GAO-01-205

Report to Congressional Committees

United States General Accounting Office

GAO

January 2001 MEDICARE HOME

HEALTH CARE

OASIS Data Use,

Cost, and Privacy

Implications
Page i GAO-01-205 Home Health Data Requirements

Letter 1

Appendix I Methodology for Survey of Home Health Agencies 22

Appendix II Development and Testing of the OASIS Data Set 27

Appendix III OASIS Data Privacy Protections 30

Appendix IV Comments From HCFA 34

Tables

Table 1: Percentage of All Agencies, Sample Agencies, and Survey

Respondents with Selected Characteristics 24

Table 2: Medians, Means, and 95-Percent Confidence Intervals for

Survey Results 25

Abbreviations

BBRA Medicare, Medicaid, and SCHIP Balanced Refinement Act

of 1999

CHSPR Center for Health Services and Policy Research

HCFA Health Care Financing Administration

HHA home health agencies

IPS interim payment system

MDCN Medicare Data Communications Network

OASIS Outcome and Assessment Information Set

PPS prospective payment system

VNA Visiting Nurse Association

Contents
Page 1 GAO-01-205 Home Health Data Requirements

January 30, 2001

Congressional Committees

Although millions of Medicare beneficiaries receive home health care each

year, little is known about the specific services provided during home

health visits or their impact on patient outcomes. In addition, from 1990 to

1997 both the number of beneficiaries and the amount of services they

received increased sharply, raising concerns about Medicare expenditures

and the appropriateness of services being provided. As early as 1987, the

Congress began to address the need for greater oversight of home health

care by requiring that the Health Care Financing Administration (HCFA)

implement an outcome-based quality monitoring system. Ten years later,

to address the mounting cost of home health care, the Congress directed

HCFA to develop a new payment system for home health care that would

shift from cost-based reimbursement to a prospective payment system

(PPS).

As part of fulfilling both of these provisions, HCFA has begun requiring

home health agencies (HHA) to collect and report data on all their patients

using a standardized assessment instrument known as the Outcome and

Assessment Information Set (OASIS). However, HHAs have expressed

concern that the OASIS data collection requirement is overly burdensome.

Also, some patients’ rights advocates contend that the confidentiality of

individual patient information may not be adequately protected. HCFA

officials respond that the OASIS data are essential to accurately monitor

home health care quality and to implement plans to achieve quality

improvements, as well as to determine payments for individual patients.

Furthermore, the agency has said that the cost and privacy implications of

using OASIS are minimal.

The Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of

1999 (BBRA) mandated that we examine the cost and privacy concerns

associated with OASIS data collection requirements.1

 We addressed the

following key questions in our review:

1. How does HCFA plan to use the OASIS-generated information?

 1

Consolidated Appropriations Act for FY 2000, P.L. 106-113, app. F, title III, section 301(b)

(Nov. 29, 1999).

United States General Accounting Office

Washington, DC 20548
Page 2 GAO-01-205 Home Health Data Requirements

2. Since the implementation of OASIS, have patient assessments changed

and have additional costs been incurred by HHAs?

3. What has HCFA done to safeguard the confidentiality of OASIS data?

To answer these questions, we interviewed industry representatives, home

health experts, HCFA and state officials, and state surveyors in several

states. We also obtained perspectives on OASIS implementation by visiting

several HHAs in urban and rural areas and interviewing agencies with

reputations for high-quality practices. Because reliable data are not

available, we could not obtain a comprehensive accounting of all possible

costs associated with complying with the OASIS mandate. Rather, we

conducted a survey of a representative sample of 50 HHAs regarding

ongoing OASIS-related costs beyond those that the HHAs previously

incurred for patient assessments. We asked specifically for the agencies’

estimates of changes in staff time for data collection and reporting and for

training new staff. (For more detail on our survey methodology, see app.

I.) Finally, we reviewed relevant documents, including HCFA regulations

and manuals. Our review was conducted from May 2000 to November 2000

in accordance with generally accepted government auditing standards.

OASIS has two primary functions: monitoring the quality of home health

care and adjusting Medicare payments to account for differences in patient

characteristics. HCFA plans to use OASIS data to help target its oversight

of the quality of HHA activities and to provide standardized information on

quality to HHAs. HHAs, in turn, can use OASIS information to determine

the extent to which their patients experience positive outcomes and

compare their performance levels with national benchmarks. OASIS data

are also used by HCFA to calculate Medicare payments for each episode of

care and to refine the adjustment factors needed to determine relative

payment rates under the home health PPS.

The use of OASIS has made the documentation of home health patient

information more consistent, while adding time for assessment-related

activities. The incorporation of the OASIS instrument into all initial patient

assessments has meant that HHAs generally collect data in a more

consistent fashion than in the past. Previously, HHAs were required to

perform an initial comprehensive assessment and may have documented

their findings in a variety of ways, often with narrative summaries. In

contrast, OASIS involves a set of standardized questions to be completed

by choosing from a list of responses that can substitute for most of the

narrative. Based on a survey of clinicians in several HHAs, HCFA

Results in Brief
Page 3 GAO-01-205 Home Health Data Requirements

estimated that using OASIS would not add to the time it took HHAs to

conduct their start-of-care assessments. However, the respondents in a

random sample of HHAs we surveyed estimated an increase in time for

patient assessments following the implementation of the OASIS mandate.

These HHAs also reported additional costs associated with verifying and

transmitting the data to HCFA, as well as with training new hires to collect

OASIS data.

In response to privacy concerns raised before the implementation of the

OASIS requirements, HCFA announced several safeguards aimed at

protecting the confidentiality of patient information. At admission, HHAs

must provide all patients with a written notice of their privacy rights. Also,

although HHAs must collect information on patients’ financial condition,

HCFA eliminated the requirement for HHAs to transmit such information

to data repositories. Additionally, it announced that for nonMedicare/Medicaid patients, several OASIS patient identifiers will be

masked. As we previously reported, however, routine monitoring of users

of confidential information, such as OASIS data, would improve the

privacy protections afforded home health care patients.

In commenting on a draft of this report, HCFA agreed with our findings

and conclusions.

Medicare’s home health care benefit enables beneficiaries with post-acutecare needs and chronic conditions to receive certain skilled nursing,

therapy, and aide services in their homes rather than in other settings. To

qualify for Medicare’s home health benefit, a beneficiary must be confined

to his or her residence (“homebound”), must be under a physician’s care,2

and must require physical therapy, speech therapy, continued

occupational therapy, or skilled nursing on an intermittent basis.

Beneficiaries are not liable for any coinsurance or deductibles for these

services and may receive care as long as they meet the eligibility criteria.

Until recently, Medicare has reimbursed HHAs for their costs, subject to

limits, for services they provide to the program’s beneficiaries.

Between 1990 and 1997, Medicare expenditures for home health services

went up three times faster than spending for the program as a whole. This

 2

The services must be furnished under a plan of care established and periodically reviewed

by a physician.

Background
Page 4 GAO-01-205 Home Health Data Requirements

rapid rise has been attributed to many factors, including a liberalization of

home health benefit criteria and a lack of sufficient controls to protect the

program from potential billing practice abuse. In combination, these

factors created conditions where providers could deliver more services

than necessary to beneficiaries in order to increase their revenues. In

response to these problems, the Balanced Budget Act of 1997 required, by

October 1, 1999, the implementation of a new home health PPS, and, until

then, the implementation of an interim payment system (IPS) to slow

spending growth.3

 The IPS incorporated tighter per-visit cost limits than

previously in place and subjected each agency to an annual Medicare

revenue cap (based on a per-beneficiary amount and the number of

patients it served).

The home health PPS, which replaced the IPS on October 1, 2000, is

designed to align payments with anticipated service needs. HHAs now

receive a single payment for each 60-day episode of care for a Medicare

beneficiary. The base payment is adjusted to reflect patient characteristics

that have been shown to affect service use. For fiscal year 2001, the base

amount per episode has been set at $2,115, but payment rates range from

about $1,100 to nearly $6,000, depending on the functional and clinical

severity of each beneficiary. Each episode payment is adjusted for

differences in labor costs across geographic areas, and certain extremely

high cost episodes receive outlier payments.4

 Once the payment is

determined, the amount of service provided to that beneficiary does not

change the amount of reimbursement.

In order to qualify as providers eligible to bill Medicare for home health

services, HHAs have to comply with the program’s conditions of

participation. These standards seek to ensure that HHAs have the

appropriate staff, policies, procedures, medical records, and operational

practices to deliver acceptable quality care. HCFA contracts with state

survey and certification agencies to oversee the adherence of HHAs in

 3

P.L. 105-33, title IV, chapter I, 111 Stat. 251, 466. The Omnibus Consolidated and

Emergency Supplemental Appropriations Act of 1999, P.L. 105-277, delayed the

implementation of the home health PPS until Oct. 1, 2000.

4

Payments also are adjusted if the episode of care is interrupted, such as when a

beneficiary elects to transfer to another HHA, when a beneficiary is discharged because

treatment goals are attained but then returns to the same HHA, or when the beneficiary

experiences a significant change in condition. Episodes with extremely low service use

(four or fewer visits) receive a low-utilization payment adjustment based on per-visit costs.
Page 5 GAO-01-205 Home Health Data Requirements

their states with these standards.5 However, our previous work has shown

that state agencies’ reviews of HHAs to be certified to provide Medicare

services did little to ensure quality care and that there was almost no

oversight of the actual care provided to home health patients.6

In the Omnibus Budget Reconciliation Act of 1987, Congress mandated

that HCFA develop a standardized patient assessment instrument to assist

in monitoring HHAs. HCFA used information from years of research and

demonstrations in the development of OASIS, which contains 79

demographic, clinical, and functional data items for assessing patients and

measuring outcomes. (The process of developing and testing OASIS is

described in app. II.) In January 1999, HCFA issued final rules requiring

HHAs to conduct comprehensive patient assessments incorporating the

OASIS data elements and electronically report the OASIS data collected.

The requirement covers most private pay as well as Medicare and

Medicaid patients.7

 Collection of the information relies on both

observation of patient function by a nurse or therapist and patient

responses. For each patient receiving skilled care, the data are generally

collected at the initial visit, every 60 days thereafter for the duration of

treatment, and at discharge.8

 HHAs report the data to their state survey

and certification agencies, which then report the data to a central

repository maintained by HCFA.

Concerns regarding the privacy of OASIS information were expressed

shortly after HCFA issued its rules on OASIS data collection and reporting

in January 1999. Some privacy advocates expressed concerns that some

questions were irrelevant or delved too deeply into the personal lives of

 5

These are the state agencies that HCFA contracts with to certify and approve all HHAs

that participate in the Medicare program as meeting certain federal requirements and

conditions of participation.

6

Medicare Home Health Agencies: Certification Process Ineffective in Excluding Problem

Agencies (GAO/HEHS-98-29, Dec. 16, 1997) and Medicare Home Health Benefit:

Congressional and HCFA Actions Begin to Address Chronic Oversight Weaknesses

(GAO/T-HEHS-98-117, Mar. 19, 1998).

7

As with other Medicare-certified providers, conditions of participation apply to all patients

they serve. Medicare-certified HHAs are required to collect and report OASIS data for all

patients regardless of payor source unless they are (1) under the age of 18, (2) receiving

maternity services, (3) receiving housekeeping or chore services only, or (4) receiving

personal care services only.

8

Most OASIS data elements apply to each of these stages; others relate specifically to one

or two of these stages.
Page 6 GAO-01-205 Home Health Data Requirements

patients. They cited the mental status questions, including one that asks

about depressive feelings reported or observed in the patient, as well as a

question regarding financial factors that could limit the patient’s ability to

meet his or her own basic health needs.

HHAs, advocacy groups, and others suggested that patient identifiers be

removed from OASIS data before transmission to HCFA or that HCFA not

require OASIS data to be reported on non-Medicare/Medicaid patients.9 In

the spring of 1999, these concerns led HCFA to postpone the effective date

of OASIS reporting until it reviewed the privacy issues involved. The

outcome of this review was HCFA’s decision to leave the OASIS

assessment instrument intact. HHAs would continue to be required to

collect all OASIS information on all patients, because HCFA believes it is

valuable to HHAs in patient assessments and care planning. However,

HCFA put limits on the transmission of certain OASIS data elements, and

it has postponed data reporting, but not collecting, for nonMedicare/Medicaid patients.

Under the new conditions of participation effective July 1999, HHAs

participating in Medicare must (1) incorporate OASIS data items into the

assessment process for Medicare, Medicaid, and private pay patients, (2)

electronically transmit accurate OASIS data to the state survey agency or

HCFA OASIS contractor,10 and (3) maintain the privacy of their OASIS

data.

The OASIS data instrument serves both to monitor home health care

quality and to adjust payments to account for differences in patient

characteristics. To enhance quality of care, HCFA plans to use the OASIS

data to guide its oversight of HHA activities, to provide each HHA with

information about its patients’ outcomes compared to those of other

HHAs, and to guide the selection of HHAs by patients and physicians.

OASIS data affect payments to HHAs both in determining the payment

 9

HHAs must collect OASIS data on both public and private pay patients because section

1891(b) of the Social Security Act requires that the Secretary of Health and Human Services

ensure that the conditions of participation and other requirements are adequate to protect

all individuals under the care of the HHA.

10These are the state agencies designated by HCFA to receive the OASIS data and maintain

them in a database. The state OASIS contractor can be the same as the state survey and

certification agency.

OASIS Designed for

Quality Monitoring

and Payment

Purposes
Page 7 GAO-01-205 Home Health Data Requirements

made for current patients and in providing data to analyze possible

modifications to the current payment system.

HCFA proposes to use OASIS data to promote higher-quality home health

care by (1) guiding the oversight of HHAs performed by state survey and

certification agencies, (2) giving HHAs comparative information that they

can use to improve their own practices, and (3) providing information to

patients and referring physicians that will help them to choose HHAs that

achieve better outcomes. Although none of these approaches has been

implemented, planning for the first two is under way, and the third is to be

developed in the future.

HCFA intends to use OASIS data to strengthen its oversight of state survey

agency monitoring of HHA outcomes. It requires the state survey agencies

to examine the OASIS data in preparation for surveys of individual HHAs.11

Survey agencies have begun checking the OASIS data submitted by HHAs

in their states to ensure HHA compliance with OASIS reporting

requirements. HCFA expects the survey staff to review OASIS-based

reports to identify indicators of potential concern (such as high rates of

infection) that would warrant further investigation and ongoing

monitoring.

When HCFA mandated that HHAs begin collecting OASIS data, it

emphasized that this requirement was intended to set in motion a process

of continuous quality improvement within each HHA. Based on the OASIS

data collected, each HHA will be granted electronic access to customized

reports displaying its own patients’ outcomes in relation to those of home

health patients nationally, with statistical adjustments to take account of

the clinical characteristics of the patients served by that agency. The HHA

will be able to examine outcomes for specific types of care (such as

wound care and pain management) and types of patients (such as those

with diabetes or those recovering from surgery). This way, each agency

will be able to assess its performance over time and compare it to national

benchmarks. These reports will enable HHAs to identify areas where their

performance was suboptimal and thus provide a basis for planning

initiatives to improve patient health status.

 11State surveyors review the clinical and administrative records maintained by the HHAs.

They assess the services that the HHA has provided and cite deficiencies in areas where the

HHA has failed to comply with federal regulations.

OASIS Data Intended to

Improve Medicare

Oversight and HHA

Practices
Page 8 GAO-01-205 Home Health Data Requirements

The first reports, based on the OASIS data that have been collected

nationwide since July 1999, show individual HHAs the demographic and

clinical profiles of their patient population and adverse events. These

reports are expected to be available by late January 2001, followed by

detailed risk-adjusted outcome reports in 2002.12 Before the reports are

made electronically accessible to the HHAs, OASIS education coordinators

in each state will provide training and technical assistance for HHAs on

how to analyze and act on the information. In addition, HCFA has funded a

2-year pilot project in five states to explore the feasibility of using peer

review organizations to help HHAs in interpreting their reports and

developing from them effective quality improvement initiatives.13

Another way HCFA plans to use OASIS data to promote quality is by

providing information to assist physicians and patients in selecting HHAs.

HCFA expects that making such comparative information on outcomes

publicly available could encourage HHAs to compete for patients on the

basis of the quality of care they provide. HCFA has recently initiated

planning on how to release this information. The first step will be to

evaluate alternative approaches for presenting and distributing these data

to the public. One current example of HCFA’s efforts to share comparative

information on Medicare providers is its “Nursing Home Compare” Web

site. This site has information on facility and resident characteristics of

nursing facilities as well as deficiencies reported in past survey

inspections, though not on patient outcomes.

A second major use of OASIS data collection is payment-related. Under

the home health PPS, HHAs receive a specified payment per beneficiary

for each 60-day episode of care. HCFA uses OASIS data to assign patients

to one of 80 relative payment levels, called home health resource groups.

This assignment is based on 23 patient descriptors from the OASIS

assessment that measure clinical condition, functional status, and service

utilization. Each payment group is assigned a relative weight that reflects

the cost of the average beneficiary in that category relative to all home

health care users.

 12Risk-adjusted outcome reports take account of variations in the health characteristics of

the patients treated by different HHAs.

13The peer review organizations in Maryland, Michigan, New York, Rhode Island, and

Virginia are participating in this project.

OASIS Data Critical to

Adjusting HHA

Payments and

Improving PPS

Formulas
Page 9 GAO-01-205 Home Health Data Requirements

In addition to providing information necessary to implement the home

health PPS in its current form, OASIS data will assist HCFA in (1)

monitoring the effects of prospective payment on quality of care and (2)

developing potential refinements in the formulas used to determine

payments. Because of the change from cost-based reimbursement to

prospectively determined payments for each episode of care, PPS creates

a financial incentive to limit services per episode and increase the number

of episodes billed. HCFA has pledged to undertake monitoring of OASIS

data, along with data from other monitoring systems, as part of a

surveillance system designed to assess the short- and long-term effects of

PPS. For example, OASIS data should enable HCFA to detect unfavorable

trends in outcomes for home health care patients, such as delayed or

diminished recovery from a stroke.

Questions have been raised about the potential vulnerability of the OASIS

data to manipulation intended to maximize provider payments. HHAs

could benefit financially from making their patients appear as sick and

functionally impaired as possible when initially assessed, in order to be

assigned a higher payment group. HCFA was aware of the risk of “gaming”

and sought to minimize this risk when it selected the specific OASIS data

elements used to assign patients to different PPS payment groups. The

Medicare Payment Advisory Commission has nonetheless expressed

concern that the OASIS assessments submitted to HCFA will reflect these

financial incentives to exaggerate patient severity at admission.14 To

address concerns about data quality, HCFA has undertaken an accuracy

demonstration program. This program will evaluate alternative methods to

ensure the accuracy of the OASIS data submitted by HHAs. In addition,

state surveyors will check a sample of patient assessments against medical

records.

Medicare fiscal intermediaries—contractors to HCFA that process HHA

claims for payment—are also expected to use OASIS data. The

information will help them decide which HHAs to include in focused

medical reviews that determine the appropriateness of payment of

individual claims for home health services provided to beneficiaries. One

aspect of this review strategy involves determining whether OASIS

 14Medicare Payment Advisory Commission, Report to the Congress: Medicare Payment

Policy (Washington, D.C.: Medicare Payment Advisory Commission, Mar. 2000), p. 69. The

Commission suggests that less “subjective” data would not be as vulnerable to this type of

manipulation but does not identify substitutes for these OASIS data elements that would be

at least as good in predicting resource use and less susceptible to manipulation.
Page 10 GAO-01-205 Home Health Data Requirements

information is supported by documentation in the medical record. If the

intermediaries determine that the OASIS data are not appropriate, they

will adjust the payment grouping accordingly.

HCFA has sought to limit the amount of OASIS data collected to that

needed for monitoring quality and payment purposes. The research group

that developed OASIS under contract to HCFA—the University of

Colorado Center for Health Services and Policy Research (CHSPR)—

explicitly set out to identify the key data elements that would enable HHAs

to measure their outcomes while minimizing the data collection burdens.

CHSPR identified a set of 73 core data items needed both to compute

quality indicators and to risk-adjust the outcomes reported.15 (See app. II

for more details on this process.) An advisory group appointed by HCFA

reviewed CHSPR’s core data set. This Standard Assessment work group

was made up of 13 members, including HHA administrators, practicing

clinicians, a clinical assessment expert, a state official, and representatives

of industry and professional organizations. It recommended that HCFA

adopt the core data set, with the addition of several more elements.16 The

feasibility of collecting and using OASIS data was subsequently tested in

two demonstration studies that documented improved outcomes for the

participating HHAs.

Nearly all the OASIS data elements that emerged from this process will be

used to generate the specific outcome measures presented in the HHA

customized quality improvement reports. Six of the 79 items currently

have no intended use. Four of these, described as “potential risk

adjustment factors,” assess environmental and safety issues in the

patient’s home, and another item relates to the patient’s financial ability to

meet treatment needs.17 All four were among those added to the data set at

the behest of HCFA’s advisory work group. Concerns were subsequently

 15P.W. Shaughnessy, R.E. Schlenker, K.S. Crisler, and others, “Measuring Outcomes of

Home Health Care, Vol. 1: Final Report, Study to Develop Outcome-based Quality Measures

for Home Health Services (Denver: Center for Health Policy Research and Center for

Health Services Research, University of Colorado, 1994), pp. 6.31-6.42.

16The elements it recommended adding to the core data set related to the patient’s physical

environment, cognitive functions, financial ability to meet treatment needs, and hearing,

speech, and vision capabilities.

17The other two items, currently being considered for use in adverse event reporting, ask

the reasons for patient hospitalization and services received if the patient was discharged

to the community.

Almost All OASIS Data

Elements Collected Will Be

Used for Quality or

Payment Purposes
Page 11 GAO-01-205 Home Health Data Requirements

raised by some privacy advocates about the sensitivity of some of these

data elements. The financial question in particular was so sensitive that

HCFA decided to exclude it from the data transmitted by the HHAs to the

states. However, HCFA maintained the obligation of the HHAs to obtain

this information for all home health patients.

HCFA also required the HHAs to collect, but not initially transmit, OASIS

information on patients receiving skilled care who were not covered by

Medicare or Medicaid. HCFA has stated that it is important to collect

OASIS data on patients served by HHAs from all payor sources in order to

evaluate the quality of care provided. In addition, HHS must ensure that

the conditions of participation are adequate to protect all individuals

under the care of the HHA.18 Although HCFA has developed techniques for

masking the identity of non-Medicare/Medicaid patients, it has postponed

having these data transmitted to the state repositories. HCFA officials told

us that the notice to begin transmission of these data could be published in

the spring of 2001. HCFA will not, however, require retroactive

transmission of the OASIS data collected from non-Medicare/Medicaid

patients. Instead, HCFA will notify HHAs to transmit only current

assessments on non-Medicare/Medicaid patients.

Incorporating the OASIS data instrument into comprehensive patient

assessments has increased the consistency of patient data collected by the

HHAs. In contrast to HCFA’s expectation that HHAs would take no more

time to conduct start-of-care visits using OASIS, nearly all respondents in

our survey of HHAs estimated that start-of-care visits take longer than they

did before. These HHAs also reported that additional time is needed to

check and edit collected OASIS data, enter and transmit the information

electronically, and train new staff.

The initiation of home health care requires two separate but related steps:

performing a comprehensive assessment of the patient’s condition and,

based on that assessment, devising the patient’s plan of care. Before the

OASIS mandate took effect, Medicare rules required HHAs to perform

both of these steps, but called for specific documentation for the plan of

care only. Now they require the collection and reporting of the OASIS

 18Similarly, HCFA requires nursing homes to report outcome information on private pay as

well as Medicare and Medicaid patients.

Assessments More

Consistent Using

OASIS, but HHAs Say

Requirements Add

Time

OASIS Mandate Requires

More Consistent

Documentation of Patient

Assessments
Page 12 GAO-01-205 Home Health Data Requirements

assessment data for each patient as well as plan-of-care documentation.

Thus, what constitutes a comprehensive assessment under the longstanding requirement is now more clearly defined for HHAs.

According to HHA and state officials, the assessments that HHAs

performed in the past varied in both scope and format. They told us that

while some agencies may have conducted thorough evaluations of their

patients, others performed more cursory or narrowly focused

assessments. Likewise, HHA documentation practices could vary

substantially. For example, some agencies wrote narrative descriptions of

the patient’s condition, and others may have developed more structured

instruments with short answers or checklists. The effect of the OASIS

mandate on each HHA depended on how different its previous practices in

conducting and documenting patient assessments were from the current

OASIS data collection and reporting requirements.

HCFA has cited data from selected HHAs in an OASIS demonstration

project to support its expectation that OASIS’ standardized, multiplechoice format would take no more time to complete than prior

documentation of assessments, which typically involved individual

narratives. However, data we collected through interviews and a survey of

HHAs suggest that OASIS did result in an increase in time spent in initial

care visits and additional time for new tasks associated with transmission

of data.

To provide a basis for cost estimates, as required by regulation, HCFA

asked CHSPR to assess the OASIS data collection costs on HHAs, in

particular the additional staff time required. Of special concern was the

start-of-care comprehensive assessment, when clinicians would have to

obtain answers to all the OASIS questions from a new patient for the first

time.19

 19The start-of-care visit time includes both time in the patient’s home and time spent

completing required documentation outside the patient’s home. In addition to conducting

the patient assessment, activities undertaken at these visits include explanations of privacy

rights as well as patient care. Assessment-related activities outside the home include care

planning and coordination with other agency staff members. Subsequent assessments

should generally take less time, because the clinician already knows the patient and many

data items will remain unchanged.

OASIS Requires Additional

Time for Multiple

Activities
Page 13 GAO-01-205 Home Health Data Requirements

CHSPR gathered data from 10 agencies participating in a HCFA-sponsored

study.20 Overall, CHSPR found that the median total time taken by these

HHAs for start-of-care visits using OASIS was 150 minutes, a few minutes

less than start-of-care visits without OASIS. In a second study, Abt

Associates measured the time taken for start-of-care visits with a longer

version of OASIS, but recorded only the time spent in the patient’s home

and not time spent on associated paperwork performed elsewhere.21 This

study of more than 20,000 visits found that start-of-care visits using OASIS

required a median of 90 minutes. However, there were no comparable data

from start-of-care visits without OASIS.

In contrast to the CHSPR study, officials of the 32 agencies responding to

our survey of a representative sample of Medicare HHAs estimated that

start-of-care visits incorporating OASIS assessments did take more time

than those conducted prior to OASIS.22 The median total time estimated to

complete start-of-care visits with OASIS was 150 minutes, matching the

figure obtained in the CHSPR study. However, HHAs reported that this

amount represented a median increase of 40 minutes relative to time for

start-of-care visits prior to OASIS.23

In each of these studies, data from individual HHAs on the amount of time

required for start-of-care visits with OASIS varied widely. This variation

 20We obtained the unpublished results of this analysis from CHSPR. To control for other

factors affecting the HHAs, CHSPR selected 10 of the 54 participating agencies that had

implemented OASIS in one part of their organization and not in others. CHSPR then

surveyed 6 clinicians from each of the 10 HHAs, half using OASIS and half not. Each

respondent was asked how much time she had spent in the patient’s home and

documenting the assessment outside the home, for the start-of-care and at discharge, on

average and for the last such visit done. They were asked to recall the time spent, not

check logs.

21The Abt study was designed to identify factors predicting resource use in home health

care. It therefore used a 129-item version of the OASIS data set. The amount of time spent

was measured in minutes at the time the visit took place. We obtained unpublished data

used in this study.

22The survey was conducted 12 months after the OASIS mandate took effect. With an

adjusted sample size of 47 (3 of the original 50 HHAs in the sample were no longer

functioning as Medicare providers), 32 respondents represent a response rate of 68

percent. The respondents generally matched the sample and sampling universe, with the

exception of underrepresenting the Northeast region and overrepresenting the West, and to

a lesser extent overrepresenting facility-based agencies compared to freestanding ones. See

app. I for details.

23Most of the surveyed HHAs said that they based their responses on visit logs and similar

records, while others provided estimates.
Page 14 GAO-01-205 Home Health Data Requirements

may reflect differences in how responding HHAs have integrated the new

assessment instrument and how it is administered in the patient’s home.

Many of the HHAs we interviewed told us that they had followed HCFA’s

instructions to replace items requesting similar information on their

patient assessment forms with OASIS items. However, one agency had not

yet completed this task, requiring the nurse conducting an initial visit to

complete the OASIS form separately. To varying degrees, clinicians

administer the OASIS assessment through a combination of questioning,

examining the patient, and observing patient behavior and home

environment.

HHAs also have to perform new tasks related to the submission of OASIS

data to the state repositories in electronic form. Both the mandate for

HHAs to collect and report OASIS data and the transition to prospective

payment based on OASIS information have heightened the concern of

HHAs with the validity and completeness of these data. To help ensure

that patient assessments are correctly recorded in a form that HCFA’s data

repositories will accept, HHAs need to review the data as they proceed

from initial recording by the clinician to electronic transmission to the

state repository. The steps in this process include the following:

• Heightened supervisory review of the assessment forms completed by the

clinician performing the assessment.

• Entering, rechecking, and correcting OASIS data from paper records into

the computerized records.

• Batching and then electronically transmitting the data to a centralized

state data repository. (The transmission protocol established by HCFA

rejects data that do not pass tests for consistency and validity. Any data

rejected have to be analyzed, corrected, and resubmitted.)

The HHAs we surveyed estimated that these steps require approximately

50 minutes per OASIS assessment.

HHAs must also commit resources to training newly hired clinicians on

OASIS protocols. Eighty-four percent of our survey respondents said they

provide training for newly hired staff, with modules focused specifically

on OASIS data collection and documentation. Those HHAs offering OASISrelated training reported providing a median of 8 hours to new staff.

However, how much additional time is due specifically to the OASIS

requirement is not clear, because OASIS-related training could substitute

for some prior assessment-related training as well as add new elements.
Page 15 GAO-01-205 Home Health Data Requirements

Many HHAs may find that their additional OASIS-related costs are offset

by payments they receive under the new payment system. We recently

reported that PPS payment rates are based on 1998 rates of home health

care utilization, which have since declined.24 Therefore, they are likely to

be generous in comparison with current use patterns. In our view, the

episode payments could provide an ample cushion for many agencies,

which can be used to offset the costs associated with the OASIS mandate.

In addition, Congress and HCFA have taken several actions to assist HHAs

in complying with OASIS mandates. For example, for each Medicare

beneficiary served from October 1, 1999, to September 30, 2000, Congress

provided HHAs with $10 to help defray OASIS costs. Also, the prospective

payment base was increased by $4.32 per 60-day episode as an ongoing

adjustment for OASIS reporting costs. HCFA has taken other steps to

reduce the costs imposed on HHAs by the OASIS mandate. These include

the development and distribution free-of-charge to HHAs of a software

program (called HAVEN) to use in transmitting the OASIS data to state

agencies.25 HCFA has also provided toll-free telephone lines to the HHAs

for this data transmission.

HCFA has instituted several policies and procedures to protect OASIS data

from unauthorized access, conceal the identity of patients, and ensure that

recipients of OASIS information protect confidentiality. HCFA officials

believe that these actions provide reasonable assurance that the privacy of

OASIS information will not be compromised. As we previously reported,

ensuring that users of confidential health data, including OASIS data,

comply with required privacy procedures is also a necessary safeguard.

As with all patient medical data, HHAs must ensure the privacy of OASIS

information. Even before OASIS was mandated, HHAs participating in

Medicare had to develop policies and procedures to maintain the

confidentiality of patient information. Several state surveyors we

interviewed said that, as part of their inspections, surveyors examine how

 24Medicare Home Health Care: Prospective Payment System Could Reverse Recent

Declines in Spending (GAO/HEHS-00-176, Sept. 8, 2000), p. 24.

25HAVEN stands for Home Assessment Validation Entry. To provide other options for HHAs

that prefer not to use HAVEN, HCFA has assisted private sector vendors of data processing

services in making their systems compatible with OASIS requirements.

HCFA’s Data

Safeguards Aim to

Ensure Patient

Privacy

Safeguards Established to

Prevent Unauthorized

Access to Patient

Information
Page 16 GAO-01-205 Home Health Data Requirements

all patient records, including the OASIS forms, are maintained in the

HHA’s administrative offices.

The new privacy requirements under Medicare conditions of participation

call for the HHA (and any agent acting on its behalf, such as a software

vendor) to ensure the confidentiality of all patient information contained

in the clinical record, including OASIS data. This requirement also

prohibits the HHA and its agents from releasing patient-identifiable OASIS

information to the public. In addition, HHAs are required to provide

beneficiaries and other patients with an OASIS statement of privacy rights

upon admission to the HHA. These OASIS privacy notices inform patients

about their rights relating to their personal health information, in language

that is intended to be clear and easy to understand.26 HCFA reported that

consumer testing of Medicare beneficiaries indicated that they understood

that the notice was informing them about their rights relating to their

personal health care information.

HCFA has also implemented data transmission and storage policies to

protect the information while it is in transit to, and being stored at, state

agencies and HCFA.27 These mechanisms include required use of a secure

communications network to protect the data while in transit, as well as

technology designed to make information unintelligible should

unauthorized persons access it. Further, HCFA requires that certain

patient identifiers associated with non-Medicare/Medicaid patients be

“masked” so that state agencies and HCFA will be unable to determine the

identity of these individuals. Although HCFA has developed techniques for

masking the identity of patients, it has postponed having these data

transmitted to the state repositories.28 Similarly, HHAs are not to transmit

the response to the question as to whether the patient has sufficient

financial resources to pay for medicine, food, and other essentials. (Details

about HCFA’s data transmission and storage protections are discussed in

app. III.)

 26HHA officials we interviewed told us that patient complaints regarding the privacy of their

OASIS information are rare.

27We have not reviewed the implementation of the system, and without testing the security

mechanisms in place at HCFA, state agencies, and HHAs, we cannot be assured the steps

taken will adequately protect the privacy of non-Medicare/Medicaid patients.

28HCFA officials told us they expect to require the transmission of OASIS data on nonMedicare/Medicaid patients in the spring of 2001.
Page 17 GAO-01-205 Home Health Data Requirements

Once the OASIS information is transmitted to HCFA, it is maintained in a

national repository, where specific disclosure policies apply. HCFA is

bound by the requirements of the federal Privacy Act (P.L. 93-579) in

protecting the confidentiality of all health information on beneficiaries,

including OASIS information.29 The Privacy Act allows the disclosure of

information without an individual’s consent for “routine uses” that are

consistent with the purposes for which the information was originally

collected. The routine uses of OASIS information include aiding in the

administration of the HHA survey and certification process.30

Persons who request OASIS data, such as researchers and members of

peer review organizations, must agree to protect the confidentiality of the

information as part of a written “data use agreement.” Data use

agreements must also be in place between HCFA regional offices and the

state’s Medicaid agency before the state’s OASIS agency can release the

information to the Medicaid agency. In addition, HCFA officials told us

that it is departmental policy to release only the “minimum necessary”

data to meet the requester’s purpose.

HCFA believes that the policies and procedures it currently has in place

provide it with reasonable assurance that the confidentiality of any OASIS

information released to approved entities will be maintained. However, in

a July 1999 report we identified several weaknesses in HCFA’s privacy

practices that could potentially compromise the confidentiality of health

information on Medicare beneficiaries.31 Although we found that HCFA’s

policies and procedures regarding disclosure of personally identifiable

information were generally consistent with the provisions of the Privacy

Act, weaknesses in the implementation of these policies raised concerns.

For example, we found that HCFA was not always clearly informing

beneficiaries of the purposes for which their information may be

disclosed, as required by the Privacy Act. We also found that HCFA did not

 29In protecting the confidentiality of health information of its beneficiaries, HCFA’s

activities, like those of other federal agencies, are governed by the Privacy Act of 1974. A

more detailed discussion of the Privacy Act and HCFA’s Notice of the OASIS System of

Records is also contained in app. III.

30In accordance with Privacy Act requirements, HCFA published its routine uses for OASIS

information in the Federal Register. These uses are listed in app. III.

31Medicare: Improvements Needed to Enhance Protection of Confidential Health

Information (GAO/HEHS-99-140, July 1999).

Privacy Protections Could

Be Further Enhanced
Page 18 GAO-01-205 Home Health Data Requirements

routinely monitor contractors and others, such as researchers, who use

personally identifiable Medicare information. We recommended that

HCFA take steps to address these weaknesses.

HCFA has taken steps regarding protection of its OASIS data. As stated

above, HCFA has required HHAs to provide both Medicare/Medicaid and

private pay patients with OASIS privacy notices. The beneficiary notice

lists the patient’s primary rights and gives the patient information as

required by the Privacy Act, such as HCFA’s authority for collecting OASIS

data and the principal purposes for which the information would be

routinely used.

However, based on our discussions with HCFA and state officials, there

appears to be little or no oversight of how effectively the state agencies

and third parties are maintaining the privacy of OASIS information. Even

though HCFA requires state agencies to ensure that access to OASIS data

is restricted and that recipients of OASIS information protect its

confidentiality, HCFA officials told us that they do not inspect the privacy

safeguards in place at the state agency.32 These officials also indicated that

HCFA still has no system in place to monitor whether parties subject to

data use agreements are complying with their requirements.33 Without an

adequate monitoring system in place, HCFA could be hampered in its

attempts to prevent the occurrence of problems and provide timely

information and corrective action for any that might occur.

With the implementation of a prospective payment system, efforts to

protect patients from potential underprovision of care and to hold HHAs

accountable are essential. Instituting the collection and reporting of OASIS

data is an important step in that direction. The use of OASIS data enhances

consistency in the performance and documentation of patient assessments

for home health services. As a result, information on patient outcomes will

become available for the first time.

 32Guidelines issued to the state agencies by HCFA recommend specific safeguards, such as

a policy that defines and limits the qualifications for an individual to access the OASIS

system. These safeguards generally follow the guidance found in Office of Management and

Budget Circular A-130 (revised), Appendix III, Security of Federal Automated Information

Resources.

33In its Notice of the OASIS System of Records, HCFA does not mention having a system to

routinely monitor third-party compliance.

Concluding

Observations
Page 19 GAO-01-205 Home Health Data Requirements

Collecting such data is not without its costs. To varying degrees, the

requirement to collect OASIS data on all home health patients increases

the amount of staff time devoted to collecting and reporting patient

assessment information. HHAs have been compensated for some of these

costs through adjustments to their payment rates. Moreover, because PPS

episode payment rates are based on historically high utilization levels,

which have since declined, these rates should allow the completion of

OASIS assessments.

Protecting the privacy of home health care patients is also important.

HCFA has made progress in this area by enhancing protections in the

collection and transmission of the OASIS data. The effectiveness of these

policies and procedures will depend on how well they are implemented.

We provided a draft of this report to HCFA for review. It its comments,

HCFA agreed with our findings and conclusions and elaborated on several

points addressed in the report. HCFA continues to believe that, once HHA

staff learn how to implement OASIS, the amount of time it takes to

conduct a thorough patient assessment will decline. The agency contends

that, as experience with OASIS is gained, HHAs will be better able to

integrate use of the instrument into their ongoing administrative and

clinical activities. In addressing the use of OASIS for payment purposes,

HCFA considers the OASIS data elements to be crucial to refining payment

rates, and if data collection were limited to those elements currently

needed for payment, its ability to refine PPS in the future would be

constrained. Regarding our discussion of data confidentiality protections,

HCFA highlighted several specific steps it has taken to ensure patient

privacy. HCFA’s comments appear in appendix IV. The agency made

technical comments that we incorporated where applicable.

Agency Comments
Page 20 GAO-01-205 Home Health Data Requirements

We are sending copies of this report to the Honorable Robert A. Berenson,

Acting Deputy Administrator of HCFA, and others who are interested. We

will also make copies available to others on request. Rosamond Katz, Eric

Peterson, and Victoria M. Smith developed the information contained in

this report. Please contact me at (202) 512-7119 if you or your staffs have

any questions.

Janet Heinrich, Director, Health Care—Public Health Issues
Page 21 GAO-01-205 Home Health Data Requirements

List of Committees

The Honorable Arlen Specter, Chairman

The Honorable Tom Harkin, Ranking Member

Subcommittee on Labor, HHS, and Education

Committee on Appropriations

United States Senate

The Honorable Charles E. Grassley, Jr., Chairman

The Honorable Max Baucus, Ranking Member

Committee on Finance

United States Senate

The Honorable Ralph Regula, Chairman

The Honorable David R. Obey, Ranking Minority Member

Subcommittee on Labor, HHS, and Education

Committee on Appropriations

House of Representatives

The Honorable Nancy L. Johnson, Chairman

The Honorable Pete Stark, Ranking Minority Member

Subcommittee on Health

Committee on Ways and Means

House of Representatives

The Honorable William J. Tauzin, Chairman

The Honorable John Dingell, Ranking Minority Member

Committee on Commerce

House of Representatives
Appendix I: Methodology for Survey of Home

Health Agencies

Page 22 GAO-01-205 Home Health Data Requirements

To gain the perspective of a representative segment of HHAs with respect

to the cost and privacy implications of the OASIS mandate, we surveyed a

random sample of HHAs. This appendix describes how the survey was

conducted and discusses the strengths and limitations of the information

provided.

Determining how much it has cost HHAs to implement HCFA’s mandate to

collect and report OASIS data on individual patients is complex, for three

main reasons. First, the OASIS mandate could lead to additional costs in

many different areas, including additional staff time to perform a variety of

tasks. HCFA required that the OASIS items be integrated with other

assessment forms, which could involve the development of both new

forms and new procedures to complete them. The process of encoding and

transmitting the OASIS data electronically led many HHAs to expand their

use of computers, which could have called in turn for capital investments

and the recruitment of new staff.

Second, the home health care industry was undergoing radical change.

The ongoing transition from cost-based reimbursement to prospective

payment fundamentally altered the financial circumstances and incentives

of many agencies. The characteristics of patients seeking and receiving

home health care may also have changed as a result. Staff recruitment,

training, computerization, and revamped procedures were all affected by

these market and payment-related changes as well, making it very difficult

to isolate an independent effect from the OASIS mandate.

Third, no cost data specifically linked to patient assessment activities were

systematically and consistently maintained either before or after the

implementation of the OASIS mandate. Instead, such activities are

integrated into the clinical and administrative functions of HHAs. Thus any

attempt to estimate the specific effect of OASIS on costs necessarily

would involve some reconstruction of such data after the fact.

Our survey of HHAs was designed with these factors in mind. Rather than

attempt to obtain a comprehensive accounting of all possible OASISrelated costs, we focused on the additional time spent on four major

activities that appeared from our preliminary interviews with HHA

officials to have had a substantial effect on total costs:

Appendix I: Methodology for Survey of Home

Health Agencies

Survey Design
Appendix I: Methodology for Survey of Home

Health Agencies

Page 23 GAO-01-205 Home Health Data Requirements

• Clinicians’ total time for the start-of-care visit,

• Supervisors’ time reviewing and monitoring patient assessment data

collection,

• Time for training new hires on OASIS, and

• Time entering and transmitting OASIS data electronically.

We asked the executive directors of the HHAs we surveyed to provide

both current and pre-OASIS time figures from more than a year ago. It is

common for agencies to maintain logs with time spent at different types of

visits. While most HHAs said they were able to draw on relevant and

specific recorded data, others provided rough estimates. However variable

in quality, these data recorded by the HHAs for their own purposes

represent the best available data we found for estimating the cost

implications of the OASIS mandate.

To select our sample, we used 1999 data extracted from HCFA’s Provider

of Service File and associated claims data. We started with a list of each

HHA that had been paid for at least one Medicare home health visit in

1999. We excluded those agencies that had not begun providing home care

under Medicare prior to January 1, 1999, and those that served fewer than

15 Medicare patients in 1999. We then selected a simple random sample

from the remaining agencies. Thus, the sample represents the universe of

HHAs, not patients.

Although our sample was not stratified, we did take precautions to ensure

that the agencies in the sample did not have a highly skewed distribution

along several major dimensions. Specifically, we observed the distribution

among all the HHAs in our sampling universe for five characteristics—

caseload size (number of Medicare patients treated annually), urban/rural,

geographic region, organizational affiliation (Visiting Nurse Association

(VNA), facility-based, freestanding), and tax status (nonprofit, for-profit,

government). (See table 1.) We then took a series of independent random

samples of 50 agencies each. (Every agency had an equal chance of being

selected for each of these samples.) We used the sample that best matched

the distribution found in the sampling universe.

Sample Selection
Appendix I: Methodology for Survey of Home

Health Agencies

Page 24 GAO-01-205 Home Health Data Requirements

Table 1: Percentage of All Agencies, Sample Agencies, and Survey Respondents

with Selected Characteristics

Universe (n = 6,772) Sample (n = 50) Respondents (n = 32)

Caseload size

Less than 100 28.9 30 25.0

100 to 249 28.6 30 37.5

250 to 999 32.6 30 28.1

1000 or more 9.9 10 9.4

Urban/rural

Urban 61.8 66 59.4

Rural 38.2 34 40.6

Region

Northeast 17.1 14 3.1

South 40.1 34 43.8

Midwest 26.6 30 21.9

West 16.2 22 31.3

Affiliation

Facility-based 34.6 38 43.8

Freestanding 59.3 54 50.0

VNA 6.1 8 6.3

Tax status

For-profit 47.2 46 43.8

Nonprofit 35.9 36 34.4

Government 16.9 18 21.9

Source: HCFA’s 1999 Provider of Service file.

We received usable responses from 32 HHAs. Three of the 50 surveyed had

ceased to operate as separate agencies, either by going out of business or

by merging with another entity. That gave us an effective response rate of

68 percent (32 out of 47). As shown above, the respondent group generally

matched the characteristics of the sampling universe and the sample. The

main exception was an underrepresentation of the Northeast region and

overrepresentation of the West. Facility-based agencies were also

somewhat overrepresented among the respondents compared to

freestanding HHAs.

Because our sample was randomly selected, it provides unbiased

estimates of the results we would have received had we been able to

survey the entire universe. Still, a sample of 50 (with 32 respondents) is

likely to have considerable sampling error compared to that of a larger

sample. The standard errors and 95 percent confidence interval for the

main survey items presented in the report are provided below. These

Sample Response

Rate
Appendix I: Methodology for Survey of Home

Health Agencies

Page 25 GAO-01-205 Home Health Data Requirements

confidence intervals indicate the range within which there is a 95 percent

chance the mean would fall if the full universe had been surveyed. They

therefore show that there is imprecision in the estimates of the means due

to the relatively small size of our sample. For example, the estimate for the

mean time required for start-of-care visits using OASIS was 143 minutes,

but the 95-percent confidence interval for that estimate ranged from 125

minutes to 160. In the text of the report we chose to present medians

rather than means, since they are less sensitive to outliers. Table 2 below

shows both means and medians.

Table 2: Medians, Means, and 95-Percent Confidence Intervals for Survey Results

Variable Median Mean

Standard

error 95% confidence interval

Start-of-care assessment

Clinician’s time for visit

and documentation postOASIS, minutes 150.0 142.9 8.7 125.4-160.4

Additional time using

OASIS, minutes 40.0 43.9 5.6 32.6–55.2

OASIS data review, entry and transmission

Supervisor’s time

reviewing start-of-care

assessment post-OASIS,

minutes 30.0 31.8 3.2 25.3-38.2

Additional time for

supervisory review of

OASIS data, minutes 15.0 16.0 2.8 10.5–21.6

Time to enter and check

OASIS data, minutes per

assessment

29.4

28.7a

59.0

40.4a

13.8

5.6a

31.3–86.7

29.4–51.6a

Time to transmit OASIS

data, minutes per

assessment

4.0

3.8b

7.3

5.4b

2.2

1.1b

2.9–11.8

3.2-7.6b

Staff training

Training new hires on

OASIS, hours 8.0 11.9 2.3 7.3–16.6

Additional new hire

training time post-OASIS,

hours 6.0 8.3 1.4 5.5–11.2

a

Recalculated with two outliers removed.

b

Recalculated with one outlier removed.

Source: GAO analysis.
Appendix I: Methodology for Survey of Home

Health Agencies

Page 26 GAO-01-205 Home Health Data Requirements

Apart from the imprecision introduced by sampling considerations,

numerous factors are likely to have influenced the estimates provided to

us by the HHAs we surveyed:

• The surveyed HHAs varied in the extent to which they relied on written

records to calculate the amount of time taken for start-of-care visits preand post-OASIS. We asked them to draw on such records if possible, but

available records varied from one agency to another.

• To the extent that the respondents believed that higher estimates of time

spent on post-OASIS visits might promote more generous payments for

home health care under Medicare, there could be an upward bias in the

figures provided.

• The comparison of current visit times with those preceding the OASIS

mandate incorporates the effects of all the changes that affected home

health care over that period, such as shifts in payment methods and

amounts by Medicare and other payers, fluctuations in market demand for

nursing and therapist staff, and the sharp decline in the number of

agencies providing care (following an earlier period of rapid growth), as

well as OASIS.

Potential

Measurement Error
Appendix II: Development and Testing of the

OASIS Data Set

Page 27 GAO-01-205 Home Health Data Requirements

OASIS was developed by the University of Colorado Center for Health

Services and Policy Research (CHSPR) for the purpose of measuring home

health care outcomes.1

 This effort involved first a review of the existing

approaches for assessing the quality of home health care, including both a

literature review and consultations with clinical experts. A series of

studies examined the data that could be obtained from clinical records as

well as secondary data sources such as Medicare claims and plan-oftreatment forms. The subsequent empirical testing of candidate measures

collected data from 3,427 Medicare and non-Medicare patients treated in

49 HHAs.

The data elements collected were tested for their statistical reliability. The

measures based on those data elements were assessed on a range of

criteria, including their clinical meaningfulness (as judged by clinical

review panels), coverage across multiple dimensions of health status,

minimization of redundancy, and ability to detect differences among

HHAs. At the end of this process, CHSPR arrived at a set of 73 core data

items needed both to compute core quality indices and to adjust the

outcomes reported for different agencies to take account of relevant

differences in the circumstances of the patients that they treat (that is, risk

adjustment).2

In late 1994, HCFA convened a 13-member Standard Assessment work

group made up of HHA administrators, practicing clinicians, a clinical

assessment expert, a state official, and representatives of industry and

professional organizations. Its charge was to assess CHSPR’s core data

items for inclusion in a patient assessment instrument to be mandated

under revised conditions of participation for HHAs under the Medicare

program. This group recommended that HCFA adopt the core data items

with modifications. Specifically, they suggested that HCFA expand three

of the data elements, convert one item to three more detailed items, and

add eight new items, including cognitive functions, financial ability to

meet treatment needs, and hearing, speech, and vision capabilities.

 1

Since the mid-1980s, CHSPR has conducted a series of studies examining quality of care in

home health services. The center received funding from both HCFA and the Robert Wood

Johnson Foundation specifically to develop and test outcome-based indicators of quality in

home health care.

2

P.W. Shaughnessy, R.E. Schlenker, K.S. Crisler, and others, “Measuring Outcomes of Home

Health Care, Vol. 1: Final Report, Study to Develop Outcome-based Quality Measures for

Home Health Services (Denver: Center for Health Policy Research and Center for Health

Services Research, University of Colorado, 1994), pp. 6.31-6.42.

Appendix II: Development and Testing of the

OASIS Data Set
Appendix II: Development and Testing of the

OASIS Data Set

Page 28 GAO-01-205 Home Health Data Requirements

This expanded core data set, now named OASIS, was then tested in several

demonstration studies conducted by CHSPR. Beginning in 1995, a group of

50 HHAs nationwide, plus another 67 in New York State, were selected to

see whether HHAs could in fact use OASIS assessments to identify

dimensions of care with suboptimal outcomes and then take measures to

improve those outcomes. Empirical testing of the OASIS data and

measures continued, including a second round of reliability assessments.

In addition, a demonstration conducted by Abt Associates also collected

OASIS data elements for the purpose of identifying appropriate criteria for

setting rates in a home health PPS.3

 A separate set of reliability

assessments took place as part of this study. The interim results published

by Abt and CHSPR indicate that the OASIS data set is generally reliable,

although a few data items had poor reliability according to the standards

adopted in these studies.4

 Both CHSPR and Abt are planning to report

additional reliability results based on larger numbers of patients, but these

findings are not yet available.

The Medicare Quality Assurance Demonstration and the New York State

Outcome Based Quality Improvement Demonstration showed that HHAs

could use OASIS data to improve home health care outcomes. Based on

their initial OASIS results, the HHAs examined their processes of care in

order to develop plans of action designed to enhance two specific

outcomes: reducing the hospitalization rate of their patients, and another

outcome selected by each participating HHA. Overall, the rate of

hospitalization among patients treated by the Medicare Quality Assurance

Demonstration HHAs declined in one year from 31.4 percent to 28.3

percent, a decrease of 10 percent. The corresponding decline in

hospitalization rates among patients in the New York State Demonstration

HHAs was 9 percent. However, no similar decrease in hospitalizations was

observed for home health patients nationally during this period. Thus

 3

In 1996, HCFA funded a major study by Abt Associates to develop a case-mix adjustment

method to be used in the home health PPS.

4

The kappa statistic is generally accepted as the appropriate statistical measure of

reliability. The independent assessment of OASIS reliability conducted by Abt Associates

interpreted a kappa of .40 or below as indicating poor, .41 to .74 as moderate, and .75 or

above as excellent reliability. See H.B. Goldberg, Case-Mix Adjustment for a National Home

Health Prospective Payment System, Contract No. 500-96-0003/TO#2, Second Interim

Report (Cambridge, Mass.: Abt Associates Inc.), Sept. 24, 1999, p. G-9. The CHSPR group

did not specify comparable thresholds, but cited several individual data elements with

kappas ranging from .25 to .45 as having “relatively low values,” which suggested that they

should be revised or replaced (Shaughnessy and others, Outcome-based Quality Measures,

p. 5.6).
Appendix II: Development and Testing of the

OASIS Data Set

Page 29 GAO-01-205 Home Health Data Requirements

HCFA concluded that outcome-based quality improvement initiatives

adopted by the demonstration HHAs were effective in achieving their

stated objective.
Appendix III: OASIS Data Privacy Protections

Page 30 GAO-01-205 Home Health Data Requirements

In protecting the confidentiality of health information of its beneficiaries,

HCFA’s activities, like those of other federal agencies, are governed by the

Privacy Act of 1974 (5 U.S.C. 552a, P.L. 93-579). The Privacy Act requires

that agencies limit their maintenance of individually identifiable records to

those that are relevant and necessary to accomplish an agency’s purpose.

Federal agencies store personally identifiable information in systems of

records—a group of records, under the control of a federal agency, from

which information can be retrieved by the name of an individual or an

identifier such as a number assigned to the individual. As of November

2000, HCFA had 47 systems of records related directly to Medicare

beneficiaries containing information stored in both electronic and paper

form. HCFA stores personally identifiable data on a Medicare beneficiary’s

enrollment and entitlement to benefits; demographic information such as

age, race, ethnicity, and language preference; and diagnoses and utilization

of medical services.

The Privacy Act generally prohibits the disclosure of individuals’ records

without their consent. However, it allows the disclosure of information

without an individual’s consent under 12 circumstances called conditions

of disclosure, such as disclosure by a federal agency to its employees

based on their need for records to perform their duties. Another condition

of disclosure allows an agency to establish “routine uses” that the agency

has determined to be compatible with the purposes for which the

information was collected.1

In accordance with the requirements of the Privacy Act, HCFA issued a

notice in June 1999 that it was establishing a new system of records to

contain OASIS data.2

 In this notice, HCFA outlined several precautionary

measures it was taking to minimize risks of unauthorized disclosure. For

example, HCFA stated that it will collect only that information necessary

to perform the functions for which it plans to use the OASIS data, such as

creating patient outcome reports for HHAs. Similarly, HCFA said it will

disclose only the minimum amount of OASIS data necessary to achieve

purposes compatible with these functions. All patient-specific information

 1

While the Privacy Act permits agencies to disclose information, it does not require that

they do so. Agencies can, for example, determine that in a particular case the privacy

interest outweighs the public interest in a disclosure. However, an agency generally must

disclose information maintained about an individual to that individual at his or her request.

2

64 Fed. Reg. 32992 (June 18, 1999). On the same day, HCFA also issued a notice requiring

OASIS data collection and transmission. See 64 Fed. Reg. 32984 (June 18, 1999).

Appendix III: OASIS Data Privacy Protections

Privacy Act

Protections

Applicable to OASIS
Appendix III: OASIS Data Privacy Protections

Page 31 GAO-01-205 Home Health Data Requirements

is to be kept confidential, with access limited to ensure that privacy

remains protected.3

Also included in the notice are the details regarding the scope of the data

collected and HCFA’s policies and procedures regarding disclosures for

the following routine uses of OASIS data:

• Aid in the administration of the survey and certification of

Medicare/Medicaid HHAs,

• Enable regulators to provide HHAs with data for their internal quality

improvement activities,

• Support agencies of the state government to determine the overall

effectiveness and quality of HHA services provided in the state,

• Aid in the administration of federal and state HHA programs within the

state,

• Monitor the continuity of care for patients who reside temporarily outside

the state,

• Support regulatory, reimbursement, and policy functions,

• Support constituent requests made to a congressional representative,

• Support litigation involving the agency, and

• Support research projects related to disease prevention or health

maintenance.

In its notice, HCFA listed seven entities who may receive disclosures of

OASIS data under HCFA’s routine use exception: (1) Department of

Justice, court or adjudicatory body, (2) agency contractors or consultants

who have been engaged by the agency to assist in the performance of a

service related to the OASIS system of records and who need to have

access to the records in order to perform the activity, (3) an agency of a

state government, or established by state law,4

 (4) another federal or state

agency (including state survey agencies and state Medicaid agencies) for

 3

With respect to authorized users, HCFA’s safeguards include (1) training them in the

Privacy Act and systems security requirements, (2) prohibiting them from releasing

information until they have the agreement of the recipient that appropriate administrative,

technical, procedural, and physical safeguards have been (or will be) implemented, (3)

monitoring them to ensure against excessive or unauthorized use, (4) requiring them to use

records in a designated work area or work station, and (5) assigning them an appropriate

database user class that restricts access accordingly.

4

For purposes of determining, evaluating, and/or assessing overall or aggregate cost,

effectiveness, and/or the quality of HHA services provided in the state; for developing and

operating Medicaid reimbursement systems; or for administration of federal/state HHA

programs within the state.
Appendix III: OASIS Data Privacy Protections

Page 32 GAO-01-205 Home Health Data Requirements

contributing to the accuracy of HCFA’s health insurance operations and/or

for supporting state agencies in the evaluations and monitoring of care

provided by HHAs, (5) a peer review organization, (6) an individual or

organization for research purposes, and (7) a member of Congress or

congressional staff member in response to an inquiry of the congressional

office made at the written request of the constituent about whom the

record is maintained.

In addition to Privacy Act protections, beneficiaries are afforded

confidentiality protections under the HHA conditions of Medicare

participation. For example, HHAs and their agents cannot release OASIS

information that identifies particular patients to the public. Additionally,

patients have the following rights: (1) the right to know why the HHA is

asking the OASIS questions, (2) the right to have their personal health care

information kept confidential, (3) the right to refuse to answer questions,

(4) the right to look at, and request changes to, their personal assessments,

and (5) the right to be informed that OASIS information will not be

disclosed except for legitimate purposes allowed by the Privacy Act.

HCFA has established additional methods to ensure the security of OASIS

information while in transit and in storage. First, HCFA will retain

information on individuals who have non-Medicare/Medicaid payment

sources in a format that does not identify particular patients. For these

patients, the HHA will submit OASIS information with certain patient

identifiers “masked.” According to HCFA officials, masking involves

obscuring items such as the patient’s name, Social Security number, and

HHA patient identification number, while still allowing data for individual

patients to be linked. These officials told us that they cannot decode

masked identifiers or re-identify the information based on nonmasked

identifiers, and therefore neither the state nor HCFA will know the identity

of the non-Medicare/Medicaid patients who are the subjects of transmitted

OASIS information.

Second, HHAs are currently required to submit OASIS data through a

private telephone line. HCFA officials told us that they required HHAs to

transmit OASIS data via the Medicare Data Communications Network

(MDCN) as of October 1, 2000. The MDCN system includes an encryption

standard for increased protection from unauthorized access while the data

are in transit. According to HCFA officials, the MDCN’s 128-bit encryption

standard will guard against unauthorized access to OASIS data, such as by

computer hackers, while in transit.

Other OASIS Data

Privacy Protections
Appendix III: OASIS Data Privacy Protections

Page 33 GAO-01-205 Home Health Data Requirements

HCFA and state OASIS automation coordinators also told us that the use

of the MDCN network is subject to numerous password protections. In

order to access the MDCN, a user needs to know three different items of

information, all of which are subject to confidentiality policies: (1) the

phone number of the MDCN network, (2) the individual user identification

number and password for the MDCN, and (3) the HHA-specific user

identification code and password for the applicable state system. In

addition, the MDCN passwords must be changed on a periodic basis.

Third, according to HCFA officials, the agency has implemented physical

safeguards and record retention policies to reduce the risk of

unauthorized access over time. For instance, the HCFA OASIS data

computer server is kept in a secure room, and only personnel with

designated access may enter. HCFA officials told us that although they do

not inspect the privacy safeguards in place at the state level, guidelines

issued to the state agencies require server safeguards.5

 The state OASIS

coordinators we spoke with said their server rooms are locked and access

restricted. HCFA officials told us that for now, OASIS data will not be

maintained online for more than 3 years. HCFA officials stated that they

would also not maintain identifiable OASIS data any longer than 15 years.

 5

The regulation on state agency OASIS collection and database responsibilities requires the

state agency to ensure that access to OASIS data is restricted and that OASIS data are

released only to the extent permitted under the Privacy Act.
Appendix IV: Comments From HCFA

Page 34 GAO-01-205 Home Health Data Requirements

Appendix IV: Comments From HCFA
Appendix IV: Comments From HCFA

Page 35 GAO-01-205 Home Health Data Requirements
Appendix IV: Comments From HCFA

(201063) Page 36 GAO-01-205 Home Health Data Requirements
The first copy of each GAO report is free. Additional copies of reports are

$2 each. A check or money order should be made out to the

Superintendent of Documents. VISA and MasterCard credit cards are also

accepted.

Orders for 100 or more copies to be mailed to a single address are

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St., NW (corner of 4th and G Sts. NW)

Washington, DC 20013

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and testimony. To

receive facsimile copies of the daily list or any list from the past 30 days,

please call (202) 512-6000 using a touchtone phone. A recorded menu will

provide information on how to obtain these lists.

Orders by Internet

For information on how to access GAO reports on the Internet, send an email message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• E-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs