
We also proposed to require qualified entities to impose a contractual bar using the QE DUA on the downstream recipients' linking of the re-disclosed data subject to the QE DUA to any other identifiable source of information. The only exception to this general policy would be if a provider or supplier were to receive identifiable information limited to its own patients.
Page 44466
Comment: Several commenters stated that they supported the proposals related to linking the data. One commenter suggested that business associates of providers or suppliers be allowed to link the data subject to the QE DUA. Another commenter recommended that authorized users be allowed to link the patient de-identified data so long as the intent or result is not to re-identify patients and the resulting data set meets the HIPAA standard for de-identification.
Response: We would like to clarify that the prohibition on linking only applies to patient de-identified data subject to the QE DUA. To the extent that a provider or supplier receives patient-identifiable data subject to the QE DUA and discloses that data to a business associate as allowed under Sec. 401.713(d)(5)(i), that provider or supplier may request that the business associate link the data subject to the QE DUA to another data source.
While we understand that some authorized users may wish to link the de-identified data subject to the QE DUA, we believe that this creates too much risk of inadvertent re-identification. However, instead of linking the data themselves, authorized users could choose to share their additional data, in accordance with applicable law, with the qualified entity who could link this new data source to the existing data and then create de-identified analyses to share with the authorized user.
-
-
Authorized Users
-
Definition of Authorized User
Section 105(a)(9)(A) of MACRA defines authorized users as: A provider of services, a supplier, an employer (as defined in section 3(5) of the Employee Retirement Insurance Security Act of 1974), a health insurance issuer (as defined in section 2791 of the Public Health Service act), a medical society or hospital association, and any other entity that is approved by the Secretary. We proposed a definition for authorized user at Sec. 401.703(k) that is consistent with Section 105(a)(9)(A) of MACRA and includes two additional types of entities beyond those established in the statute--healthcare professional associations and state agencies. Specifically, we proposed to define an authorized user as: (1) A provider; (2) a supplier; (3) an employer; (4) a health insurance issuer; (5) a medical society; (6) a hospital association; (7) a healthcare professional association; or (8) a state agency.
Comment: Commenters had a wide ranging list of suggested additions to the definition of an authorized users, including: Other types of associations and partnership groups whose missions support the permitted data uses, entities with expertise in quality measure development, organizations engaged in research, federal agencies, regional health improvement collaboratives, and the Indian Health Service (and Indian Health programs). Several commenters also suggested that CMS create a process for qualified entities to seek approval for additional authorized users that may not fit into the regulatory definitions.
Response: We recognize that many organizations are interested in accessing analyses provided by the qualified entity. However, CMS believes we must maintain a carefully curated list of authorized users to prevent the monitoring of the qualified entity program from becoming too cumbersome. As a result, we are only adding federal agencies, including, but not limited to the Indian Health Service (and Indian Health programs), to the definition of authorized users. Similar to state agencies, we believe that federal agencies, particularly those that provide healthcare services such as the Indian Health Service and the U.S. Department of Veteran Affairs are important partners with CMS in transforming the healthcare delivery system and could substantially benefit from access to analyses to help improve quality and reduce costs, especially for individuals who utilize their services. On the other hand, we believe many of the other suggested authorized users do not represent well defined groups, which could lead to significant confusion as to which entities fall within the group and which do not. In addition, as we noted above, the statute is explicit in its prohibition of releasing the analyses or data to the public, so the addition of any authorized user with a research aim is not consistent with the parameters of the program.
We believe a separate approval process would be very costly for CMS and create additional burdens for qualified entities. We also believe that a standard list of authorized users is the simplest and least administratively burdensome method to ensure equal treatment of qualified entities. Because many of the suggested authorized users do not represent well defined groups, we would envision an approval process for each entity requesting analyses, which would potentially be more burdensome for smaller regional qualified entities that do not have the time or resources to devote to the approval process. Furthermore, we have an existing process through which entities can obtain Medicare data for research purposes. More information on accessing CMS data for research can be found on the ResDAC Web site at www.resdac.org.
Comment: Several commenters suggested that other organizations beyond providers, suppliers, hospital associations, and medical societies be allowed to access data. A few commenters suggested any entity should be allowed to access de-identified data. Another commenter recommended the creation of a new authorized user called a healthcare provider or supplier collaborator and defined as an organization or entity that does not directly treat patients, but works closely with the provider or supplier in connection with treatment of patients.
Response: Section 105 (a)(2)(A)(i) only allows for the disclosure of data to a provider of services, a supplier, and a medical society or hospital association.
Comment: Several commenters suggested that authorized users that are allowed to act on behalf of their subparts (for example, Accountable Care Organizations) or business associates as defined in HIPAA should be allowed to receive data and/or analyses directly.
Response: We do not intend to prevent organizations acting under a contract with an authorized user from receiving data or the analyses on behalf of the authorized user. Therefore, we have modified the definition of authorized user to include contractors, including, where applicable, business associates as that term is defined at 45 CFR 160.103. An authorized user is now defined as a third party and its contractors (including, where applicable, business associates as that term is defined at 45 CFR 160.103) that need analyses or data covered by this section to carry out work on behalf of that third party (meaning not the qualified entity or the qualified entity's contractors) to whom/which the qualified entity provides or sells data as permitted under this subpart. Authorized user third parties are limited to the following entities: A provider, a supplier, a medical society, a hospital association, an employer, a health insurance issuer, a healthcare provider and/or supplier association, a state entity, a federal agency.
We would like to note that with this change to the definition of authorized user a qualified entity is now also liable for the actions of the third party's contractors who enter into a QE DUA with the qualified entity.
Comment: One commenter suggested a modification to the definition of provider to include dieticians, social workers, case management nurses, and other allied health professionals.
Page 44467
Response: The current definition of a supplier is a physician or other practitioner that furnishes healthcare services under Medicare. To the extent that dieticians, social workers, case management nurses, and other allied health professionals are furnishing healthcare services under Medicare, they would already be considered suppliers. If they are not furnishing services under Medicare, we do not believe the analyses or data based on Medicare claims data will hold much value for improving care delivery or reducing costs, and so we decline expanding the definition to include them.
-
Definition of Employer
We proposed to define an employer as having the same meaning as the term ``employer'' defined in Section 3(5) of the Employee Retirement Insurance Security Act of 1974.
Comment: One commenter suggested that the definition of employer should not include any third-party consultant or wellness program vendors.
Response: As noted above, we believe authorized users should be allowed to share analyses and data with contractors who need such information to conduct work on their behalf. Therefore, we modified the definition of authorized user to include contractors. To the extent a wellness vendor is an employer's contractor, the vendor will be required to sign a non-public analyses agreement and will be bound to only use and disclose the analyses in a manner consistent with the provisions of that agreement. We would also like to point out that as specified in Sec. 401.716(c)(2), employers, and their contractors, may only use the analyses for the purposes of providing health insurance to employees, retirees, or dependents of employees.
-
Definition of Health Insurance Issuer
We proposed to define a health insurance issuer as having the same meaning as the term ``health insurance issuer'' defined in Section 2791(b)(2) of the Public Health Service Act.
Comment: One commenter suggested that the definition of health insurance issuer should not include any third-party consultant or wellness program vendors.
Response: As with employers, we believe issuers should be allowed to share analyses and data with contractors who need such information to conduct work on their behalf. Therefore, as stated above, we have modified the definition of authorized user. To the extent a wellness vendor is an issuer's contractor, the vendor will be required to sign a non-public analyses agreement and will be bound to only use and disclose the analyses in a manner consistent with the provisions of that agreement.
-
Definition of ``Medical Society''
We proposed to define a medical society as a non-profit organization or association that provides unified representation for a large number of physicians at the national or state level and whose membership is comprised mainly of physicians.
Comment: One commenter requested that CMS provide an example of a medical society.
Response: We would consider the American Medical Association or the American Academy of Family Physicians to be national-level medical societies. At the state-level, the Medical Association of the State of Alabama is an example of a medical society under this definition.
-
Definition of ``Hospital Association''
We proposed to define a hospital association as a non-profit organization or association that provides unified representation for a large number of hospitals or health systems at the national or state level and whose membership is comprised of a majority of hospitals and health systems.
Comment: One commenter requested that CMS provide an example of a hospital association.
Response: We would consider the American Hospital Association or the Federation of American Hospitals to be national hospital associations. At the state-level, the Hospital and Healthsystem Association of Pennsylvania is an example of a hospital association under this definition.
Comment: Several commenters suggested that the definition of hospital association be expanded to include associations at the local level and quality organizations that are affiliated with, but have separate 501(c)(3) numbers from their state hospital association.
Response: CMS recognizes that local hospital associations may work more closely on issues such as quality improvement with hospitals and health systems in their area than state or national associations. As a result, we have modified the definition of hospital association to include local-level organizations. However, we do not believe that the MACRA statute at 105(a)(9)(v) intends for quality organizations affiliated with a hospital association to be considered a hospital association since the language only refers to hospital association and does not reference quality organizations. To the extent that these quality organizations are doing work on behalf of the state hospital association under contract, and that work requires access to such data or analyses, these quality organizations would be considered authorized users and would be required to enter into a QE DUA and/or non-public analyses agreement with the qualified entity.
-
Definition of ``Healthcare Provider and/or Supplier Association''
We proposed to define a healthcare provider and/or supplier association as a non-profit organization or association that represents providers and suppliers at the national or state level and whose membership is comprised of a majority of providers and/or suppliers. We did not receive any comments on this definition, so are finalizing it without modification.
-
Definition of ``State Agency''
We proposed to define a state agency as any office, department, division, bureau, board, commission, agency, institution, or committee within the executive branch of a state government.
Comment: One commenter stated that state agencies should be limited to those entities that promote care quality and patient care improvement activities. Another commenter recommended that the term state agency be changed to state entity to help avoid conflict with state-specific references to the word ``agency.'' One commenter suggested CMS provide clarity on whether the definition of state agency includes political subdivisions of the state.
Response: We do not believe that state agencies should be limited to those entities focused on care quality and patient care improvement. There are a wide-array of uses of the non-public analyses by states who are CMS' partners in transforming the healthcare delivery system. We do appreciate the comment related to the use of the term agency at the state-level, and have modified this term in the regulations to be ``state entity.'' In addition, to provide clarity, we note that we did not intend for the definition of state agency to include political subdivisions of a state, such as a county, city, town, or village, and as a result have not added these to the definition.
-
-
Annual Report Requirements
-
Reporting Requirements for Analyses
Section 105(a)(8) of MACRA expands the information that a qualified entity must report annually to the Secretary if
Page 44468
a qualified entity provides or sells non-public analyses. Therefore, consistent with these requirements, we proposed to require that the qualified entity provide a summary of the non-public analyses provided or sold under this subpart, including specific information about the number of analyses, the number of purchasers of such analyses, the types of authorized users that purchased analyses, the total amount of fees received for such analyses. We also proposed to require the qualified entity to provide a description of the topics and purposes of such analyses. In addition, we proposed to require a qualified entity to provide information on QE DUA and non-public analyses agreement violations.
Comment: Several commenters suggested additions to the reporting requirements for analyses. One commenter suggested that qualified entities include the specific entities to whom analyses were provided or sold as well as more detailed pricing information. Another commenter recommended the addition of the frequency and nature of requests for error correction, and how often analyses are disclosed with unresolved requests for error correction.
Response: We believe that Section 105(a)(8)(A) of MACRA intends for qualified entities to provide a summary of the analyses and that the specific details of the entities who received analyses or the pricing information for analyses are not consistent with that intent. We do believe there is value in monitoring requests for error correction to ensure that qualified entities are not releasing analyses that consistently have requests for error correction, which could indicate a qualified entities' poor use of the Medicare data; however, we believe the requirement to provide this information, with the exception of how often analyses are disclosed with unresolved requests for error correction, already exists as part of the annual reporting requirements under Sec. 401.719(b)(2). We believe including how often analyses are disclosed with unresolved error requests in the annual reports is important because it allows CMS to track possible poor use of the Medicare data by qualified entities. Therefore, we have added the requirement to report the number of analyses disclosed with unresolved requests for error correction at Sec. 401.719(b)(3)(iii).
Comment: One commenter suggested that the annual reports be made public.
Response: We recognize that in some cases the annual reports may contain sensitive commercial information and, as a result, we do not believe the reports should be made public. We would like to clarify, however, that anytime CMS receives a request for information under the Freedom of Information Act (FOIA), the agency always evaluates whether the information is subject to one of the FOIA exemptions, including Exemption 4, which protects commercial or financial information that is privileged and confidential. We welcome identification of any materials within such reports that the qualified entity believes are subject to a FOIA exemption, and the rationale therefore.
-
Reporting Requirements for Data
Section 105(a)(8) of MACRA also requires a qualified entity to submit a report annually if it provides or sells data. Therefore, consistent with the statutory requirements, we also proposed to require qualified entities that provide or sell data under this subpart to provide the following information as part of its annual report: Information on the entities who received data, the uses of the data, the total amount of fees received for providing, selling, or sharing the data, and any QE DUA violations.
Comment: Several of the comments on reporting requirements for data were the same as those for analyses addressed above. One commenter suggested the addition of information on authorized user data breaches to the annual report. Another commenter stated that the annual reporting requirements for data may contain sensitive commercial information that may be subject to confidentiality provisions between the qualified entity and applicable authorized users.
Response: We believe that data breaches should be reported to CMS in a much timelier manner than the annual report. As discussed above, the QE DUA requires authorized users to notify the qualified entity of any violations of the QE DUA and to comply with the breach provisions governing qualified entities. As a result, we do not believe this element is needed in the annual report.
We recognize that some of the information we proposed to require of qualified entities in their annual reports will be sensitive commercial information. As noted above, anytime CMS receives a request for information under the FOIA, the agency always evaluates whether the information is subject to one of the FOIA exemptions, including Exemption 4, which protects commercial or financial information that is privileged and confidential. Contractual confidentiality provisions between authorized users and qualified entities will not negate CMS' obligations under FOIA, but we welcome identification of any materials within such reports that the qualified entity believes are subject to a FOIA exemption, and the rationale therefore.
-
-
Assessment for a Breach
-
Violation of a DUA
Section 105(a)(7) of MACRA requires the Secretary to impose an assessment on a qualified entity in the case of a ``breach'' of a CMS DUA between the Secretary and a qualified entity or a breach of a QE DUA between a qualified entity and an authorized user. Because the term ``breach'' is defined in HIPAA, and this definition is not consistent with the use of the term for this program, we proposed instead to adopt the term ``violation'' when referring to a ``breach'' of a DUA for purposes of this program. We also proposed to define a ``violation'' to mean a failure to comply with a requirement in a CMS DUA or QE DUA. We also proposed to impose an assessment on any qualified entity that violates a CMS DUA or fails to ensure that their authorized users and their contractors/business associates do not violate a QE DUA.
Comment: A few commenters recommended that CMS further define and provide examples of what would constitute a DUA violation. Another commenter suggested CMS expand the definition of a violation so that both the qualified entity and the authorized user may be held responsible for a breach.
Response: While we recognize that not all terms of the DUAs are equal regarding the risk to the privacy and security of the Medicare data, we believe the aggravating and mitigating circumstances discussed in more detail below provide us the flexibility to ensure the assessment amount is consistent with the nature of the violation. One example of a violation would be knowingly releasing patient names and other protected health information for marketing purposes. Another example of a violation would be sharing individually identifiable information for an individual who does not meet the definition of a patient with a supplier.
While we recognize that it may be the authorized user who is responsible for the violation, we believe Section 105(a)(7) of MACRA does not give us the authority to impose an assessment on the authorized user. However, we do believe that the qualified entity could include terms in their agreement with the authorized user to require the authorized user to pay the assessment if the authorized user is responsible for the violation.
Page 44469
MACRA provides guidance only on the assessment amount and what triggers an assessment, but it does not dictate the procedures for imposing such assessments. We therefore proposed to model qualified entity program procedures on certain relevant provisions of Section 1128A of the Act (Civil Money Penalties) and part 402 (Civil Money Penalties, Assessments, and Exclusions) including the process and procedures for calculating the assessment, notifying a qualified entity of a violation, collecting the assessment, and providing qualified entities an appeals process.
-
Amount of Assessment
Section 105(a)(7)(B) of MACRA specifies that when a violation occurs, the assessment is to be calculated based on the number of affected individuals who are entitled to, or enrolled in, benefits under part A of title XVIII of the Act, or enrolled in part B of such title. Assessments can be up to $100 per affected individual, but, given the broad discretion in establishing some lesser amount, we looked to part 402 as a model for proposing aggravating and mitigating circumstances that would be considered when calculating the assessment amount per impacted individual. However, violations under section 105(a)(7)(B) of MACRA are considered point-in-time violations, not continuing violations.
Number of Individuals
We proposed at Sec. 401.719(d)(5)(i) that CMS will calculate the amount of the assessment of up to $100 per individual entitled to, or enrolled in part A of title XVIII of the Act and/or enrolled in part B of such title whose data was implicated in the violation.
We generally proposed to determine the number of potentially affected individuals by looking at the number of beneficiaries whose Medicare claims information was provided either by CMS to the qualified entity or by the qualified entity to the authorized user in the form of individually identifiable or de-identified data sets that were potentially affected by the violation.
We proposed that a single beneficiary, regardless of the number of times their information appears in a singular non-public report or dataset, would only count towards the calculation of an assessment for a violation once. For qualified entities that provide or sell subsets of the dataset that CMS provided to them, combined information, or non-
public analyses, we proposed to require that the qualified entity provide the Secretary with an accurate number of beneficiaries whose data was sold or provided to the authorized user and, thereby, potentially affected by the violation. In those instances in which the qualified entity is unable to establish a reliable number of potentially affected beneficiaries, we proposed to impose the assessment based on the total number of beneficiaries that were included in the data set(s) that was/were transferred to the qualified entity under the CMS DUA.
Assessment Amount per Impacted Individual
As noted above, MACRA allows an assessment in the amount of up to $100 per potentially affected individual. We therefore proposed to draw on 42 CFR part 402 to specify the factors and circumstances that will be considered in determining the assessment amount per potentially affected individual.
We proposed at Sec. 401.719(d)(5)(i)(A) that the following basic factors be considered in establishing the assessment amount per potentially affected individual: (1) The nature and extent of the violation; (2) the nature and extent of the harm or potential harm resulting from the violation; and (3) the degree of culpability and history of prior violations.
In addition, in considering these basic factors and determining the amount of the assessment per potentially affected individual, we proposed to take into account certain aggravating and mitigating circumstances.
We proposed at Sec. 401.719(d)(5)(i)(B)(1) that CMS consider certain aggravating circumstances in determining the amount per potentially affected individual, including the following: Whether there were several types of violations, occurring over a lengthy period of time; whether there were many violations or the nature and circumstances indicate a pattern of violations; and whether the nature of the violation had the potential or actually resulted in harm to beneficiaries.
In addition, we proposed at Sec. 401.719(d)(5)(i)(B)(2) that CMS take into account certain mitigating circumstances in determining the amount per potentially affected individual, including the following: Whether the violations subject to the imposition of an assessment were few in number, of the same type, and occurring within a short period of time, and/or whether the violation was the result of an unintentional and unrecognized error and the qualified entity took corrective steps immediately after discovering the error.
Comment: One commenter suggested that CMS allow the qualified entity to take corrective action in the case of a minor violation. Another commenter recommended that CMS impose a limit on the assessment amount because not specifying a maximum assessment amount could create a barrier to entry for entities interested in the program. One commenter stated they supported the statutorily set assessment of $100 per affected individual because it creates a strong incentives for excellent data security.
Response: We recognize the need for a corrective action process and have already established one at Sec. 401.719(d)(1) through (3) that applies regardless of the amount of the assessment. We appreciate commenters concerns about creating a barrier for entry, but agree that allowing for an assessment of up to $100 per affected individual creates strong incentives for the qualified entity to ensure the privacy and security of the Medicare data. We believe the basic, aggravating, and mitigating circumstances provide CMS with the flexibility to set the assessment value appropriately given the nature of the violation and the qualified entity's history with violations.
-
Notice of Determination
We looked to the relevant provisions in 42 CFR part 402 and Section 1128A of the Act to frame proposals regarding the specific elements that would be included in the notice of determination. To that end, we proposed at Sec. 401.719(d)(5)(ii) that the Secretary would provide notice of a determination to a qualified entity by certified mail with return receipt requested. The notice of determination would include information on (1) the assessment amount, (2) the statutory and regulatory bases for the assessment, (3) a description of the violations upon which the assessment was proposed, (4) information concerning response to the notice, and (5) the means by which the qualified entity must pay the assessment if they do not intend to request a hearing in accordance with procedures established at Section 1128A of the Act and implemented in 42 CFR part 1005. We did not receive any comments on this proposal so are finalizing it without modification.
-
Failure To Request a Hearing
We also looked to the relevant provisions in 42 CFR part 402 and section 1128A of the Act to inform our proposals regarding what happens when a hearing is not requested.
Page 44470
We proposed at Sec. 401.719(d)(5)(iii) that an assessment will become final if a qualified entity does not request a hearing within 60 days of receipt of the notice of the proposed determination. At this point, CMS would impose the proposed assessment. CMS would notify the qualified entity, by certified mail with return receipt, of the assessment and the means by which the qualified entity may pay the assessment. Under these proposals, a qualified entity would not have the right to appeal an assessment unless it has requested a hearing within 60 days of receipt of the notice of the proposed determination. We did not receive any comments on these proposals so are finalizing them without modification.
-
When an Assessment Is Collectible
We again looked to the relevant provisions in 42 CFR part 402 and section 1128A of the Act to inform our proposed policies regarding when an assessment becomes collectible.
We proposed at Sec. 401.719(d)(5)(iv) that an assessment becomes collectible after the earliest of the following situations: (1) On the 61st day after the qualified entity receives CMS's notice of proposed determination under Sec. 401.719(d)(5)(ii), if the entity does not request a hearing; (2) immediately after the qualified entity abandons or waives its appeal right at any administrative level; (3) 30 days after the qualified entity receives the Administrative Law Judge's (ALJ) decision imposing an assessment under Sec. 1005.20(d), if the qualified entity has not requested a review before the Department Appeal Board (DAB); or (4) 60 days after the qualified entity receives the DAB's decision imposing an assessment if the qualified entity has not requested a stay of the decision under Sec. 1005.22(b). We did not receive any comments on this proposal so are finalizing it without modification.
-
Collection of an Assessment
We also looked to the relevant provisions in 42 CFR part 402 and section 1128A of the Act in framing our proposals regarding the collection of an Assessment.
We proposed at Sec. 401.719(d)(5)(v) that CMS be responsible for collecting any assessment once a determination is made final by HHS. In addition, we proposed that the General Counsel may compromise an assessment imposed under this part, after consulting with CMS or Office of Inspector General (OIG), and the Federal government may recover the assessment in a civil action brought in the United States district court for the district where the claim was presented or where the qualified entity resides. We also proposed that the United States may deduct the amount of an assessment when finally determined, or the amount agreed upon in compromise, from any sum then or later owing the qualified entity. Finally, we proposed that matters that were raised or that could have been raised in a hearing before an ALJ or in an appeal under section 1128A(e) of the Act may not be raised as a defense in a civil action by the United States to collect an assessment. We did not receive any comments on these proposals so are finalizing them without modification.
-
-
Termination of Qualified Entity Agreement
We proposed at Sec. 401.721(a)(7) that CMS may unilaterally terminate the qualified entity's agreement and trigger the data destruction requirements in the CMS DUA if CMS determines through our monitoring program at Sec. 401.717(a) and (b) that a qualified entity or its contractor fails to monitor authorized users' compliance with the terms of their QE DUAs or non-public analysis use agreements. We stated in the proposed rule that we believe this proposed provision is consistent with the intent of MACRA to ensure the protection of data and analyses provided by qualified entities to authorized users under this subpart.
Comment: One commenter stated that CMS should have a violation corrections period prior to terminating a qualified entity. Another commenter recommended that CMS carefully monitor all aspects of the qualified entity program and related authorized user activities to minimize the risk of unintended consequences.
Response: We currently have a process in place to require qualified entities to develop a corrective action plan or to put qualified entities on a special monitoring plan if we determine that the qualified entity violated any terms of the program. In addition, we already have a number of mechanisms in place to monitor qualified entities participating in the program including audits, site visits, and required reporting. We believe the additional annual reporting elements described above will ensure that we can continue to monitor qualified entities appropriately given the changes to the program. As a result, we are finalizing our proposed language on termination of a qualified entity's agreement at Sec. 401.721(a)(7).
-
Additional Data
Section 105(c) of MACRA expands, at the discretion of the Secretary, the data that the Secretary may make available to qualified entities, including standardized extracts of claims data under titles XIX (Medicaid) and XXI (the Children's Health Insurance Program, CHIP) for one or more specified geographic areas and time periods as may be requested by the qualified entity. However, due to issues involving Medicaid data submitted to CMS, including lack of data timeliness and overall data quality, we proposed not to expand the data available to qualified entities from CMS and instead suggested that qualified entities would be better off seeking Medicaid and/or CHIP data through the State Medicaid Agencies.
Comment: Many commenters recommended that CMS expand the data available to qualified entities to include Medicaid and CHIP data. These commenters noted the additional burden of having to request the data from each state individually. On the other hand, one commenter stated that they agreed with CMS' proposal not to expand access to Medicaid and/or CHIP data.
Response: As some commenters noted, we have been working with states to transform our Medicaid Statistical Information System (MSIS) to address concerns regarding data timeliness and quality. This is essential for the Medicaid program to keep pace with the data needed to improve quality of care, track enrollment and utilization of services, improve program integrity, and support states and other stakeholders need for information about Medicaid and CHIP. This new data set is known as Transformed MSIS (T-MSIS). The T-MSIS data set contains enhanced information about beneficiary eligibility, beneficiary and provider enrollment, service utilization, claims and managed care data, and expenditure data for Medicaid and CHIP. We are currently working with states to help them transition from MSIS to T-MSIS.
We recognize commenters' interest in accessing Medicaid and CHIP data from CMS rather than going to each state individually. We believe that T-MSIS can create a framework for CMS collection of Medicaid and CHIP data that addresses many of the concerns about the timeliness and quality of the MSIS data that we raised in the proposed rule. As a result, we anticipate future rulemaking to make Medicaid and CHIP data available to qualified entities when the T-MSIS data becomes available and is determined to be of sufficient quality for use in public provider performance reporting.
Comment: One commenter suggested that CMS also allow qualified entities to
Page 44471
request access to Medicare Advantage data.
Response: We believe section 1874(e)(3) of the Act only allows for the disclosure of Medicare claims data under Parts A, B, and D, as well as Medicaid and/or CHIP claims data.
-
Qualified Clinical Data Registries
Section 105(b) of MACRA allows qualified clinical data registries to request access to Medicare data for the purposes of linking the data with clinical outcomes data and performing risk-adjusted, scientifically valid analyses, and research to support quality improvement or patient safety. The CMS research data disclosure policies already allow qualified clinical data registries to request Medicare data for research purposes. More information on accessing CMS data for research can be found on the ResDAC Web site at www.resdac.org. Given the existing research request processes and procedures, we proposed not to adopt any new policies or procedures regarding qualified clinical data registries' access to Medicare claims data for quality improvement or patient safety analyses.
Comment: Several commenters recommended that CMS offer qualified clinical data registries an alternative path to the research request process to allow them to access CMS data for quality improvement and patient safety activities. Commenters stated that qualified clinical data registries need data to conduct quality improvement activities that will improve patient care and that, in many cases, this work is not consistent with the research request process requirement that the work to contribute to generalizable knowledge.
Response: We recognize that the research request pathway may not be consistent with types of analyses qualified clinical data registries envision conducting using the CMS data. As a result, we are modifying the regulations to allow qualified clinical data registries to serve as quasi-qualified entities, provided the qualified clinical data registry agrees to meet all the requirements in this subpart with the exception of the requirement at Sec. 401.707(d) that the organization submit information about the claims data it possesses from other sources. In addition, for the purposes of qualified clinical data registries acting as quasi qualified entities under the qualified entity program requirements, we define combined data as, at a minimum, a set of CMS claims data provided under subpart G combined with clinical data or a subset of clinical data. Since the language at section 105(b) of MACRA does not reference section 1874(e)(4)(d) of the Act, which provides parameters for the definition of combined data for the purposes of the qualified entity program, we do not believe these requirements for combined data apply to qualified clinical data registries serving as quasi qualified entities.
We believe that the requirements of the qualified entity program, which was created to allow for provider performance reporting, also create an appropriate framework for qualified clinical data registries to conduct analyses to support quality improvement and patient safety. In addition, we believe that the new parameters of the qualified entity program, discussed in detail above, would allow qualified clinical data registries to work directly with providers and suppliers on issues related to quality improvement and patient safety. Qualified clinical data registries could also elect to become qualified entities and work with providers and suppliers in accordance with applicable laws to develop new quality measures in the context of nonpublic analyses that could then be used across the healthcare system to measure provider and supplier performance.
Comment: Several commenters suggested that CMS make the Social Security Death Master File available to qualified clinical data registries to allow for enhanced accuracy of patient outcomes information.
Response: We recognize that death information is a key aspect of analyses of patient outcomes, but CMS does not have the authority to disclose the Social Security Death Master File to qualified clinical data registries. However, CMS has date of death information for Medicare patients and we include this date of death information on the data files that are shared with qualified entities and those that would be shared with qualified clinical data registries.
-
-
Other Comments
We received several additional suggestions for improvements to the program regarding topics that were not specifically discussed in the preamble to the proposed rule.
Comment: Several commenters raised issues related to qualified entity application process. One commenter suggested CMS make the application process and costs for becoming a qualified entity more transparent. A few commenters suggested that CMS offer qualified entities better technical assistance on the security certification step of the approval process. One commenter recommended that CMS streamline the application process for applicants that already have certifications or accreditations that demonstrate a high level of security.
Response: We thank commenters for their feedback on the qualified entity application process. We believe the issues raised by commenters on this topic are outside the scope of this final rule. However, we are always looking for ways to improve the program and will take these comments into consideration.
Comment: Some commenters addressed general program requirements of the qualified entity program. One commenter suggested that qualified entities that focus on certain clinical conditions should not have to meet the same threshold for amount of other claims data. Another commenter recommended that CMS allow state-level public reporting in the qualified entity program. A few commenters stated that CMS should provide qualified entities with access to timelier Medicare data. One commenter stated that some of the existing provisions in the CMS DUA conflict with requirements in HIPAA, specifically the requirement to destroy data if and when an organization leaves the program.
Response: We have not established a threshold for the minimum amount of other claims an organization needs to become a qualified entity. Instead, we ask applicants to explain how the data they do have for use in the qualified entity program will be adequate to address concerns about sample size and reliability that have been expressed by stakeholders regarding the calculation of performance measures from a single payer source. Each application is evaluated on its collective merit, including the amount of claims data from other sources, and its explanation of why that data in combination with the requested Medicare data is adequate for the stated purposes of the program.
We also do not prohibit qualified entities from publicly reporting their findings regarding provider and supplier performance at the state-level. Qualified entities are allowed to report on providers and suppliers at any level for which the measures can be used, provided the statutory and regulatory requirements are met, including that no patient information is disclosed.
We currently make data available to qualified entities on quarterly basis. We believe the timeliness of this data strikes the right balance between data completeness and data timeliness.
Finally, we do not believe that requirements in the CMS DUA are inconsistent with HIPAA. We use a very similar DUA to share data with HIPAA-
Page 44472
covered providers and suppliers who are participating in Innovation Center models. We do recognize that some qualified entities may have trouble incorporating the Medicare data into their data systems because they may not be able to ensure the destruction of this data once it is linked with other data maintained by the qualified entity. However, we believe that requiring destruction of the data if a qualified entity leaves the program is important for ensuring the privacy and security of CMS data.
Comment: One commenter suggested that CMS clarify how FOIA may or may not apply to data or reports submitted by qualified entities. Another commenter recommended that CMS clarify how the changes to the qualified entity program intersect with other statutory and regulatory requirements.
Response: As we noted above, any information that we collect from qualified entities is subject to FOIA. However, any time we receive a request for information under FOIA, we always evaluate whether the information is subject to one of the FOIA exemptions, including Exemption 4, which protects commercial or financial information that is privileged and confidential.
We are not able to address the breadth and scope of laws with which the qualified entity program requirements may intersect in this rule. Such analyses require case-by-case assessment of the facts at hand, and depending on jurisdiction, may vary based on which state laws apply. Entities should consult with their legal counsel to advise them on what laws apply to them, and to what effect.
Comment: One commenter suggested that the release of Part D data to qualified entities should be tailored to protect the viability of the Part D program.
Response: We are committed to ensuring that commercially sensitive information from the Part D program is protected. As we stated in the previous final rule on the qualified entity program, published on December 7, 2011, we are aware of the concerns related to, and restrictions governing the release of certain Part D drug cost information. Due to these concerns, we only release the Total Drug Cost element to qualified entities. We do not release the four subcomponents of drug cost: Ingredient cost, dispensing fee, vaccine administration fee, and total amount attributable to sales tax.
Comment: One commenter stated that the rule does not address how states that have all payer claims databases (APCDs) can access Medicare data.
Response: We do not believe that state APCDs are prohibited from becoming qualified entities. However, state APCDs with an interest in conducting research rather than provider performance reporting can also request data from CMS via the research request process. Organizations interested in accessing CMS data for research should visit www.resdac.org.
Comment: One commenter stated that CMS should adopt a new version of the claims form that includes a field for unique device identifiers.
Response: This comment is outside the scope of the qualified entity rule. That said, CMS uses claims that comply with the HIPAA standard transactions regulations (45 CFR part 162). Any changes to forms would be achieved through rulemaking under those provisions.
Comment: Several commenters stated that they had concerns about the security of the Medicare data.
Response: We are committed to ensuring the privacy and security of all data and we believe the existing and new program requirements create an appropriate framework for maintaining the security of data disclosed to qualified entities. Organizations applying to become qualified entities currently go through a rigorous security review during the application process. In addition, we monitor qualified entities closely to ensure that they continue to maintain appropriate data security standards once approved. As discussed above, we have also established data security protections that qualified entities must meet when sharing data with authorized users, including a requirement that the authorized user report any breaches to the qualified entity (and that the qualified entity report the breaches to CMS).
Comment: Several commenters recommended that CMS clarify that organizations already approved as qualified entities would be allowed to begin using the Medicare data for the uses described in this final rule, regardless of whether the qualified entity has generated a public report.
Response: We would like to clarify that once these regulations become effective, organizations approved as qualified entities will be allowed to use the Medicare data to create non-public analyses and provide or sell such analyses to authorized users, as well provide or sell combined data, or provide Medicare claims data alone at no cost, to certain authorized users. However, we believe that public reporting is a very important aspect of participation in the qualified entity program and would like to remind qualified entities about the provision at Sec. 401.709(d) which requires qualified entities to produce public reports at least annually.
-
Provisions of the Final Rule
For the most part, this final rule incorporates the provisions of the proposed rule. Those provisions of this final rule that differ from the proposed rule are as follows:
We modified the definition of authorized user at Sec. 401.703(j) to: Include a federal agency, change the term ``state agency'' to ``state entity'' to provide additional clarity, and include any contractors (or business associates) that need analyses or data to carry out work on behalf of authorized user third parties.
We modified the definition of hospital association at Sec. 401.703(n) to include organizations or associations at the local level.
At Sec. 401.703(r), we modified the definition of patient to extend the window for a face-to-face or telehealth appointment to at least once in the past 24 months.
We added activities that qualify as treatment under 45 CFR 164.501 to permitted uses of the data subject to the QE DUA.
We modified the terms of the QE DUA to permit authorized users to re-disclose data subject to the QE DUA as a covered entity would be permitted to disclose PHI for treatment activities, as allowed under 45 CFR 164.506(c)(2).
At Sec. 401.716(b)(2), we modified the requirements to clarify that a qualified entity may not provide or sell a non-public analysis to an issuer for a geographic area where the issuer does not provide coverage and, thus, does not have any covered lives to contribute to the analyses.
At Sec. 401.716(b)(4)(iii), we allowed for the disclosure of non-public analyses that individually identify a provider or supplier if every provider or supplier identified in the analysis has notified the qualified entity that analyses may be disclosed to that authorized user without prior review by the provider or supplier.
We added a procedural step to the review and error correction process for non-public analyses at Sec. 401.717(f) to include confidential notification of the provider or supplier.
We added a new provision at Sec. 401.722(a) to allow a qualified clinical data registry that agrees to meet the requirements in this subpart, with the exception of the requirement to submit information on the claims data from other sources it possesses, to request
Page 44473
access to Medicare data as a quasi-qualified entity.
-
Collection of Information Requirements
Under the Paperwork Reduction Act of 1995, we are required to provide 30-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicit comment on the following issues:
The need for the information collection and its usefulness in carrying out the proper functions of our agency.
The accuracy of our estimate of the information collection burden.
The quality, utility, and clarity of the information to be collected.
Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.
We solicited public comment on each of these issues for the following sections of this document that contain information collection requirements (ICRs).
Proposed Sec. 401.718(c) and Sec. 401.716(b)(2)(ii) require a qualified entity to enter into a QE DUA with an authorized user prior to providing or selling data or selling a non-public analyses that contains individually identifiable beneficiary information. Proposed Sec. 401.713(d) requires specific provisions in the QE DUA. Proposed Sec. 401.716(c) requires a qualified entity to enter into a non-public analyses agreement with the authorized user as a pre-condition to providing or selling de-identified analyses. We estimate that it will take each qualified entity a total of 40 hours to develop the QE DUA and non-public analyses agreement. Of the 40 hours, we estimate it will take a professional/technical services employee with an hourly labor cost of $75.08 a total of 20 hours to develop both the QE DUA and non-
public analyses agreement and estimate that it will require a total of 20 hours of legal review at an hourly labor cost of $77.16 for both the QE DUA and non-public analyses agreement. We also estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement with an authorized user by a professional/technical service employee with an hourly labor cost of $75.08. While there may be two different staff positions that perform these duties (one that is responsible for processing the QE DUAs and/or non-public analyses agreement and one that is responsible for maintaining the QE DUA and/or non-public analyses agreement), we believe that both positions would fall under the professional/technical services employee labor category with an hourly labor cost of $75.08. There are currently 15 qualified entities; however we estimate that number will increase to 20 if these proposals are finalized. This number includes qualified entities and ``quasi qualified entities'' (meaning qualified clinical data registries that are approved under Sec. 401.722(a) as described in this preamble), which we hereinafter collectively refer to as ``qualified entity''. This would mean that to develop each QE DUA and non-public analysis agreement, the burden cost per qualified entity would be $3,045 with a total estimated burden for all 15 qualified entities of $45,675. This does not include the two hours to process and maintain each QE DUA.
As discussed in the regulatory impact analysis below, we estimate that each qualified entity would need to process and maintain 70 QE DUAs or non-public analyses agreements as some authorized users may receive both datasets and a non-public analyses and would only need to execute one QE DUA. We estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement. This would mean the burden cost per qualified entity to process and maintain 70 QE DUAs or non-public analyses agreements would be $10,511 with a total estimated burden for all 15 qualified entities of $157, 668. While we anticipate that the requirement to create a QE DUA and/or non-public analyses agreement will only be incurred once by a qualified entity, we believe that the requirement to process and maintain the QE DUAs and/or non-public analyses will be an ongoing cost.
These regulations would also require a qualified entity to submit additional information as part of its annual report to CMS. A qualified entity is currently required to submit an annual report to CMS under Sec. 401.719(b). Proposed Sec. 401.719(b)(3) and (4) provide for additional reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. The burden associated with this requirement is the time and effort necessary to gather, process, and submit the required information to CMS. As noted above, there are currently 15 qualified entities; however we estimate that number will increase to 20 if these proposals are finalized. Some qualified entities may not want to bear the risk of the potential assessments and have been able to accomplish their program goals under other CMS data sharing programs, therefore some qualified entities may not elect to provide or sell analyses and/or data to authorized users. As a result, we estimate that 15 qualified entities will choose to provide or sell analyses and/or data to authorized users, and therefore, would be required to comply with these additional reporting requirements within the first three years of the program. We further estimate that it would take each qualified entity 50 hours to gather, process, and submit the required information. We estimate that it will take each qualified entity 34 hours to gather the required information, 15 hours to process the information, and 1 hour to submit the information to CMS. We believe a professional or technical services employee of the qualified entity with an hourly labor cost of $75.08 will fulfill these additional annual report requirements. We estimate that 15 qualified entities will need to comply with this requirement and that the total estimated burden associated with this requirement is $56,310. We requested comment on the type of employee and the number of hours that will be needed to fulfill these additional annual reporting requirements.
As a reminder, the final rule for the qualified entity program, published December 7, 2011, included information about the burden associated with the provisions in that rule. Specifically, Sec. Sec. 401.705 through 401.709 provide the application and reapplication requirements for qualified entities. The burden associated with these requirements is currently approved under OMB control number 0938-1144 with an expiration date of May 31, 2018. This package accounts for 35 responses. Section 401.713(a) states that as part of the application review and approval process, a qualified entity would be required to execute a DUA with CMS, that among other things, reaffirms the statutory bar on the use of Medicare data for purposes other than those referenced above. The burden associated with executing this DUA is currently approved under OMB control number 0938-0734 with an expiration date of December 31, 2017. This package accounts for 9,240 responses (this package covers all CMS DUAs, not only DUAs under the qualified entity program). We currently have 15 qualified entities and estimate it will increase to 20 so we have not surpassed the previously approved numbers.
We based the hourly labor costs on those reported by the Bureau of Labor
Page 44474
Statistics (BLS) at http://data.bls.gov/pdq/querytool.jsp?survey=ce for this labor category. We used the annual rate for 2014 and added 100 percent for overhead and fringe benefit costs.
Table 1--Collection of Information
--------------------------------------------------------------------------------------------------------------------------------------------------------
Hourly
Number of Burden per Total labor cost Total labor
Regulation section(s) OMB Control No. Number of responses response annual of cost of Total cost
respondents per (hours) burden reporting reporting ($)
respondent (hours) ($) * ($)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Sec. 401.718, Sec. 401.716, and 0938 New............... 15 1 20 300 75.08 22,524 22,524
Sec. 401.713 (DUA and non-public
analyses agreement Development).
Sec. 401.718 and Sec. 401.716 0938 New............... 15 1 20 300 77.16 23,148 23,148
(Legal Review).
Sec. 401.718 and Sec. 401.716 0938 New............... 15 70 2 2,100 75.08 157,668 157,668
(Processing and Maintenance).
Sec. 401.719(b)................... 0938 New............... 15 1 50 750 75.08 56,310 56,310
------------------------------------------------------------------------------------------
Total........................... ....................... 15 73 ........... 3,450 ........... ........... 259,650
--------------------------------------------------------------------------------------------------------------------------------------------------------
* The values listed are based on 100 percent overhead and fringe benefit calculations.
Note: There are no capital/maintenance costs associated with the information collection requirements contained in this rule; therefore, we have removed
the associated column from Table 1.
If you comment on these information collection and recordkeeping requirements, please submit your comments to the Office of Information and Regulatory Affairs, Office of Management and Budget,
Attention: CMS Desk Officer, CMS-5061-F
Fax: (202) 395-6974; or
Email: OIRA_submission@omb.eop.gov
-
Regulatory Impact Statement
In accordance with the provisions of Executive Order 12866, this regulation was reviewed by the Office of Management and Budget.
-
Response to Comments
We received a few comments on the anticipated effects of these modifications to the qualified entity program.
Comment: One commenter suggested that it would take each qualified entity an estimated 60 hours to develop and review the QE DUA and non-
public analyses agreement. Of those 60 hours, 30 hours would be to develop the QE DUA and non-public analyses agreement and 30 would be needed for legal review. In addition, the commenter estimated that it would take each qualified entity 3 hours to process and maintain each QE DUA and non-public analyses agreement.
Response: In the proposed rule, we estimated that it would take each qualified entity 40 hours to develop and review the QE DUA and non-public analyses agreement. Of those 40 hours, 20 hours would be needed to develop the QE DUA and non-public analyses agreement and 20 hours would be needed for legal review. We also estimated that it would take 2 hours to process and maintain each QE DUA and non-public analyses agreement. We recognize that some qualified entities may spend more hours than other qualified entities to develop, process, and maintain QE DUAs and non-public analyses agreements. For example, some qualified entities may spend 60 hours to develop the QE DUA and non-
public analyses agreement and other qualified entities will spend 30 hours. However, we believe that 40 hours to develop the QE DUA and the non-public analyses agreement and 2 hours to process each QE DUA and the non-public analyses agreement is a reasonable average.
Comment: We received a few comments about the impact on providers and suppliers. One commenter suggested that CMS reconsider the assumption that all 1500 small rural hospitals would not be impacted by this rule and that the 3 hour average estimate for providers and suppliers to review non-public analyses appears too low. Another commenter suggested that CMS monitor provider burden as expanded data access unfolds and the number of qualified entities and authorized users begin to grow.
Response: We appreciate commenters' concerns about the potential impact on providers and suppliers. As discussed above in section II.A.4, we made procedural changes to the proposed review and corrections process for non-public analyses in order to reduce burden to both qualified entities and providers and suppliers. As a first step of the review and correction process, the qualified entity would be required to notify the provider or supplier that analyses that individually identify the provider or supplier are going to be released to an authorized user and allow the provider or supplier to opt-in to the review and corrections process at Sec. 401.717(a) through (e). This notification should include a short summary of the analyses, the process for the provider or supplier to request the analyses, and the date on which the qualified entity will release the analyses to the authorized user. This date should be at least 65 calendar days from the date the provider or supplier is notified of the analyses.
Given these procedural changes to the review and corrections process in the context of the non-public analyses, we believe that the 3 hours average estimate for providers and suppliers to review non-
public analyses is a sufficient estimate of provider and supplier burden. This average takes into account the range of potential cases given the new review and corrections process. In some cases, for example, notification may be sufficient to meet the needs of providers or suppliers. In other cases, however, where the analyses are similar to previous analyses or use data the provider or supplier has already corrected, the provider or supplier may choose not to review the analyses. In addition, as discussed in the proposed rule, even if a provider or supplier requests the non-public analyses, there will be variability in the amount of time providers or suppliers will need for the review and corrections process.
As discussed in the proposed rule, we do not anticipate this rule will have a significant impact on the operations of a substantial number of small rural hospitals because we anticipate that most qualified entities will focus their performance evaluation efforts on metropolitan areas where the majority of health services are provided. In addition, given the limited number of health services provided in rural regions, we anticipate that any analyses that included rural regions would not individually identify the providers or suppliers, but rather focus on regional or state metrics. As suggested by a commenter, we will monitor provider burden as the number of qualified
Page 44475
entities grows and more non-public analyses are provided to authorized users.
-
Overall Impact
We have examined the impacts of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), the Regulatory Flexibility Act (RFA) (September 19, 1980, 96), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), and the Congressional Review Act (5 U.S.C. 804(2)).
Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). For the reasons discussed below, we estimate that the total impact of this final rule will be less than $58 million and therefore, it will not reach the threshold for economically significant effects and is not considered a major rule.
The RFA requires agencies to analyze options for regulatory relief of small businesses, if a rule has a significant impact on a substantial number of small entities. For purposes of the RFA, we estimate that most hospitals and most other providers are small entities as that term is used in the RFA (including small businesses, nonprofit organizations, and small governmental jurisdictions). However, since the total estimated impact of this rule is less than $100 million, and the total estimated impact will be spread over 82,500 providers and suppliers (who are the subject of reports), no one entity will face significant impact. Of the 82,500 providers, we estimate that 78,605 will be physician offices that have average annual receipts of $11 million and 4,125 will be hospitals that have average annual receipts of $38.5 million. As discussed below, the estimated cost per provider is $8,426 (see table 5 below) and the estimated cost per hospital is $6,523 (see table 5 below). For both types of entities, these costs will be a very small percentage of overall receipts. Thus, we are not preparing an analysis of options for regulatory relief of small businesses because we have determined that this rule will not have a significant economic impact on a substantial number of small entities.
For section 105(a) of MACRA, we estimate that two types of entities may be affected by the additional program opportunities: Qualified entities that choose to provide or sell non-public analyses or data to authorized users; and providers and suppliers who are identified in the non-public analyses create by qualified entities and provided or sold to authorized users.
We anticipate that most providers and suppliers that may be identified in qualified entities' non-public analyses will be hospitals and physicians. Many hospitals and most other healthcare providers and suppliers are small entities, either by being nonprofit organizations or by meeting the Small Business Administration definition of a small business (having revenues of less than $38.5 million in any 1 year) (for details see the Small Business Administration's Web site at https://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf (refer to the 620000 series). For purposes of the RFA, physicians are considered small businesses if they generate revenues of $11 million or less based on Small Business Administration size standards. Approximately 95 percent of physicians are considered to be small entities.
The analysis and discussion provided in this section and elsewhere in this final rule complies with the RFA requirements. Because we acknowledge that many of the affected entities are small entities, the analysis discussed throughout the preamble of this final rule constitutes our regulatory flexibility analysis for the remaining provisions and addresses comments received on these issues.
In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis, if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. Any such regulatory impact analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a metropolitan statistical area and has fewer than 100 beds. We do not believe this final rule has impact on significant operations of a substantial number of small rural hospitals because we anticipate that most qualified entities will focus their performance evaluation efforts on metropolitan areas where the majority of health services are provided. As a result, this rule will not have a significant impact on small rural hospitals. Therefore, the Secretary has determined that this final rule will not have a significant impact on the operations of a substantial number of small rural hospitals.
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2016, that threshold is approximately $146 million. This final rule will not impose spending costs on state, local, or tribal governments in the aggregate, or by the private sector, of $146 million or more. Specifically, as explained below we anticipate the total impact of this rule on all parties to be approximately $58 million.
Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. We have examined this final rule in accordance with Executive Order 13132 and have determined that this regulation will not have any substantial direct effect on State or local governments, preempt States, or otherwise have a Federalism implication.
-
Anticipated Effects
-
Impact on Qualified Entities
Because section 105(a) of MACRA allows qualified entities to use the data in new ways to provide or sell non-public analyses or data to authorized users, there is little quantitative information to inform our estimates on the number of analyses and datasets that the qualified entity costs may provide or sell or on the costs associated with the creation of the non-public analyses or datasets. Therefore, we look to the estimates from the original qualified entity rules to estimate the number of hours that it may take to create non-public analyses, to process provider/supplier appeals and revisions, and to complete annual reports. We also looked to the Centers for Medicare and Medicaid's cost of providing data to qualified entities since qualified entities' data fees are equal to the government's cost to make the data available.
There are currently 15 qualified entities and these qualified entities all are in different stages of the qualified entity program. For example, some qualified entities have released public reports and some qualified entities are
Page 44476
still completing the security requirements in order to receive Medicare data. Given the requirements in the different phases and the current status of the qualified entities, we estimate that 11 qualified entities will be able to provide or sell analyses and/or data to authorized users within the first year of the program, and therefore, will be incurring extra costs. As discussed above, we believe the total number of qualified entities will ultimately grow to 20 in subsequent years, with 15 entities providing or selling analyses and/or data to authorized users. In estimating qualified entity impacts, we used hourly labor costs in several labor categories reported by the Bureau of Labor Statistics (BLS) at http://data.bls.gov/pdq/querytool.jsp?survey=ce. We used the annual rates for 2014 and added 100 percent for overhead and fringe benefit costs. These rates are displayed in Table 2.
Table 2--Labor Rates for Qualified Entity Impact Estimates
----------------------------------------------------------------------------------------------------------------
2014 Hourly
wage rate OH and fringe Total hourly
(BLS) (100%) costs
----------------------------------------------------------------------------------------------------------------
Professional and technical services............................. $37.54 $37.54 $75.08
Legal review.................................................... 38.58 38.58 77.16
Custom computer programming..................................... 43.05 43.05 86.10
Data processing and hosting..................................... 34.02 34.02 68.04
Other information services...................................... 39.72 39.72 79.44
----------------------------------------------------------------------------------------------------------------
We estimate that within the first year that 11 qualified entities will provide or sell on average 55 non-public analyses or provide or sell 35 datasets. We do not believe the number of datasets and non-
public analyses per qualified entity will change in future years of the program.
In the original proposed rule for the qualified entity program (76 FR 33566), we estimated that each qualified entities' activities to analyze the Medicare claims data, calculate performance measures and produce public provider performance reports will require 5,500 hours of effort per qualified entity. We anticipate under this final rule that implements section 105(a) of MACRA that qualified entities will base the non-public analyses on their public performance reports. Therefore, the creation of the non-public analyses will require much less effort and only require a fraction of the time it takes to produce the public reports. We estimate that a qualified entity's activities for each non-
public analysis to analyze the Medicare claims data, calculate performance measures, and produce the report will require 320 hours, between five and six percent of the time to produce the public reports. We anticipate that half of this time will be spent on data analysis, measure calculation, and report creation and the other half on data processing.
We anticipate that within the first year of the program a qualified entity will, on average, provide one-year datasets containing all data types for a cohort of 750,000 to 1.75 million beneficiaries to 35 authorized users. We estimate that it will require 226 hours to create each dataset that will be provided to an authorized user. We looked to the Centers for Medicare and Medicaid Centers' data costs and time to estimate a qualified entity's costs and time to create datasets. While the majority of the time will be devoted to computer processing, we anticipate about 100 hours will be spent on computer programming, particularly if the qualified entity is de-identiying the data.
We further estimate that, on average, each qualified entity will expend 7,500 hours of effort processing providers' and suppliers' appeals of their performance reports and producing revised reports, including legal review of the appeals and revised reports. These estimates assume that, as discussed below in the section on provider and supplier impacts, on average 25 percent of providers and suppliers will appeal their results from a qualified entity. Responding to these appeals in an appropriate manner will require a significant investment of time on the part of qualified entities. This equates to an average of four hours per appeal for each qualified entity. These estimates are similar to those in the Qualified Entities final rule. We assume that the complexity of appeals will vary greatly, and as such, the time required to address them will also vary greatly. Many appeals may be able to be dealt with in an hour or less while some appeals may require multiple meetings between the qualified entity and the affected provider or supplier. On average, however, we believe that this is a reasonable estimate of the burden of the appeals process on qualified entities. We discuss the burden of the appeals process on providers and suppliers below.
We estimate that each qualified entity will spend 40 hours creating a non-public analyses agreement template and a QE DUA. We also estimate that it will take a qualified entity 2 hours to process a QE DUA or non-public analyses agreement.
Finally, we estimate that each qualified entity will spend 50 hours on the additional annual reporting requirements.
Qualified entities will be required to notify CMS of inappropriate disclosures or use of beneficiary identifiable data pursuant to the requirements in the CMS DUA. We believe that the report generated in response to an inappropriate disclosure or use of beneficiary identifiable data will be generated as a matter of course by the qualified entities and therefore, will not require significant additional effort. Based on the assumptions we have described, we estimate the total impact on qualified entities for the first year of the program to be a cost of $27,925,198.
Page 44477
Table 3--Impact on Qualified Entities for the First Year of the Program
--------------------------------------------------------------------------------------------------------------------------------------------------------
Hours
-----------------------------------------------------
Data Labor Cost per Number of Number of Total cost
Activity Professional Computer processsing hourly cost authorized authorized qualified impact
and Legal programming and user users entities
technical hosting
--------------------------------------------------------------------------------------------------------------------------------------------------------
Impact on Qualified Entities
--------------------------------------------------------------------------------------------------------------------------------------------------------
Dissemination of Data
--------------------------------------------------------------------------------------------------------------------------------------------------------
Data processing & hosting......... ............ ........... ........... 126 $68.04 $8,573 35 11 $3,300,620
Computer programming.............. ............ ........... 100 ........... 86.10 8,610 35 11 3,314,850
---------------------------------------------------------------------------------------------------------------------
Total: Dissemination of Data.. ............ ........... ........... ........... ........... ........... ........... ........... $6,615,470
--------------------------------------------------------------------------------------------------------------------------------------------------------
Non-Public Analyses
--------------------------------------------------------------------------------------------------------------------------------------------------------
Data analysis/measure calculation/ ............ ........... 160 ........... 86.10 13,776 55 11 8,334,480
report preparation...............
Data Processing and hosting....... ............ ........... ........... 160 68.04 10,886 55 11 6,586,272
---------------------------------------------------------------------------------------------------------------------
Total: Non-public Analyses.... ............ ........... ........... ........... ........... ........... ........... ........... 14,920,752
--------------------------------------------------------------------------------------------------------------------------------------------------------
Processing of Provider Appeals and Report Revision
--------------------------------------------------------------------------------------------------------------------------------------------------------
Qualified entity processing of 5,500 ........... ........... ........... 75.08 412,940 ........... 11 4,542,340
provider appeals and report
revision.........................
Qualified entity legal analysis of ............ 2,000 ........... ........... 77.16 154,320 ........... 11 1,697,520
provider appeals and report
revisions........................
---------------------------------------------------------------------------------------------------------------------
Total: Qualified entity ............ ........... ........... ........... ........... ........... ........... ........... 6,239,860
processing of provider
appeals and report revision..
--------------------------------------------------------------------------------------------------------------------------------------------------------
QE DUA and Non-Public Analyses Agreements
--------------------------------------------------------------------------------------------------------------------------------------------------------
QE DUA and Non-public analyses:
Development of the QE DUA and 20 ........... ........... ........... 75.08 1502 ........... 11 16,518
non-public analyses agreement
Legal review of the QE DUA and ............ 20 ........... ........... 77.16 1,543 ........... 11 16,975
non-public analyses agreement
Processing QE DUA and non- 2 ........... ........... ........... 75.08 150 70 11 115,623
public analyses agreement....
---------------------------------------------------------------------------------------------------------------------
Total QE DUA and non- ............ ........... ........... ........... ........... ........... ........... ........... 149,116
public analyses
agreements...............
Additional Annual Report 50 ........... ........... ........... 75.08 3,754 ........... 11 41,294
Requirements.................
---------------------------------------------------------------------------------------------------------------------
Total qualified entity ............ ........... ........... ........... ........... ........... ........... ........... 27,966,492
Impacts..................
--------------------------------------------------------------------------------------------------------------------------------------------------------
-
Impact on Healthcare Providers and Suppliers
We note that numerous healthcare payers, community quality collaboratives, States, and other organizations are producing performance measures for healthcare providers and suppliers using data from other sources, and that providers and suppliers are already receiving performance reports from these sources. We anticipate that the review of non-public analyses will merely be added to those existing efforts to improve the statistical validity of the measure findings.
Table 4 reflects the hourly labor rates used in our estimate of the impacts of the first year of section 105(a) of MACRA on healthcare providers and suppliers.
Table 4--Labor Rates for Provider and Supplier Impact Estimates
----------------------------------------------------------------------------------------------------------------
Overhead and
2014 Hourly fringe Total hourly
wage rate benefits costs
(BLS) (100%)
----------------------------------------------------------------------------------------------------------------
Physicians' offices............................................. $38.27 $38.27 $76.54
Hospitals....................................................... 29.65 29.65 59.30
----------------------------------------------------------------------------------------------------------------
Page 44478
We anticipate that the impacts on providers and suppliers consist of costs to review the performance reports generated by qualified entities and, if they choose, appeal the performance calculations. We believe, on average, each qualified entity will produce non-public analyses that in total include information on 7,500 health providers and suppliers. This is based on estimates in the qualified entity final rule, but also include an increase of 50 percent because we believe that more providers and suppliers will be included in the non-public analyses. We anticipate that the largest proportion of providers and suppliers will be physicians because they comprise the largest group of providers and suppliers, and are a primary focus of many recent performance evaluation efforts. We also believe that many providers and suppliers will be the recipients of the non-public analyses in order to support their own performance improvement activities, and therefore, there will be no requirement for a correction or appeals process. As discussed above, there is no requirement for a corrections or appeals process where the analysis only individually identifies the (singular) provider or supplier who is being provided or sold the analysis. Based on our review of information from existing programs, we assume that 95 percent of the recipients of performance reports (that is, an average of 7,125 per qualified entity) will be physicians, and 5 percent (that is, an average of 375 per qualified entity) will be hospitals and other suppliers. Providers and suppliers receive these reports with no obligation to review them, but we assume that most will do so to verify that their calculated performance measures reflect their actual patients and health events. Because these non-public analyses will be based on the same underlying data as the public performance reports, we estimate that it will take less time for providers or suppliers to review these analyses and generate an appeal. We estimate that, on average, each provider or supplier will devote three hours to reviewing these analyses. We also estimate that 25 percent of the providers and suppliers will decide to appeal their performance calculations, and that preparing the appeal will involve an average of seven hours of effort on the part of a provider or supplier. As with our assumptions regarding the level of effort required by qualified entities in operating the appeals process, we believe that this average covers a range of provider efforts from providers who will need just one or two hours to clarify any questions or concerns regarding their performance reports to providers who will devote significant time and resources to the appeals process.
Using the hourly costs displayed in Table 4, the impacts on providers and suppliers are calculated below in Table 5. Based on the assumptions we have described, we estimate the total impact on providers for the first year of the program to be a cost of $29,690,386.
As stated above in Table 3, we estimate the total impact on qualified entities to be a cost of $27,966,492. Therefore, the total impact on qualified entities and on providers and suppliers for the first year of the program is estimated to be $57,656,878.
Table 5--Impact on Providers and Suppliers for the First Year of the Program
--------------------------------------------------------------------------------------------------------------------------------------------------------
Hours per provider Number of
-------------------------- providers Number of
Activity Labor Cost per per qualified Total cost
Physician Hospitals hourly cost provider qualified entities impact
offices entity
--------------------------------------------------------------------------------------------------------------------------------------------------------
Impact on Providers and Suppliers
--------------------------------------------------------------------------------------------------------------------------------------------------------
Physician office review of performance reports............... 3 ........... $76.54 $230 7,125 11 $18,026,250
Hospital review of performance reports....................... ........... 3 59.30 178 375 11 734,250
Physician office preparing and submitting appeal requests to 7 ........... 76.54 536 1,781 11 10,500,776
qualified entities..........................................
Hospital preparing and submitting appeal requests to ........... 7 59.30 415 94 11 429,110
qualified entities..........................................
------------------------------------------------------------------------------------------
Total Impact on Providers and Suppliers.................. ........... ........... ........... ........... ........... ........... 29,690,386
--------------------------------------------------------------------------------------------------------------------------------------------------------
-
-
Alternatives Considered
The statutory provisions added by section 105(a) of MACRA are detailed and prescriptive about the permissible uses of the data under the Qualified Entity Program. We believe there are limited approaches that will ensure statutory compliance. We considered less prescriptive requirements on the provisions that will need to be included in the agreements between qualified entities and authorized users that received or purchased analyses or data. For example, we could have required less strenuous data privacy and security protections such as not setting a minimum standard for protection of beneficiary identifiable data or non-public analyses. In addition, we could have reduced additional restrictions on re-disclosure or permitted data or analyses to be re-disclosed to additional downstream users. While these approaches might reduce costs for qualified entities, we did not adopt such an approach because of the importance of protecting beneficiary data. We believe if we do not require qualified entities to provide sufficient evidence of data privacy and security protection capabilities, there will be increased risks related to the protection of beneficiary identifiable data.
-
Conclusion
As explained above, we estimate the total impact for the first year of the program on qualified entities and providers to be a cost of $57,656,878. While we anticipate the number of qualified entities to increase slightly, we do not anticipate significant growth in the qualified entity program given the qualified entity program requirements, as well as other existing programs that allow entities to obtain Medicare data. Based on these estimates, we conclude this final rule does not reach the threshold for economically significant effects and thus is not considered a major rule.
In accordance with the provisions of Executive Order 12866, this regulation was reviewed by the Office of Management and Budget.
Page 44479
List of Subjects in 42 CFR Part 401
Claims, Freedom of information, Health facilities, Medicare, Privacy.
For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services amends 42 CFR part 401 as set forth below:
PART 401--GENERAL ADMINISTRATIVE REQUIREMENTS
0
-
The authority citation for part 401 is revised to read as follows:
Authority: Secs. 1102, 1871, and 1874(e) of the Social Security Act (42 U.S.C. 1302, 1395hh, and 1395w-5) and sec. 105, Pub. L. 114-
10, 129 Stat. 87.
0
-
Section 401.703 is amended by adding paragraphs (j) through (u) to read as follows:
Sec. 401.703 Definitions.
* * * * *
(j) Authorized user is a third party and its contractors (including, where applicable, business associates as that term is defined at 45 CFR 160.103) that need analyses or data covered by this section to carry out work on behalf of that third party (meaning not the qualified entity or the qualified entity's contractors) to whom/
which the qualified entity provides or sells data as permitted under this subpart. Authorized user third parties are limited to the following entities:
(1) A provider.
(2) A supplier.
(3) A medical society.
(4) A hospital association.
(5) An employer.
(6) A health insurance issuer.
(7) A healthcare provider and/or supplier association.
(8) A state entity.
(9) A federal agency.
(k) Employer has the same meaning as the term ``employer'' as defined in section 3(5) of the Employee Retirement Insurance Security Act of 1974.
(l) Health insurance issuer has the same meaning as the term ``health insurance issuer'' as defined in section 2791 of the Public Health Service Act.
(m) Medical society means a nonprofit organization or association that provides unified representation and advocacy for physicians at the national or state level and whose membership is comprised of a majority of physicians.
(n) Hospital association means a nonprofit organization or association that provides unified representation and advocacy for hospitals or health systems at a national, state, or local level and whose membership is comprised of a majority of hospitals and health systems.
(o) Healthcare Provider and/or Supplier Association means a nonprofit organization or association that provides unified representation and advocacy for providers and suppliers at the national or state level and whose membership is comprised of a majority of suppliers or providers.
(p) State Entity means any office, department, division, bureau, board, commission, agency, institution, or committee within the executive branch of a state government.
(q) Combined data means, at a minimum, a set of CMS claims data provided under this subpart combined with claims data, or a subset of claims data from at least one of the other claims data sources described in Sec. 401.707(d).
(r) Patient means an individual who has visited the provider or supplier for a face-to-face or telehealth appointment at least once in the past 24 months.
(s) Marketing means the same as the term ``marketing'' at 45 CFR 164.501 without the exception to the bar for ``consent'' based marketing.
(t) Violation means a failure to comply with a requirement of a CMS DUA (CMS data use agreement) or QE DUA (qualified entity data use agreement).
(u) Required by law means the same as the phrase ``required by law'' at 45 CFR 164.103.
0
-
Section 401.713 is amended by revising paragraph (a) and adding paragraph (d) to read as follows:
Sec. 401.713 Ensuring the privacy and security of data.
(a) Data use agreement between CMS and a qualified entity. A qualified entity must comply with the data requirements in its data use agreement with CMS (hereinafter the CMS DUA). Contractors (including, where applicable, business associates) of qualified entities that are anticipated to have access to the Medicare claims data or beneficiary identifiable data in the context of this program are also required to execute and comply with the CMS DUA. The CMS DUA will require the qualified entity to maintain privacy and security protocols throughout the duration of the agreement with CMS, and will ban the use or disclosure of Medicare data or any derivative data for purposes other than those set out in this subpart. The CMS DUA will also prohibit the use of unsecured telecommunications to transmit such data, and will specify the circumstances under which such data must be stored and may be transmitted.
* * * * *
(d) Data use agreement between a qualified entity and an authorized user. In addition to meeting the other requirements of this subpart, and as a pre-condition of selling or disclosing any combined data or any Medicare claims data (or any beneficiary-identifiable derivative data of either kind) and as a pre-condition of selling or disclosing non-public analyses that include individually identifiable beneficiary data, the qualified entity must enter a DUA (hereinafter the QE DUA) with the authorized user. Among other things laid out in this subpart, such QE DUA must contractually bind the authorized user (including any contractors or business associates described in the definition of authorized user) to the following:
(1)(i) The authorized user may be permitted to use such data and non-public analyses in a manner that a HIPAA Covered Entity could do under the following provisions:
(A) Activities falling under paragraph (1) of the definition of ``health care operations'' under 45 CFR 164.501: Quality improvement activities, including care coordination activities and efforts to track and manage medical costs; patient-safety activities; population-based activities such as those aimed at improving patient safety, quality of care, or population health, including the development of new models of care, the development of means to expand coverage and improve access to healthcare, the development of means of reducing healthcare disparities, and the development or improvement of methods of payment or coverage policies.
(B) Activities falling under paragraph (2) of the definition of ``health care operations'' under 45 CFR 164.501: Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities.
(C) Activities that qualify as ``fraud and abuse detection or compliance activities'' under 45 CFR 164.506(c)(4)(ii).
(D) Activities that qualify as ``treatment'' under 45 CFR 164.501.
(ii) All other uses and disclosures of such data and/or such non-
public analyses must be forbidden except to the extent a disclosure qualifies as a ``required by law'' disclosure as defined at 45 CFR 164.103.
Page 44480
(2) The authorized user is prohibited from using or disclosing the data or non-public analyses for marketing purposes as defined at Sec. 401.703(s).
(3) The authorized user is required to ensure adequate privacy and security protection for such data and non-public analyses. At a minimum, regardless of whether the authorized user is a HIPAA covered entity, such protections of beneficiary identifiable data must be at least as protective as what is required of covered entities and their business associates regarding protected health information (PHI) under the HIPAA Privacy and Security Rules. In all cases, these requirements must be imposed for the life of such beneficiary identifiable data or non-public analyses and/or any derivative data, that is until all copies of such data or non-public analyses are returned or destroyed. Such duties must be written in such a manner as to survive termination of the QE DUA, whether for cause or not.
(4) Except as provided for in paragraph (d)(5) of this section, the authorized user must be prohibited from re-disclosing or making public any such data or non-public analyses.
(5)(i) At the qualified entity's discretion, it may permit an authorized user that is a provider as defined in Sec. 401.703(b) or a supplier as defined in Sec. 401.703(c), to re-disclose such data and non-public analyses as a covered entity will be permitted to disclose PHI under 45 CFR 164.506(c)(4)(i), under 45 CFR 164.506(c)(2), or under 45 CFR 164.502(e)(1).
(ii) All other uses and disclosures of such data and/or such non-
public analyses is forbidden except to the extent a disclosure qualifies as a ``required by law'' disclosure.
(6) Authorized users who/that receive the beneficiary de-identified combined data or Medicare data as contemplated under Sec. 401.718 are contractually prohibited from linking the beneficiary de-identified data to any other identifiable source of information, and must be contractually barred from attempting any other means of re-identifying any individual whose data is included in such data.
(7) The QE DUA must bind authorized user(s) to notifying the qualified entity of any violations of the QE DUA, and it must require the full cooperation of the authorized user in the qualified entity's efforts to mitigate any harm that may result from such violations, or to comply with the breach provisions governing qualified entities under this subpart.
0
-
Section 401.716 is added to read as follows:
Sec. 401.716 Non-public analyses.
(a) General. So long as it meets the other requirements of this subpart, and subject to the limits in paragraphs (b) and (c) of this section, the qualified entity may use the combined data to create non-
public analyses in addition to performance measures and provide or sell these non-public analyses to authorized users (including any contractors or business associates described in the definition of authorized user).
(b) Limitations on a qualified entity. In addition to meeting the other requirements of this subpart, a qualified entity must comply with the following limitations as a pre-condition of dissemination or selling non-public analyses to an authorized user:
(1) A qualified entity may only provide or sell a non-public analysis to a health insurance issuer as defined in Sec. 401.703(l), after the health insurance issuer or a business associate of that health insurance issuer has provided the qualified entity with claims data that represents a majority of the health insurance issuer's covered lives, using one of the four methods of calculating covered lives established at 26 CFR 46.4375-1(c)(2), for the time period and geographic region covered by the issuer-requested non-public analyses. A qualified entity may not provide or sell a non-public analysis to a health insurance issuer if the issuer does not have any covered lives in the geographic region covered by the issuer-requested non-public analysis.
(2) Analyses that contain information that individually identifies one or more beneficiaries may only be disclosed to a provider or supplier (as defined at Sec. 401.703(b) and (c)) when both of the following conditions are met:
(i) The analyses only contain identifiable information on beneficiaries with whom the provider or supplier have a patient relationship as defined at Sec. 401.703(r).
(ii) A QE DUA as defined at Sec. 401.713(d) is executed between the qualified entity and the provider or supplier prior to making any individually identifiable beneficiary information available to the provider or supplier.
(3) Except as specified under paragraph (b)(2) of this section, all analyses must be limited to beneficiary de-identified data. Regardless of the HIPAA covered entity or business associate status of the qualified entity and/or the authorized user, de-identification must be determined based on the standards for HIPAA covered entities found at 45 CFR 164.514(b).
(4) Analyses that contain information that individually identifies a provider or supplier (regardless of the level of the provider or supplier, that is, individual clinician, group of clinicians, or integrated delivery system) may not be disclosed unless one of the following three conditions apply:
(i) The analysis only individually identifies the provider or supplier that is being supplied the analysis.
(ii) Every provider or supplier individually identified in the analysis has been afforded the opportunity to appeal or correct errors using the process at Sec. 401.717(f).
(iii) Every provider or supplier individually identified in the analysis has notified the qualified entity, in writing, that analyses can be disclosed to the authorized user without first going through the appeal and error correction process at Sec. 401.717(f).
(c) Non-public analyses agreement between a qualified entity and an authorized user for beneficiary de-identified non-public analyses disclosures. In addition to the other requirements of this subpart, a qualified entity must enter a contractually binding non-public analyses agreement with the authorized user (including any contractors or business associates described in the definition of authorized user) as a pre-condition to providing or selling de-identified analyses. Such non-public analyses agreement must contain the following provisions:
(1) The authorized user may not use the analyses or derivative data for the following purposes:
(i) Marketing, as defined at Sec. 401.703(s).
(ii) Harming or seeking to harm patients or other individuals both within and outside the healthcare system regardless of whether their data are included in the analyses.
(iii) Effectuating or seeking opportunities to effectuate fraud and/or abuse in the healthcare system.
(2) If the authorized user is an employer as defined in Sec. 401.703(k), the authorized user may only use the analyses or derivative data for purposes of providing health insurance to employees, retirees, or dependents of employees or retirees of that employer.
(3)(i) At the qualified entity's discretion, it may permit an authorized user that is a provider as defined in Sec. 401.703(b) or a supplier as defined in Sec. 401.703(c), to re-disclose the de-
identified analyses or derivative data, as a covered entity will be permitted under 45 CFR 164.506(c)(4)(i), or under 45 CFR 164.502(e)(1).
(ii) All other uses and disclosures of such data and/or such non-
public
Page 44481
analyses is forbidden except to the extent a disclosure qualifies as a ``required by law'' disclosure.
(4) If the authorized user is not a provider or supplier, the authorized user may not re-disclose or make public any non-public analyses or derivative data except as required by law.
(5) The authorized user may not link the de-identified analyses to any other identifiable source of information and may not in any other way attempt to identify any individual whose de-identified data is included in the analyses.
(6) The authorized user must notify the qualified entity of any DUA violations, and it must fully cooperate with the qualified entity's efforts to mitigate any harm that may result from such violations.
0
-
Section 401.717 is amended by adding paragraph (f) to read as follows:
Sec. 401.717 Provider and supplier requests for error correction.
* * * * *
(f) A qualified entity must comply with the following requirements before disclosing non-public analyses, as defined at Sec. 401.716, which contain information that individually identifies a provider or supplier:
(1) A qualified entity must confidentially notify a provider or supplier that non-public analyses that individually identify the provider or supplier are going to be released to an authorized user at least 65 calendar days before disclosing the analyses. This confidential notification must include a short summary of the analyses (including the measures calculated), the process for the provider or supplier to request the analyses, the authorized users receiving the analyses, and the date on which the qualified entity will release the analyses to the authorized user.
(2) A qualified entity must allow providers and suppliers the opportunity to opt-in to the review and correction process as defined in paragraphs (a) through (e) of this section, anytime during the 65 calendar days. If a provider or supplier chooses to opt-in to the review and correction process more than 5 days into the notification period, the time for the review and correction process is shortened from 60 days to the number of days between the provider or supplier opt-in date and the release date specified in the confidential notification.
0
-
Section 401.718 is added to read as follows:
Sec. 401.718 Dissemination of data.
(a) General. Subject to the other requirements in this subpart, the requirements in paragraphs (b) and (c) of this section and any other applicable laws or contractual agreements, a qualified entity may provide or sell combined data or provide Medicare data at no cost to authorized users defined at Sec. 401.703(b), (c), (m), and (n).
(b) Data--(1) De-identification. Except as specified in paragraph (b)(2) of this section, any data provided or sold by a qualified entity to an authorized user must be limited to beneficiary de-identified data. De-identification must be determined based on the de-
identification standards for HIPAA covered entities found at 45 CFR 164.514(b).
(2) Exception. If such disclosure will be consistent with all applicable laws, data that individually identifies a beneficiary may only be disclosed to a provider or supplier (as defined at Sec. 401.703(b) and (c)) with whom the identifiable individuals in such data have a current patient relationship as defined at Sec. 401.703(r).
(c) Data use agreement between a qualified entity and an authorized user. A qualified entity must contractually require an authorized user to comply with the requirements in Sec. 401.713(d) prior to providing or selling data to an authorized user under Sec. 401.718.
0
-
Section 401.719 is amended by adding paragraphs (b)(3) and (4) and (d)(5) to read as follows:
Sec. 401.719 Monitoring and sanctioning of qualified entities.
* * * * *
(b) * * *
(3) Non-public analyses provided or sold to authorized users under this subpart, including the following information:
(i) A summary of the analyses provided or sold, including--
(A) The number of analyses.
(B) The number of purchasers of such analyses.
(C) The types of authorized users that purchased analyses.
(D) The total amount of fees received for such analyses.
(E) QE DUA or non-public analyses agreement violations.
(ii) A description of the topics and purposes of such analyses.
(iii) The number of analyses disclosed with unresolved requests for error correction.
(4) Data provided or sold to authorized users under this subpart, including the following information:
(i) The entities who received data.
(ii) The basis under which each entity received such data.
(iii) The total amount of fees received for providing, selling, or sharing the data.
(iv) QE DUA violations.
* * * * *
(d) * * *
(5) In the case of a violation, as defined at Sec. 401.703(t), of the CMS DUA or the QE DUA, CMS will impose an assessment on a qualified entity in accordance with the following:
(i) Amount of assessment. CMS will calculate the amount of the assessment of up to $100 per individual entitled to, or enrolled for, benefits under part A of title XVIII of the Social Security Act or enrolled for benefits under Part B of such title whose data was implicated in the violation based on the following:
(A) Basic factors. In determining the amount per impacted individual, CMS takes into account the following:
(1) The nature and the extent of the violation.
(2) The nature and the extent of the harm or potential harm resulting from the violation.
(3) The degree of culpability and the history of prior violations.
(B) Criteria to be considered. In establishing the basic factors, CMS considers the following circumstances:
(1) Aggravating circumstances. Aggravating circumstances include the following:
(i) There were several types of violations occurring over a lengthy period of time.
(ii) There were many of these violations or the nature and circumstances indicate a pattern of violations.
(iii) The nature of the violation had the potential or actually resulted in harm to beneficiaries.
(2) Mitigating circumstances. Mitigating circumstances include the following:
(i) All of the violations subject to the imposition of an assessment were few in number, of the same type, and occurring within a short period of time.
(ii) The violation was the result of an unintentional and unrecognized error and the qualified entity took corrective steps immediately after discovering the error.
(C) Effects of aggravating or mitigating circumstances. In determining the amount of the assessment to be imposed under paragraph (d)(5)(i)(A) of this section:
(1) If there are substantial or several mitigating circumstance, the aggregate amount of the assessment is set at an amount sufficiently below the maximum permitted by paragraph (d)(5)(i)(A) of this section to reflect the mitigating circumstances.
Page 44482
(2) If there are substantial or several aggravating circumstances, the aggregate amount of the assessment is set at an amount at or sufficiently close to the maximum permitted by paragraph (d)(5)(i)(A) of this section to reflect the aggravating circumstances.
(D) The standards set for the qualified entity in this paragraph are binding, except to the extent that--
(1) The amount imposed is not less than the approximate amount required to fully compensate the United States, or any State, for its damages and costs, tangible and intangible, including but not limited to the costs attributable to the investigation, prosecution, and administrative review of the case.
(2) Nothing in this section limits the authority of CMS to settle any issue or case as provided by part 1005 of this title or to compromise any assessment as provided by paragraph (d)(5)(ii)(E) of this section.
(ii) Notice of determination. CMS must propose an assessment in accordance with this paragraph (d)(5), by notifying the qualified entity by certified mail, return receipt requested. Such notice must include the following information:
(A) The assessment amount.
(B) The statutory and regulatory bases for the assessment.
(C) A description of the violations upon which the assessment was proposed.
(D) Any mitigating or aggravating circumstances that CMS considered when it calculated the amount of the proposed assessment.
(E) Information concerning response to the notice, including:
(1) A specific statement of the respondent's right to a hearing in accordance with procedures established at Section 1128A of the Act and implemented in 42 CFR part 1005.
(2) A statement that failure to respond within 60 days renders the proposed determination final and permits the imposition of the proposed assessment.
(3) A statement that the debt may be collected through an administrative offset.
(4) In the case of a respondent that has an agreement under section 1866 of the Act, notice that imposition of an exclusion may result in termination of the provider's agreement in accordance with section 1866(b)(2)(C) of the Act.
(F) The means by which the qualified entity may pay the amount if they do not intend to request a hearing.
(iii) Failure to request a hearing. If the qualified entity does not request a hearing within 60 days of receipt of the notice of proposed determination, any assessment becomes final and CMS may impose the proposed assessment.
(A) CMS notifies the qualified entity, by certified mail with return receipt requested, of any assessment that has been imposed and of the means by which the qualified entity may satisfy the judgment.
(B) The qualified entity has no right to appeal an assessment for which the qualified entity has not requested a hearing.
(iv) When an assessment is collectible. An assessment becomes collectible after the earliest of the following:
(A) Sixty (60) days after the qualified entity receives CMS's notice of proposed determination under paragraph (d)(5)(ii) of this section, if the qualified entity has not requested a hearing.
(B) Immediately after the qualified entity abandons or waives its appeal right at any administrative level.
(C) Thirty (30) days after the qualified entity receives the ALJ's decision imposing an assessment under Sec. 1005.20(d) of this title, if the qualified entity has not requested a review before the DAB.
(D) Sixty (60) days after the qualified entity receives the DAB's decision imposing an assessment if the qualified entity has not requested a stay of the decision under Sec. 1005.22(b) of this title.
(v) Collection of an assessment. Once a determination by HHS has become final, CMS is responsible for the collection of any assessment.
(A) The General Counsel may compromise an assessment imposed under this part, after consulting with CMS or OIG, and the Federal government may recover the assessment in a civil action brought in the United States district court for the district where the claim was presented or where the qualified entity resides.
(B) The United States or a state agency may deduct the amount of an assessment when finally determined, or the amount agreed upon in compromise, from any sum then or later owing the qualified entity.
(C) Matters that were raised or that could have been raised in a hearing before an ALJ or in an appeal under section 1128A(e) of the Act may not be raised as a defense in a civil action by the United States to collect an assessment.
0
-
Section 401.721 is amended by adding paragraph (a)(7) to read as follows:
Sec. 401.721 Terminating an agreement with a qualified entity.
(a) * * *
(7) Fails to ensure authorized users comply with their QE DUAs or analysis use agreements.
* * * * *
0
-
Section 401.722 is added to read as follows:
Sec. 401.722 Qualified clinical data registries.
(a) A qualified clinical data registry that agrees to meet all the requirements in this subpart, with the exception of Sec. 401.707(d), may request access to Medicare data as a quasi qualified entity in accordance with such qualified entity program requirements.
(b) Notwithstanding Sec. 401.703(q) (generally defining combined data), for purposes of qualified clinical data registries acting as quasi qualified entities under the qualified entity program requirements, combined data means, at a minimum, a set of CMS claims data provided under this subpart combined with clinical data or a subset of clinical data.
Dated: June 22, 2016.
Andrew M. Slavitt,
Acting Administrator, Centers for Medicare & Medicaid Services.
Dated: June 28, 2016.
Sylvia M. Burwell,
Secretary, Department of Health and Human Services.
FR Doc. 2016-15708 Filed 7-1-16; 11:15 am
BILLING CODE 4120-01-P
-
-
