Quality Improvement Organization Manual 
Chapter 8  Infrastructure Operations Support and 
Data Management 
 
 
Table of Contents 
(Rev. 22, 12-02-15) 
 
Transmittals for Chapter 8 
 
8000 - Introduction 
8005  Infrastructure Operations and Support Manual 
8010  Infrastructure Information Technology Administrator Manual 
8015  Database Systems Administrator Guide 
8020  Security Handbook 
8025  System for Confidentiality of QIO Program Data 
8030  IT Performance Standards  8000  Introduction 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
This chapter describes the minimum requirements and responsibilities of the Quality 
Improvement Organizations (QIOs) in using information technology (IT) infrastructure 
and managing electronic data for the QIO Program. QIOs must use the applications, 
tools, and systems furnished by CMS that are accessible through a secure Intranet site.  
This chapter describes the supporting documents that govern the policies and procedures 
for the CMS-furnished secure network environment that are the basis of the IT 
performance standards on which the QIO will be reviewed.  The QIOs must meet or 
exceed all IT performance standards listed in Section 8030 IT Performance Standards. 
CMS furnishes the IT manuals described in this chapter to QIOs and other authorized 
CMS contractors that support the QIO Program.  CMS routinely updates and revises the 
documents as changes in the IT environment and program operations occur. 
 
8005  Infrastructure Operations and Support Manual 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
The Infrastructure Operations and Support Manual provides policy and procedure 
information to the QIO user community regarding IT infrastructure.  This manual 
delineates roles and responsibilities for QIO users, administrators, CMS personnel, and 
CMS contractor personnel working within the QIO IT infrastructure environment.  The 
expectation is that the community will use the manual as a reference for questions 
regarding IT policy issues and practices.  This manual will also assist QIOs, Help Desk 
personnel, CMS, and CMS supporting contractors in interacting and communicating in 
order to support the IT infrastructure.  The manual is available through the CMS-
furnished secure Intranet site (secure log in is required). 
 
8010  Infrastructure Information Technology Administrator Manual 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
The Infrastructure Information Technology Administrator Manual is a companion 
document to the Infrastructure Operations and Support Manual discussed in Section 
8005.  This manual gives a general description of the work environment for QIO network 
administrators, as well as specific detailed procedures that network administrators need 
to perform.  The manual is available through the CMS-furnished secure Intranet site 
(secure log in is required). 
 
8015  Database Systems Administrator Guide 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
The Database Systems Administrator Guide provides QIO database administrators with 
instructions, guidelines, and samples needed to perform the basic day-to-day operations 
on QIO databases.  Users may reproduce this document as necessary.  The guide is 
available through the CMS-furnished secure Intranet site (secure log in is required). 
  8020  Security Handbook 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
The System Security Policy establishes a security management process for QIO users 
that complies with the Computer Security Act of 1987 (P.L. 100-235), the Health 
Insurance Portability and Accountability Act of 1996 (P.L. 104-191), Appendix III to the 
Office of Management and Budget (OMB), Circular No. A-130 (50 FR 52730; December 
24, 1985), Federal Information Security Management Act (FISMA), Title III of the E-
Government Act of 2002 (Public Law 107-347, 44 U.S.C. Chapter 36), the Department of 
Health and Human Services and CMS information security policy, programmatic 
direction, standards, guidelines, and handbooks.  Use of the CMS-furnished IT 
infrastructure environment as well as access to and use of QIO Program data is subject 
to CMS information security and privacy policy and program oversight provided by the 
CMS Office of the Chief Information Office and the Chief Information Security Officer.  
All personnel working within the CMS-furnished IT infrastructure and data environment 
must abide by the policies and procedures set forth in the Security Policy, read the 
Statement of Acceptance, and sign the Policy Acceptance Log attesting to the acceptance 
of these policies once a year. 
 
The Security Policy provides guidelines pertaining to the appropriate use of the Internet 
and email resources for transmission of QIO Program data.  The System Security Policy is 
available for download on the main page of the QIO Program Internet site (secure log in 
is not required). 
 
8025  System for Confidentiality of QIO Program Data 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
QIOs are required to protect the confidentiality of data in accordance with section 1160 
of the Social Security Act (42 USC 1320c-9) and regulations at 42 CFR 480.  Chapter10 
of the QIO Manual provides guidance on requirements for protecting the confidentiality 
of QIO Program data.  The transmission and storage of such data must be consistent and 
compliant with the requirements to protect the data.  CMS provides a secure file 
exchange application to safeguard the electronic transmission or exchange of sensitive or 
confidential data, including but not limited to data containing personally identifiable 
information (PII) and protected health information (PHI).  The purpose of the secure file 
exchange application is to provide increased efficiencies in information exchange and to 
support secure communication and healthcare quality data between two or more 
organizations, including: hospitals, physicians offices, nursing homes, QIOs, End-Stage 
Renal Disease (ESRD) facilities, ESRD Networks, performance measurement systems, 
data vendors, and the Clinical Data Abstraction Center (CDAC).  The secure file 
exchange application that is available through the secure Intranet site is the CMS 
approved method to exchange files containing PII or PHI data, and to protect other 
confidential information.  Information retrieved and/or transmitted within this system is 
protected from external access. 
  In addition, users shall not connect or install external systems, applications, or devices to 
the secure IT environment without prior approval from CMS.  CMS approval may be 
granted through the Engineering Review Board (ERB) request process.  Failure to obtain 
CMS approval for connections to external IT systems, applications, or devices may result 
in disconnection from the secure IT infrastructure environment without warning. 
 
8030  IT Performance Standards 
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15) 
 
The QIO Program IT performance standards are based on five system administrative 
performance areas that must be met or exceeded during the course of the contract. 
 
The performance standards areas are as follows: 
 
  Contingency Planning  This category concerns preparation for disaster or the 
loss of information.  It includes contingency planning, archiving, backup, and 
storage operations to restore operability of IT system resources and QIO Program 
information 
 
  System Maintenance  This category concerns maintenance of IT system 
resources.  It includes proper monthly maintenance and application of routine and 
emergency updates, upgrades, and patches in compliance with CMS hardware, 
software, security standards, and operational practices 
 
  User and Administrator Training  This category concerns user and system 
administrator compliance with training on contractor and CMS-furnished IT 
systems, networks, applications, devices, standards, procedures, and security 
 
  Security  This category concerns safeguards for the security of QIO Program 
information collection, storage, use, sharing, retention, and destruction, security 
for IT access controls and operational practices, and the protection of privacy 
data and confidential information 
 
  Inventory  This category concerns maintenance of inventories for contract 
acquired and CMS-furnished property 
  Transmittals Issued for this Chapter 
 
Rev #  Issue Date  Subject  Impl Date  CR# 
R22QIO  12/02/2015  QIO Manual Chapter 8  Infrastructure  12/02/2015 N/A 
Operations Support and Data Management 
R14QIO  04/07/2006  Revisions to Chapter 8, "Data Management"  04/07/2006 N/A 
for consistency with 8th Statement of Work 
contract cycle 
R1QIO  05/23/2003  Initial Issuance of Chapters 2, 8, 13 and 15  N/A  N/A 
Back to top of chapter