```

[Federal Register Volume 76, Number 110 (Wednesday, June 8, 2011)]
[Proposed Rules]
[Pages 33566-33588]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-14003]

[[Page 33565]]

Vol. 76

Wednesday

No. 110

June 8, 2011

Part III

Department of Health and Human Services

-----------------------------------------------------------------------

Centers for Medicare & Medicaid Services

-----------------------------------------------------------------------

42 CFR Part 401

Medicare Program; Availability of Medicare Data for Performance 
Measurement; Proposed Rule

Federal Register / Vol. 76, No. 110 / Wednesday June 8, 2011 / 
Proposed Rules

[[Page 33566]]

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 401

[CMS-5059-P]
RIN 0938-AQ17

Medicare Program; Availability of Medicare Data for Performance 
Measurement

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This rule proposes to implement new statutory requirements 
regarding the release and use of standardized extracts of Medicare 
claims data to measure the performance of providers and suppliers in 
ways that protect patient privacy. This rule explains how entities can 
become qualified by CMS to receive standardized extracts of claims data 
under Medicare Parts A, B, and D for the purpose of evaluation of the 
performance of providers of services and suppliers.

DATES: To be assured consideration, comments must be received at one of 
the addresses provided below, no later than 5 p.m. on August 8, 2011.

ADDRESSES: In commenting, please refer to file code CMS-5059-P. Because 
of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    You may submit comments in one of four ways (please choose only one 
of the ways listed):
    1. Electronically. You may submit electronic comments on this 
regulation to http://www.regulations.gov. Follow the ``Submit a 
comment'' instructions.
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-5059-P, P.O. Box 8012, 
Baltimore, MD 21244-1850.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-5059-P, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    4. By hand or courier. Alternatively, you may deliver (by hand or 
courier) your written comments ONLY to the following addresses prior to 
the close of the comment period: a. For delivery in Washington, DC-- 
Centers for Medicare & Medicaid Services, Department of Health and 
Human Services, Room 445-G, Hubert H. Humphrey Building, 200 
Independence Avenue, SW., Washington, DC 20201.
    (Because access to the interior of the Hubert H. Humphrey Building 
is not readily available to persons without Federal Government 
identification, commenters are encouraged to leave their comments in 
the CMS drop slots located in the main lobby of the building. A stamp-
in clock is available for persons wishing to retain a proof of filing 
by stamping in and retaining an extra copy of the comments being 
filed.)
    b. For delivery in Baltimore, MD--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, 7500 Security 
Boulevard, Baltimore, MD 21244-1850.
    If you intend to deliver your comments to the Baltimore address, 
please call telephone number (410) 786-9994 in advance to schedule your 
arrival with one of our staff members.
    Comments erroneously mailed to the addresses indicated as 
appropriate for hand or courier delivery may be delayed and received 
after the comment period.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT: Colleen Bruce, (410) 786-5529.

SUPPLEMENTARY INFORMATION: 
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following Web 
site as soon as possible after they have been received at: http://www.regulations.gov. Follow the search instructions on that Web site to 
view public comments.
    Comments received in a timely fashion would also be available for 
public inspection as they are received, generally beginning 
approximately 3 weeks after publication of a document, at the 
headquarters of the Centers for Medicare & Medicaid Services, 7500 
Security Boulevard, Baltimore, Maryland 21244, Monday through Friday of 
each week from 8:30 a.m. to 4 p.m. To schedule an appointment to view 
public comments, phone 1-800-743-3951.

I. Background

    On March 23, 2010, the Patient Protection and Affordable Care Act, 
(``Affordable Care Act'') Public Law 111-148, was enacted. Effective 
January 1, 2012, section 10332 of the Affordable Care Act would amend 
section 1874 of the Social Security Act (the Act) by adding a new 
subsection (e) requiring standardized extracts of Medicare claims data 
under parts A, B, and D be made available to ``qualified entities'' for 
the evaluation of the performance of providers of services and 
suppliers. Such a disclosure is permitted under the Privacy Rule issued 
under the Health Insurance Portability and Accountability Act as a 
disclosure ``required by law.'' Qualified entities may use the 
information obtained under section 1874(e) of the Act for the sole 
purpose of evaluating the performance of providers of services and 
suppliers, and to generate specified public reports. Qualified entities 
may receive data for one or more specified geographic areas and must 
pay a fee equal to the cost of making the data available. Congress also 
required that qualified entities combine claims data from sources other 
than Medicare with the Medicare data when evaluating the performance of 
providers of services and suppliers. Potential qualified entities that 
wish to request data under these provisions would have to submit an 
application to the Secretary that includes, among other things, a 
description of the methodologies that the applicant proposes to use to 
evaluate the performance of providers of services and suppliers in the 
geographic area(s) they select. Qualified entities would generally be 
required to use standard measures for evaluating the performance of 
providers of services and suppliers unless the Secretary, in 
consultation with appropriate stakeholders, determines that use of 
alternative measures would be more valid, reliable, responsive to 
consumer preferences, cost-effective, or relevant to dimensions of 
quality and resource use not addressed by standard measures. Reports 
generated by the qualified entities may only include information on 
individual providers of services and suppliers in aggregate form, that 
is, at the provider of services or supplier level, and may not be 
released to the public until the providers of services and suppliers 
have had an opportunity to review them and ask for corrections. 
Congress included a provision at section 1874(e)(3) of the Act to allow 
the Secretary to take such actions as may be necessary to protect the 
identity of individuals entitled to or enrolled in Medicare.

[[Page 33567]]

    We believe the sharing of Medicare data with qualified entities 
through this program and the resulting reports produced by qualified 
entities would be an important driver of improving quality and reducing 
costs in Medicare, as well as for the healthcare system in general. 
Additionally, we believe this program would increase the transparency 
of provider and supplier performance, while ensuring beneficiary 
privacy.

II. Provisions of the Proposed Rule

    To implement the new statutory provisions of section 1874(e) of the 
Act, we are proposing to revise Part 401 by adding a new subpart G, 
``Availability of Medicare Data for Performance Measurement.'' The 
proposals in this rule would be consistent with section 10332 of the 
Affordable Care Act. Throughout the preamble, we identify options and 
alternatives to the provisions we propose. We have attempted to take 
into consideration comments received during the listening session on 
September 20, 2010. However, we strongly encourage comments on our 
proposed approach and on alternatives that would help us implement the 
appropriate requirements and regulatory provisions under section 
1874(e) of the Act.

A. Considerations for the Definition, Eligibility Criteria, and 
Operating Requirements of Qualified Entities

1. Definitions
    Section 1874(e)(1) of the Act requires the Secretary to make 
available to qualified entities data for the evaluation of the 
performance of providers of services and suppliers, as proposed at 
Subpart G of this proposed rule. Section 1874(e)(2) of the Act defines 
a qualified entity as a public or private entity that:
     Is qualified (as determined by the Secretary) to use 
claims data to evaluate the performance of providers of services and 
suppliers on measures of quality, efficiency, effectiveness, and 
resource use; and
     Agrees to meet the requirements described in section 
1874(e)(4) of the Act and meets such other requirements as the 
Secretary may specify, such as ensuring security of data.
    We have proposed a definition that is consistent with these 
statutory provisions at 42 CFR 401.702(a). Specifically, we have 
defined a qualified entity as a public or private entity that: (1) is 
qualified, as determined by the Secretary, to use claims data to 
evaluate the performance of providers of services and suppliers on 
measures of quality, efficiency, effectiveness, and resources use, and 
(2) agrees to meet the requirements of the Act and meets stated 
regulatory requirements at Sec. Sec.  401.703 through 401.710.
2. Eligibility Criteria
    As amended, section 1874(e)(2)(A) of the Act provides the Secretary 
with discretion to establish criteria to determine whether an entity is 
qualified to use claims data to evaluate the performance of providers 
of services and suppliers. In determining the qualified entity 
eligibility requirements, we sought to balance the need to ensure the 
production of timely, high quality, usable reports on providers of 
services and suppliers with the need to protect the privacy and 
security of beneficiary identifiable data and the need to ensure 
providers of services and suppliers have the opportunity to review the 
reports, appeal, and correct errors prior to public release.
    We are proposing at Sec.  401.703 to evaluate an organization's 
eligibility qualifications across three areas: organizational and 
governance capabilities, addition of claims data from other sources, 
and data privacy and security. In determining an applicant's 
eligibility, potential qualified entities would be evaluated 
individually to ensure they are prepared to meet the requirements in 
the statute for serving as a qualified entity. We are not planning to 
limit the number of qualified entities. Any entity that meets the 
eligibility criteria would be able to become a qualified entity.
a. Organizational and Governance Capabilities
    Section 1874(e)(2)(A) of the Act gives the Secretary the authority 
to establish the criteria to determine whether an entity is qualified 
to fulfill the requirements of the statute. We propose to thoroughly 
evaluate potential qualified entities on their organizational and 
governance capabilities to perform all of the following tasks:
     Accurately calculating quality, efficiency, effectiveness, 
and resource use measures from claims data, including:
    [cir] Identifying an appropriate method to attribute a particular 
patient's services to specific providers of services and suppliers.
    [cir] Ensuring the use of approaches to ensure statistical validity 
such as a minimum number of observations or minimum denominator for 
each measure.
    [cir] Using methods for risk-adjustment to account for variation in 
both case-mix and severity among providers of services and suppliers.
    [cir] Identifying methods for handling outliers.
    [cir] Correcting measurement errors and assessing measure 
reliability.
    [cir] Identifying appropriate peer groups of providers and 
suppliers for meaningful comparisons.
     Successfully combining claims data from different payers 
to calculate performance reports.
     Designing, and continuously improving the format of 
performance reports on providers of services and suppliers.
     Preparing an understandable description of the measures 
used to evaluate the performance of providers of services and suppliers 
so that consumers, providers of services and suppliers, health plans, 
researchers, and other stakeholders can assess performance reports.
     Implementing and maintaining a process for providers of 
services and suppliers identified in a report to review the report 
prior to publication, and providing timely responses to provider of 
services and supplier inquiries regarding requests for data, error 
correction, and appeals.
     Establishing, maintaining, and monitoring a rigorous data 
privacy and security program, including disclosing to CMS in its 
application any inappropriate disclosures of beneficiary identifiable 
information or HIPAA violations for the preceding 10-year period, and 
any corrective actions taken to address such issues.
     Accurately preparing performance reports on providers of 
services and suppliers and making performance report information 
available to the public in aggregate form, that is, at the provider of 
services or supplier level.
    Applicants would generally be expected to demonstrate expertise and 
sustained experience on each of these criteria. Generally, an applicant 
would be considered to have demonstrated expertise and sustained 
experience on these criteria if the applicant can show that it has been 
handling claims data and calculating performance measures for a period 
of at least three years. We believe that to be a successful qualified 
entity, an applicant would need to have an established track record of 
profiling providers of services and suppliers. However, we propose to 
consider applicants with fewer years of experience in handling claims 
data and calculating performance measures, or limited experience 
implementing and maintaining a process for providers of services and 
suppliers to request error correction if the applicant has sufficient

[[Page 33568]]

experience in the other areas described above. In all other areas, 
applicants must demonstrate expertise and sustained experience as 
stated above. We seek comment on our approach to evaluating qualified 
entities, and whether three years of demonstrated expertise is 
sufficient to ensure that only the highest quality entities are 
admitted to this program.
    We note that several of the tasks that are required of the 
qualified entities necessitate expertise and careful attention to the 
required processes as outlined below. Due to the importance of ensuring 
that the qualified entity is able to achieve the goals of the program, 
we wish to ensure that the qualified entities have the resources to 
meet their obligations to measure providers of services and suppliers 
and publish reports under the statute. Therefore, we propose that 
qualified entity applicants would also need to submit a description of 
the business model they plan to use for covering the costs of 
performing the required functions listed below, including paying the 
fee for the data. We solicit comment on our proposal.
b. Addition of Claims Data From Other Sources
    Section 1874(e)(1) and Section 1874(e)(3) of the Act require the 
Secretary to provide standardized extracts of claims data under 
Medicare Parts A, B, and D for one or more specified geographic areas 
and time periods to qualified entities so they can use the information 
in concert with other claims data to evaluate the performance of 
providers and suppliers. As discussed in section II.B. below, the 
qualified entities are to evaluate the performance of providers of 
services and suppliers using measures that may be calculated from the 
claims data only. At Sec.  401.702(d), we propose to define claims 
data, whether from Medicare claims or other sources, to be 
administrative claims data only, meaning, itemized billing statements 
from providers of services and suppliers that, except in the context of 
Part D drug event data, request reimbursement for a list of services 
and supplies that were provided to a Medicare beneficiary in the fee-
for-service context or to a participant in another insurance or 
entitlement program. Claims data would need to have characteristics and 
variables similar to the data discussed in section II.C. below. Data 
from other sources, such as registry data, chart abstracted data, or 
data from electronic medical records would not be considered claims 
data.
    Section 1874(e)(4)(B)(iii) of the Act requires qualified entities 
to combine Medicare data made available under this section with claims 
data from sources other than Medicare in their performance evaluations 
of providers of services or suppliers. We believe that this provision 
was intended to make Medicare data available to those already working 
with other claims data in order to increase sample sizes used to 
calculate measures and evaluate the performance of providers of 
services and suppliers. This belief is based on past experiences where 
measurement entities have expressed an interest in obtaining Medicare 
data to combine with other claims data to improve the population sample 
upon which their performance findings are based, and to address 
concerns expressed by stakeholders regarding small sample sizes in 
performance reports generated from a single payer source. The relative 
size of Medicare enrollment makes it one of the largest payers in any 
given market.
    In addition, since Medicare serves an older population with 
declining health, using claims data from Medicare would provide more 
opportunities to assess care provided to the chronically ill and other 
resource-intensive populations than is found in other claims data. The 
goal expressed by those seeking this data in the past has been that 
Medicare data, when coupled with other claims data, can provide 
measurement initiatives with greatly increased sample sizes upon which 
to calculate more reliable performance results.
    The statute requires the inclusion of claims data from other 
sources, but it does not specify a minimum amount of such data to 
qualify as a qualified entity. CMS has considered how to best ensure 
that Medicare data is combined with a sufficient amount of other claims 
data to meaningfully address some of the concerns regarding sample size 
and reliability outlined above. We are proposing at Sec.  401.703(a)(2) 
that applicants demonstrate to CMS that the claims data from other 
sources, which they are combining with Medicare data, addresses the 
concerns regarding sample size and reliability expressed by multiple 
stakeholders regarding the calculation of performance measures from a 
single payer source. In order to ensure that Medicare data is only made 
available to qualified entities that have additional claims data from 
other sources, applicants would not be approved as qualified entities 
unless they possess the claims data from other sources at the time of 
their application, and that data meets the requirements outlined above.
    We considered imposing a specific threshold amount of additional 
claims data, but we believe that it would be difficult to precisely 
establish a threshold amount of data to address concerns about small 
sample sizes and reliability. We are requesting comments on this policy 
decision, as well as suggestions for other possible options or 
alternatives. We are also considering a proposal to require qualified 
entities to have claims data from two or more other sources. For 
example, a qualified entity would need to have claims data from two 
private payers, or one private payer and Medicaid claims data, in order 
to be eligible to receive Medicare data. We believe that a requirement 
for claims data from two or more other sources may help further 
alleviate some of the methodological issues associated with performance 
measurement based on single-source data. Measurement of a provider of 
services or supplier based on one other source plus Medicare may still 
not represent enough of a provider of services' or supplier's patient 
population to provide meaningful data that would help improve 
performance. We are considering a proposal to require claims data from 
two or more other sources to ensure that performance reports produced 
by qualified entities are as fair a representation as possible of any 
provider of services' or suppliers' practice to encourage behavior 
change. We seek comments on this alternative proposal of requiring 
claims data from two or more other sources to be combined with Medicare 
claims data, and whether there are particular challenges associated 
with requiring claims data from multiple sources before a qualified 
entity can participate in this program.
c. Data Privacy and Security
    It is of the utmost importance to CMS that beneficiary identifiable 
Medicare data remain private and secure. Section 1874(e)(3) of the Act 
requires the Secretary to take actions necessary to protect the 
identity of individuals entitled to or enrolled in our programs.
    In order to fulfill this obligation, we are proposing at Sec.  
401.703(a)(3) to require that applicants demonstrate that they have 
rigorous privacy and security practices in place to protect the data 
released to them and have programs in place to train staff on data 
privacy protections and general data security protocols. Applicants 
would not be eligible to serve as qualified entities unless CMS 
determines that they have thoroughly documented data privacy and 
security practices including enforcement mechanisms. The data privacy 
and security requirements for qualified entities are discussed in 
detail at Section II.D.

[[Page 33569]]

3. Proposed Operating and Governance Requirements for Serving as a 
Qualified Entity
    CMS recognizes that applicants may not have fully developed plans 
for every aspect of serving as a qualified entity; however, there are 
key aspects that we believe are important enough to require the 
submission of proposed plans as a condition of being approved as a 
qualified entity. Specifically, we propose at Sec.  401.704 that 
applicants would submit, as part of their application: (1) The measures 
they intend to use, including, among other things, the methods of 
creating and disseminating reports; (2) the report review process they 
would use to afford providers of services and suppliers with reports 
confidentially prior to public release, including addressing report 
recipient requests for data and for error correction; (3) a prototype 
for the required reports, including any narrative language, and 
dissemination plans for providing reports to the public. Additional 
information regarding the application requirements may be found in 
section II.G. below.

B. Considerations for the Definition, Selection, and Use of Performance 
Measures by Qualified Entities

    Section 1874(e)(2)(A) of the Act requires qualified entities be 
qualified to use claims data to evaluate the performance of providers 
of services and suppliers using measures of quality, efficiency, 
effectiveness, and resource use. Specifically, section 
1874(e)(4)(B)(ii)(I) of the Act requires qualified entities requesting 
standardized extracts of Medicare claims to use standard measures, if 
available, such as measures endorsed by the entity with a contract 
under section 1890(a) of the Act, and measures developed pursuant to 
section 931 of the Public Health Service Act. Section 
1874(e)(4)(B)(ii)(II) of the Act also provides for the use of 
alternative measures by qualified entities if the Secretary, in 
consultation with appropriate stakeholders, determines that use of such 
alternative measures would be more valid, reliable, responsive to 
consumer preferences, cost-effective, or relevant to dimensions of 
quality and resource use not addressed by the standard measures. 
Qualified entities may only use standard or approved alternative 
measures to evaluate the performance of providers of services and 
suppliers using claims data from Medicare parts A, B, or D.
1. Proposed Definition of, and Process for Identifying and Approving 
Standard Measures for Use by Qualified Entities
    For purposes of a qualified entity selecting and using measures to 
evaluate the performance of providers of services and suppliers, we 
propose to define at Sec.  401.708(a) a ``standard measure'' to be a 
measure that can be calculated using only claims data and that is--(1) 
endorsed by the entity with a contract under section 1890(a) of the 
Act; (2) developed pursuant to section 931 of the Public Health Service 
Act; or (3) was adopted through notice and comment rulemaking and is 
currently being used in a CMS program that includes performance 
measurement, even if it is not endorsed by the entity with a contract 
under section 1890(a) of the Act.
    Currently, the entity with a contract under section 1890(a) of the 
Act is the National Quality Forum (NQF). NQF uses its formal Consensus 
Development Process to evaluate and endorse consensus standards, 
including performance measures, on an ongoing basis. It is viewed as a 
trusted partner in ensuring that any nationally endorsed provider of 
services and supplier performance measures are subject to rigorous 
multi-stakeholder scrutiny to ensure they are scientifically valid, 
address clear performance improvement needs and can be calculated in a 
manner that does not impose undue burden on providers and suppliers. 
There are currently hundreds of NQF-endorsed quality measures covering 
a range of clinicians, settings, and specialties, although not all of 
these measures can be calculated using only claims data.
    A list of currently NQF-endorsed performance measures can be 
obtained from the NQF Web site at http://www.qualityforum.org/Measures_List.aspx. We propose to define any measure endorsed by the 
entity with a contract under section 1890(a) of the Act which can be 
calculated from standardized extracts of Medicare parts A, B, or D 
claims as a standard measure. In addition to endorsed NQF measures, we 
propose to also define a measure which can be calculated from 
standardized extracts of Medicare parts A, B, or D claims data that has 
time-limited NQF endorsement as a standard measure. Measures that are 
time-limited endorsed that were not developed pursuant to section 931 
of the Public Health Service Act, or that are being used by a CMS 
program that includes performance measurement, would only be considered 
standard measures until such time as the NQF determines their 
endorsement status. Time-limited endorsed measures that ultimately 
receive endorsement would remain standard measures for as long as they 
remain endorsed, and time-limited endorsed measures that do not 
ultimately receive endorsement would lose their status as standard 
measures unless they were developed pursuant to section 931 of the 
Public Health Service Act, or can be calculated from standardized 
extracts of Medicare parts A, B, or D claims data, were adopted through 
notice and comments rulemaking, and are being used in a CMS program 
that includes quality measurement. Time-limited measures that do not 
receive NQF endorsement and that were not developed pursuant to Section 
931 of the Public Health Act, or are not used in a CMS program that 
includes performance measurement could however, be submitted for 
approval as alternative measures through the alternative measure 
process outlined below at II.B.2.
    Section 931 of the Public Health Service Act, as added by Section 
3013 of the Affordable Care Act supports the development, improvement, 
update, or expansion of quality measures for use in Federal health 
programs. To date, no measures have been developed under this 
provision. We propose that any measures developed or updated under this 
provision would also be considered standard measures regardless of 
their NQF endorsement status, as long as the measures can be calculated 
from the standardized extracts of Medicare parts A, B, and D claims 
data available to the qualified entity.
    We also propose to include in the definition of standard measure 
any measure that was adopted through notice and comment rulemaking and 
that is currently used in a CMS program that involves performance 
measurement, even if it is not NQF-endorsed or developed under section 
931 of the Public Health Service Act, as long as the measure can be 
calculated from the standardized extracts of Medicare parts A, B, and D 
claims data available to the qualified entity. For example, several 
measures in the hospital Inpatient Quality Reporting program beginning 
in FY 2012 (foreign object retained after surgery, air embolism, 
catheter-associated urinary tract infection, blood incompatibility, 
pressure ulcer stages III and IV, falls and trauma, manifestations of 
poor glycemic control, and vascular catheter associated infection) fit 
this criteria.
    The notice and comment rulemaking process includes a public comment 
period in which stakeholders are able to express their views regarding 
the proposed measures. Measures

[[Page 33570]]

implemented via the rulemaking process are not finalized until the 
public comment period closes, the comments are reviewed and considered, 
and a final rule is published. Because the notice and comment 
rulemaking process involves extensive opportunity for public input, we 
believe that measures used in CMS programs, regardless of whether they 
are endorsed by the NQF or developed under section 931 of the Public 
Health Service Act, have been subjected to sufficient scrutiny that 
they can be considered standard measures. We propose to make a list of 
measures that meet the requirements of being adopted through notice and 
comment rulemaking and currently being used in a CMS program that 
includes performance measurement, available in subregulatory guidance.
    In using any standard measure, we propose to require that the 
qualified entity must follow the measure specifications as written, 
including all numerator and denominator inclusions and exclusions, 
measured time periods, and specified data sources. We recognize that 
some measure specifications may require additional customization to 
implement in specific contexts, but such customization should not 
change the defined numerator, denominator, and exclusion criteria for 
the measure.
    We invite comments on the proposed definition of standard measures 
and the proposed requirement for qualified entities to follow the 
measure specifications as written.
2. Proposed Definition of, and Process for Identifying and Approving 
Alternative Measures for Use by Qualified Entities
    We also recognize that a qualified entity may wish to measure 
performance in an area for which there are no standard measures. We 
note that there are several areas of performance measurement with very 
few available measures that meet the definition of a standard measure 
as proposed above. We hope to encourage innovation in the development 
of new claims-based measures to evaluate the performance of providers 
of services and suppliers through the use of alternative measures. 
While the statute does not require the Secretary to allow the use of 
alternative measures, we believe that allowing qualified entities to 
propose the use of alternative measures encourages the development of 
additional claims-based performance measures.
    For qualified entities wishing to use alternative measures, we 
propose to adopt an alternative measure selection process through 
future notice and comment rulemaking that would subject proposed 
alternative measures to public comment after qualified entities propose 
candidate alternative measures for the Secretary's consideration. At 
Sec.  401.708(b)(1), we propose to define ``alternative measure'' as a 
measure that is not a standard measure, but that can be calculated 
using only standardized extracts of Medicare parts A, B, and D claims, 
and that has been found by the Secretary to be more valid, reliable, 
responsive to consumer preferences, cost effective, or relevant to 
dimensions of quality and resource use not addressed by standard 
measures.
    As discussed above, section 1874(e)(4)(B)(ii)(II) of the Act 
permits the use of alternative measures if the proposed alternative 
measure is more valid, reliable, responsive to consumer preferences, 
cost-effective, or relevant to dimensions of quality and resource use 
than existing claims-based standard measures. If there is a claims-
based standard measure for the clinical area or topic(s) that the 
qualified entity chooses to measure, we propose that the qualified 
entity must use the standard measure in lieu of any alternative 
measures, unless the qualified entity can provide detailed scientific 
justification for asserting that the proposed alternative measure in 
that clinical area or topic is more valid, reliable, responsive to 
consumer preferences, cost-effective, or relevant to dimensions of 
quality and resource use than the existing claims-based standard 
measure, and such assertions are accepted through the notice and 
comment rulemaking process outlined below.
    Similarly, in the case where a standard measure was not previously 
available for a particular clinical area or condition, but such a 
measure subsequently becomes available, we propose that qualified 
entities must cease use of the alternative measure and switch to the 
standard measure within 6 months (for example, if a standard measure 
becomes available in February 2013, either through being endorsed by 
the entity with a contract under section 1890(a) of the Act, developed 
pursuant to section 931 of the Public Health Service Act, or adopted 
through notice and comment rulemaking to be used in a CMS program that 
includes performance measurement, qualified entities would have to 
begin using the standard measure instead of the alternative measure in 
any reports by August 2013). If the qualified entity wishes to continue 
to use the alternative measure, then it must provide the scientific 
justification outlined above to obtain approval for the use of 
alternative measures when a standard measure for the clinical area or 
condition(s) that the qualified entity chooses to measure is available.
    In order to provide us with the information necessary to determine 
whether an alternative measure is more valid, reliable, responsive to 
consumer preferences, cost-effective, or relevant to dimensions of 
quality and resource use not addressed by the standard measures as 
required by section 1874(e)(4)(B)(ii)(II) of the Act, we propose that 
the qualified entity would need to submit to the Secretary the 
following information about a proposed alternative measure:
     The name of the alternative measure that the qualified 
entity is requesting the Secretary to consider as an alternative 
measure.
     The name of the alternative measure's developer or owner.
     Detailed specifications for the alternative measure.
     Information demonstrating how the alternative measure is 
more valid, reliable, responsive to consumer preferences, cost-
effective, or relevant to dimensions of quality and resource use not 
addressed by standard measures.
    We solicit comments on our proposals regarding alternative 
measures, and we welcome comments on whether any additional information 
regarding proposed alternative measures should be required in order to 
request the Secretary's consideration of a candidate alternative 
measure.
    Section 1874(e)(4)(B)(ii)(II) of the Act further requires the 
Secretary to review the candidate alternative measures in consultation 
with appropriate stakeholders in order to determine if an alternative 
measure would be more valid, reliable, responsive to consumer 
preferences, cost-effective or relevant to dimensions of quality and 
resource use not addressed by standard measures. In order to obtain 
consultation with appropriate stakeholders, we propose that once all 
qualified entities have submitted the above information regarding a 
proposed alternative measures, we would use the notice and comment 
rulemaking process to obtain public comment on approving the measures 
as alternative measures. We solicit comment on our proposal to engage 
in consultation with appropriate stakeholders through notice and 
comment rulemaking and we also welcome comments on alternative 
processes to consider for meeting the stakeholder consultation 
requirement.
    The statute requires the Secretary to make the final determination 
regarding whether an alternative measure is more valid, reliable, 
responsive to consumer

[[Page 33571]]

preferences, cost-effective, or relevant to dimensions of quality and 
resource use not addressed by standard measures. The Secretary would 
consider the information received from the qualified entity and other 
stakeholders during the notice and comment rulemaking process in order 
to determine whether a proposed alternative measure meets the statutory 
criteria for approval as an alternative measure. Once an alternative 
measure has been approved by the Secretary, the alternative measure 
would be available for use by all qualified entities, not just the 
submitting entity.
    Any measure that is not approved as an alternative measure may not 
be used to evaluate the performance of providers of services and 
suppliers using data from the qualified entity program. In the event 
additional information is available for an alternative measure that was 
previously denied approval, the alternative measure may be resubmitted 
to the Secretary for consideration.
    Because our proposals for the approval process of alternative 
measures would require notice and comment rulemaking, it would be 
logistically challenging for alternative measures to be approved in 
time to enable measure calculation and reporting of alternative 
measures in the first year of the program. While qualified entities 
would be able to submit alternative measures for consideration during 
the first year of the program, the approval process would likely not 
conclude in time to use the alternative measure in the first year of 
the program.
    Depending on the volume and timing of alternative measure 
submissions, we anticipate conducting the notice and comment rulemaking 
process on an annual basis. We are proposing to establish an annual 
deadline of May 31 for the submission of proposed alternative quality 
measures in order to allow for the measures to go through notice and 
comment rulemaking prior to the start of the next calendar year. The 
notice and comment rulemaking period generally takes 6 months from the 
publication of a proposed rule to the effective date of a final rule, 
so the alternative measures submitted by May 31 would be ready for use 
in the following calendar year, i.e., a measure submitted by May 31, 
2012 would be available for calendar year 2013. If no proposed 
alternative measures are received by the annual deadline, we would not 
publish a rule. Proposed alternative measures submitted after the 
annual deadline would be considered for rulemaking during the following 
calendar year.
    We believe this proposed approach is adequate because:
     We have proposed an expansive definition of what 
constitutes a standard measure (including non-NQF endorsed measures 
which can be calculated from standardized extracts of Medicare parts A, 
B, and D claims if they were adopted through notice and comment 
rulemaking and are currently being used in CMS programs that include 
quality measurement), and this would greatly increase the number of 
standard measures available for use by qualified entities.
     It is appropriate for qualified entities to focus on well 
established measures that are either NQF-endorsed or used in CMS 
programs in their first year of operation as qualified entities.
    We solicit comment on our proposals regarding the approval process 
for alternative measures.
    As with standard measures, when using an alternative measure 
approved by the Secretary, we propose to require that the qualified 
entity follow the measure specifications as written, including all 
numerator and denominator inclusions and exclusions, measured time 
periods, and specified data sources. We recognize that some measure 
specifications may require additional customization to implement the 
measure in specific contexts, but such customization should not change 
the defined numerator, denominator, and exclusion criteria for the 
measure. We invite comments on the proposed requirement for qualified 
entities to follow the measure specifications as written.
3. Selection and Justification of Measures by Qualified Entities
    We propose, at Sec.  401.704(a), to require that qualified entities 
provide a description of each standard or alternative measure they plan 
to use to calculate the performance of providers of services and 
suppliers as part of their application. This description should include 
the name of the measure, the name of the measure developer/owner, and 
the measure specifications including the numerator and the denominator. 
In addition, we propose to require an explanation of the applicant's 
rationale for selecting the measure, which would include a description 
of the relationship of any proposed measure (standard or alternative) 
to existing measurement efforts, and the relevancy of each proposed 
measure to the population(s) in the geographic area(s) the applicant is 
proposing to serve. The rationale would also include a specific 
description of the geographic area(s) the applicant intends to serve 
and a specific description of how each measure evaluates providers of 
services and suppliers on quality, efficiency, effectiveness, and/or 
resource use. Finally, we propose to require an applicant to provide a 
description of the methodologies it intends to use in creating reports 
with respect to attribution of beneficiaries to providers of services 
and suppliers, benchmarking performance data, and severity and case-mix 
adjustments.
    We propose at Sec.  401.706(a)(1) to allow a qualified entity to 
calculate and report measures that were not included in its initial 
application if the qualified entity submits the information described 
above about the additional measure(s) to CMS no less than ninety (90) 
days prior to the anticipated date for the confidential distribution of 
reports using those measures to providers of services and suppliers. We 
would review this information and approve or disapprove the use of the 
measure. We propose barring qualified entities from using a measure 
that has not been approved by CMS, even if CMS' review takes longer 
than ninety days.
4. Methodologies Used in Performance Reports
    Section 1874(e)(4)(B)(I) of the Act requires qualified entities to 
submit a description of the methodologies that they would use to 
evaluate the performance of providers services and suppliers. In 
keeping with this requirement, we have proposed Sec.  401.704(a)(5), 
which requires an applicant to submit a description of methodologies it 
intends to use in creating reports. We believe, however, that a review 
of methodologies is inadequate in the absence of a review of the 
abilities of the qualified entity to appropriately apply those 
methodologies. Therefore, we propose at Sec.  401.703(a)(1) that in 
order to be eligible to serve as a qualified entity, applicants must 
demonstrate expertise and sustained experience in several areas 
necessary for performance measurement.
5. Reports and Reporting
    Section 1874(e)(4)(C)(ii) of the Act requires qualified entities to 
make their draft reports available in a confidential manner to 
providers of services and suppliers identified in the reports before 
such reports are released publicly in order to offer them an 
opportunity to review these reports, and, if appropriate, appeal to 
request correction of any errors. We propose to require the qualified 
entities to include a plan for establishing and maintaining these 
appeal and correction processes in their

[[Page 33572]]

application materials, as we have stated in proposed Sec.  401.704(b). 
The plan must clearly describe how the qualified entity would make 
providers of services and suppliers aware of the process and establish 
procedures, including timeframes, for how providers of services and 
suppliers can request data from the qualified entity and request error 
corrections in the reports before the reports are made public.
    After reports have been shared confidentially with providers of 
services and suppliers, and any errors have been corrected, Section 
1874(e)(4)(C)(iv) of the Act requires the reports to be made available 
to the public. As discussed further below in Section II.E., in cases 
where provider requests for error correction cannot be resolved prior 
to a date specified by the qualified entity (at least 30 business days 
after the report was originally shared with providers of services and 
suppliers), the reports would be released publically with information 
that a provider of services or supplier error correction is ongoing. As 
stated in the statute at Section 1874(e)(4)(C)(iii) of the Act, the 
reports must include ``an understandable description'' of the measures, 
rationale for use, methodology (including risk-adjustment and physician 
attribution), data specifications and limitations, and sponsors. We 
interpret ``an understandable description'' to mean any descriptions 
that can be easily read and understood by a lay person. Additionally, 
the reports to the public may only include data on providers of 
services or suppliers at the provider of services or supplier level 
with no claim or person-level information to ensure beneficiary 
privacy.
    Pursuant to Section 1874(e)(4)(B)(vi) of the Act, we propose 
requiring qualified entities to submit prototype reports for both the 
reports they would send to providers of services and suppliers, and the 
reports they would release to the public (if they are different) in 
their application, including the narrative language they plan to use in 
the reports to describe the data and results. The prototype report 
should also contain an easily comprehensible description of the 
proposed measures, the rationale for the use of those measures, a 
description of the methodologies to be used, and a description of the 
data specifications and limitations.
    We have given extensive consideration to when in the process 
qualified entities should submit these prototype reports to CMS. One 
option would be for qualified entities to submit prototype reports with 
their applications to become qualified entities. As outlined above, one 
of the eligibility criteria for qualified entities is demonstrated 
expertise and experience in designing, disseminating, and continuously 
improving performance reports to providers of services and suppliers. 
Given this criteria, it seems reasonable to assume that qualified 
entities would be in a position to provide CMS with prototype reports 
at the time of their applications.
    A countervailing argument would be that qualified entities may need 
some time working with Medicare data and claims data from other sources 
before they would be in a position to identify an appropriate format 
for the required performance reports. This scenario would support 
requiring the submission of the prototype report sometime after an 
organization has been approved as a qualified entity, but at a time 
prior to the confidential release to providers of services and 
suppliers. Under this scenario, the qualified entity would receive 
Medicare data without having to demonstrate that they had considered 
how they could use that data to produce measure results.
    While we believe that qualified entities may identify changes that 
would be necessary as they work with the data, we believe that it is 
appropriate to expect that they have sufficiently considered these 
reporting obligations as they consider their desires to apply for 
qualified entity status, and that such considerations would include at 
least an initial concept of what they could provide in the reports. 
Therefore, despite the concern that qualified entities would need some 
time with the data to identify the appropriate format for reports, we 
believe that qualified entities should have the expertise and skills to 
be able to submit prototype reports at the time of their applications 
to become qualified entities.
    In recognition of the advances that could be made to these 
prototypes as the qualified entities work, we propose, at Sec.  
401.706(a)(2), providing for a process whereby they can modify the 
initial prototypes as long as these modifications are submitted to, and 
approved by, CMS. We propose requiring these submissions no less than 
90 days prior to the confidential release of report to providers of 
services and suppliers. We would review the modified prototype report 
and make a determination regarding the use of the new report. This 
determination would be based on the extent to which the proposed 
changes make the description of the measures used in the report more 
understandable. We propose barring qualified entities from using a 
report that has not been approved by CMS, even if CMS' review takes 
longer than 90 days.
    In addition, we propose to require the submission of plans for 
making the reports available to the public at the time of application. 
To the extent that the report formats or delivery mechanisms differ 
from those proposed at the time of application, we propose to also 
require an explanation and justification of those differences no less 
than 90 days prior to the release of differing report formats or 
delivery mechanisms.
    Finally, at Sec.  401.705(d) we propose requiring qualified 
entities to produce reports on the performance of providers of services 
and suppliers at a minimum of at least once a year. If CMS provides 
qualified entities with yearly updates to the data, as discussed below, 
we believe qualified entities should be expected to use the updates to 
produce performance reports. We seek comments on these proposals.

C. Data Extraction and Dissemination

    Section 1874(e)(3) of the Act requires the Secretary to provide 
qualified entities with standardized extracts of claims data from 
Medicare parts A, B, and D for one or more specified geographic areas 
and time periods. These data extracts would include information from 
all seven claim types that are submitted for payment in the Medicare 
Fee-For-Service Program. Information extracted from institutional 
claims includes inpatient hospital, outpatient hospital, skilled 
nursing facility, home health, and hospice services. Information 
extracted from non-institutional claims includes physician/supplier and 
durable medical equipment claims. These files contain only final action 
claims, meaning non-rejected claims for which a payment has been made. 
All disputes and adjustments have been resolved and details clarified.
    Medicare institutional and non-institutional claims include, but 
are not limited to, the following data elements: beneficiary ID, claim 
ID, the start and end dates of service, the provider or supplier ID, 
the principal procedure and diagnosis codes, the attending physician, 
other physicians, and the claim payment type.
    Qualified entities would also be eligible to receive certain Part D 
claims information for beneficiaries enrolled in the Medicare Fee-For-
Service Program. This type of information is known as ``drug event'' 
information, as opposed to ``claims'' information, because prescription 
drug coverage under Part D is provided by private insurance plans.

[[Page 33573]]

These plans have varied pricing methods, and often pay capitated rates. 
We note that the use of the term ``drug event'' does not mean this 
database includes information about adverse reactions to drugs. The key 
data elements for this database include: beneficiary ID, prescriber ID, 
drug service date, drug product service ID, quantity dispensed, days' 
supply, gross drug cost brand name, generic name, drug strength, and 
indication if the drug is on the formulary of the Part D plan.
    All claims files would contain a unique encrypted beneficiary 
identification number that would allow a qualified entity to link 
claims for an individual beneficiary. These files would not contain the 
actual beneficiary Medicare Health Insurance Claim Number.
    A comprehensive record layout for all three of these databases is 
offered at http://www.ccwdata.org/variables/var_claim_files.php for 
institutional claims, http://www.ccwdata.org/variables/var_claim_files2.php for non-intuitional claims, and http://www.ccwdata.org/variables/var_ptd_event.php for Part D drug events.
    The institutional claims database includes the following files:
    Inpatient claim file: The Inpatient claim file contains final 
action claims data submitted by inpatient hospital providers for 
reimbursement of facility costs. Some of the information contained in 
this file includes diagnosis, (ICD-9 diagnosis), procedure (ICD-9 
procedure code), Medicare Severity--Diagnosis Related Group (MS-DRG), 
dates of service, reimbursement amount, and hospital provider 
information. Each observation in this file is at the claim level.
    Skilled Nursing Facility claim file: The Skilled Nursing Facility 
(SNF) claim file contains final action claims data submitted by SNF 
providers. Some of the information contained in this file includes 
diagnosis and procedure (ICD-9 diagnosis and ICD-9 procedure code), 
dates of service, reimbursement amount, and SNF provider number. Each 
observation in this file is at the claim level.
    Outpatient claim file: The Outpatient claim file contains final 
action claims data submitted by institutional outpatient providers. 
Examples of institutional outpatient providers include hospital 
outpatient departments, rural health clinics, renal dialysis 
facilities, outpatient rehabilitation facilities, comprehensive 
outpatient rehabilitation facilities, and community mental health 
centers. Some of the information contained in this file includes 
diagnosis and procedure (ICD-9 diagnosis, Healthcare Common Procedure 
Coding System (HCPCS) codes), dates of service, reimbursement amount, 
outpatient provider number, and revenue center codes. Each observation 
in this file is at the claim level.
    Home Health Agency claim file: The Home Health Agency (HHA) claim 
file contains final action claims data submitted by HHA providers. Some 
of the information contained in this file includes the number of 
visits, type of visit (skilled-nursing care, home health aides, 
physical therapy, speech therapy, occupational therapy, and medical 
social services), diagnosis (ICD-9 diagnosis), dates of visits, 
reimbursement amount, and HHA provider number. Each observation in this 
file is at the claim level.
    Hospice claim file: The Hospice claim file contains final action 
claims data submitted by Hospice providers. Some of the information 
contained in this file includes the level of hospice care received (for 
example, routine home care, inpatient respite care), terminal diagnosis 
(ICD-9 diagnosis), dates of service, reimbursement amount, and Hospice 
provider number. Each observation in this file is at the claim level.
    The non-institutional claims database includes the following files:
    Carrier claim file: The Carrier claim file contains final action 
claims data submitted by non-institutional providers. Examples of non-
institutional providers include physicians, physician assistants, 
clinical social workers, nurse practitioners, independent clinical 
laboratories, ambulance providers, and free-standing ambulatory 
surgical centers. Some of the information contained in this file 
includes diagnosis and procedure (ICD-9 diagnosis, Healthcare Common 
Procedure Coding System (HCPCS) codes), dates of service, reimbursement 
amount, and non-institutional provider numbers (for example, UPIN, PIN, 
NPI). Each observation in this file is at the claim level.
    Durable Medical Equipment claim file: The Durable Medical Equipment 
(DME) claim file contains final action claims data submitted by Durable 
Medical Equipment suppliers. Some of the information contained in this 
file includes diagnosis, (ICD-9 diagnosis), services provided 
(Healthcare Common Procedure Coding System (HCPCS) codes), dates of 
service, reimbursement amount, and DME provider number. Each 
observation in this file is at the claim level.
    The Part D database includes the following file:
    Drug Event Database: The drug event database includes the 
following: encrypted beneficiary identifier, date of service, drug 
product dispensed, drug quantity, number of days supply of product, 
drug costs, beneficiary and other payer cost-sharing, formulary tier 
and utilization management, Part D benefit phase, encrypted pharmacy 
identifier, encrypted prescriber identifier, and encrypted plan 
identifier.
    We plan to provide identical standard data extracts to all 
qualified entities, that is, all extracts would include the same data 
elements and the same record layout. CMS does not plan to provide any 
customized data files to qualified entities under section 1874(e) of 
the Act. It would be the responsibility of the qualified entities to 
create customized analytical files and databases to support their 
calculation of performance measures for providers of services and 
suppliers.
    We seek comment on whether qualified entities would require any 
technical assistance to aid in understanding and working with Medicare 
data, what type of technical assistance would be beneficial, and 
whether we should include technical assistance in the fee charged for 
the data (see Section II.C.3. below). We plan to encourage the 
development of a voluntary knowledge sharing mechanism for qualified 
entities to communicate with each other regarding best practices for 
calculating measures, designing reports, and other important elements 
of this program. We seek comments on whether technical assistance is 
needed and how such a voluntary knowledge sharing mechanism would best 
be designed and operated.
1. Number of Years of Data
    Section 1874(e)(3) of the Act requires the Secretary to provide 
standardized extracts to qualified entities containing data from 
specific time periods. CMS is proposing to provide qualified entities 
with the most recent three years of Medicare data available at the time 
the qualified entity is approved for participation in the program. For 
example, if a qualified entity applies and is approved for 
participation in 2012, data for calendar years 2008, 2009, and 2010 
would be provided since they would be the most recent final action 
claims data available. Thereafter, CMS proposes to provide qualified 
entities with the most recent additional year of data on a yearly 
basis.

[[Page 33574]]

2. Geographic Areas
    Section 1874(e)(3) of the Act requires the Secretary to provide 
standardized extracts to qualified entities containing data for 
specific geographic areas. CMS is proposing that qualified entities 
receive standardized data extracts for a single geographic area or 
multiple regions. We propose to limit the provision of Medicare data to 
the geographic spread of the qualified entity's other claims data. For 
example, if a qualified entity has a sufficient amount of claims data 
from other sources (as determined by CMS during the application 
process) for people in Maryland, CMS would provide Medicare data for 
the state of Maryland.
    During the September 20, 2010 public listening session for section 
10332 of the Affordable Care Act, CMS received suggestions to release 
nationwide Medicare claims if the data are necessary for qualified 
entities to evaluate the performance of the providers of services and 
suppliers at a national level. In this proposed rule, we are requesting 
comments as to whether CMS should provide an option for the release of 
nationwide Medicare data. We specifically welcome comments regarding 
how the qualified entities would obtain a sufficient amount of non-
Medicare nationwide claims data to include in the evaluation of 
providers of services and suppliers and how the qualified entities 
would implement and manage a nationwide provider of services and 
suppliers confidential review and appeal process.
3. Cost To Obtain the Data
    Section 1874(e)(4)(A) of the Act requires qualified entities to pay 
a fee for obtaining the data that is equal to the cost of making such 
data available. We interpret the cost of making the data available 
broadly, to include the cost of providing the technical assistance 
(described above), the cost of processing qualified entities' 
applications, and the costs of monitoring qualified entities to ensure 
appropriate use of the data and appropriate adherence to data privacy 
and security standards. This monitoring may include, but is not limited 
to, periodic requests for documentation relating to privacy and 
security policies and procedures. The data fees would vary in 
accordance with the amount of data requested by the qualified entities. 
CMS would provide each prospective qualified entity with the actual 
cost of obtaining the data they request, and post on the CMS Web site 
examples of data requests and what each costs. However, based on our 
past experience providing Medicare data to research entities, we 
estimate that the approximate costs to provide three years of data for 
2.5 million beneficiaries to a qualified entity would be $200,000. 
Approximately $75,000 of the $200,000 is the cost of the claims data, 
while $125,000 is the cost of making the data available including the 
cost of processing applications and data requests, providing technical 
assistance, and monitoring. Therefore, to provide a qualified entity 
with three years of data for 5.0 million beneficiaries, the approximate 
costs would be $275,000 ($150,000 for the data and $125,000 for the 
program costs).
    Qualified entities would be expected to pay the fee annually. 
However, after the first year, costs would be lower since qualified 
entities would only be receiving one year of Medicare claims data. We 
solicit comment on the prospective fee amount and the ability of 
prospective applicants to pay it.
    We note that the creation and dissemination of nationwide extracts 
of Medicare data (mentioned above) would significantly increase the 
cost to any qualified entity seeking such nationwide data of obtaining 
and processing Medicare data. As stated above, we seek comment on the 
likelihood of a qualified entity having sufficient other claims data to 
meet the requirements to receive a nationwide extract of Medicare data.

D. Data Security and Privacy

    This provision creates a new program that provides for the release 
of Medicare beneficiary level data to private entities that are not 
enrolled in Medicare. We recognize that many approved qualified 
entities would be organizations with many years of experience in using 
claims data to produce performance reports on providers of services and 
suppliers, and, as such, may have existing agreements with private 
health plans who provide them data regarding the data security and 
privacy standards they must observe. While CMS is committed to ensuring 
the success of qualified entities in combining Medicare data with 
claims data from other sources to create comprehensive performance 
reports for providers of services and suppliers, CMS is also committed 
to ensuring that the beneficiary level data provided to qualified 
entities is subject to stringent security and privacy standards 
throughout all phases of the performance measure calculation, 
confidential reporting, appeal, and public reporting processes.
    In addition to the statutory requirements contained in section 
1874(e)(4) of the Act, qualified entities must meet any requirements 
that are adopted by the Secretary under section 1874(e)(2)(B) of the 
Act, which provides for the adoption of ``such other requirements as 
the Secretary may specify.'' In accordance with the explicit language 
of the statute, such ``other requirements'' may include security 
requirements for the data. Furthermore, section 1874(e)(3) of the Act 
requires the Secretary to take such actions as deemed necessary to 
protect the identity of individuals entitled to or enrolled in Medicare 
Parts A, B or D. As such, the Secretary is authorized to impose privacy 
and security requirements on qualified entities as a condition of 
participating in this program.
    We have considered whether qualified entities would require 
beneficiary identifiable data to calculate measures. As defined at 
Sec.  401.702(f) we interpret beneficiary identifiable data to mean 
data that permits a qualified entity to determine the name, or name and 
other direct identifying factors (for example, race, sex, age, address) 
of an individual beneficiary. If one approaches this issue purely from 
the point of view of the ability of qualified entities to engage in 
measure calculation and reporting, beneficiary identifiable data is not 
required. Qualified entities would be able to engage in measure 
calculation and reporting with files containing an encrypted 
beneficiary identifier. For this reason, we propose to include in any 
data files provided to qualified entities an encrypted beneficiary 
identifier that would permit linking of claims for the same beneficiary 
across multiple files and multiple years without identifying individual 
beneficiaries.
    While we realize that the statute permits providers of services and 
suppliers to request of qualified entities the Medicare claims data 
underlying their measure results, we anticipate that it would be 
difficult for providers of services and suppliers to identify errors in 
measurement in the absence of patient names. For example, a report from 
a qualified entity might indicate to a provider that only 50 percent of 
their assigned diabetic patients received recommended Hba1c tests in a 
given year. In the absence of patient names, we believe that it would 
be difficult for the provider to tell whether there were errors in how 
the measure result was calculated. Specifically, a provider may feel 
that there is an error in the underlying claims data that has 
inappropriately lowered their measure result. This could happen for a 
number of reasons. The provider may have conducted a Hba1c test but for 
some reason may not have submitted that

[[Page 33575]]

claim for payment, or may have submitted the claim for payment and it 
does not appear in the claims data provided to qualified entities due 
to an error. Additionally, a claims-based quality measure may not have 
fully captured the exclusion criteria that apply to many quality 
measures. For example, a qualified entity may, using available claims 
data, conclude that a provider has not provided a mammogram to an 
eligible patient. However, the patient may have undergone mastectomy 
surgery in previous years and therefore no longer be eligible for 
inclusion in the denominator for the breast cancer screening measure.
    For these reasons we believe that if a provider has a list of 
patient names associated with a measure result, it gives them the 
ability to cross reference the patient name against medical records in 
an effort to assess if there is missing clinical information that could 
be shared with the qualified entity in order to improve the accuracy of 
their results.
    As a result, we believe that on balance, it may be appropriate to 
provide qualified entities with the beneficiary names if it is 
requested as described below, in order to enable adequate review 
opportunities for providers of services and suppliers and to promote 
increased provider acceptance of, and trust in claims-based quality 
measures.
    While we believe that these contemplated disclosures are important 
to the success of the program, we also recognize the importance of 
protecting beneficiary data. In 2008, we published a regulation to 
permit Part D drug event data to be used for program monitoring, 
research, public health, care coordination, quality improvement, 
population of personal health records, and other purposes. See 73 FR 
30664. As discussed in the regulation, we sought to balance access to 
the data with protections for beneficiary privacy and commercially-
sensitive plan data to safeguard public health and permit broader 
public knowledge about the operations of the Part D program. Under the 
qualified entity program, release of Part D data is needed for provider 
performance evaluation, and provider performance evaluation is 
necessary for care coordination and quality improvement. We intend to 
ensure that Part D data released by CMS under this program complies 
with the requirements in the Part D data regulation, and that qualified 
entities take the necessary steps to ensure that any prescription drug 
data released to providers of services and suppliers as part of the 
review, appeal, and error corrections process is also safeguarded to 
ensure privacy and security of beneficiary information.
    Additionally, as discussed further in II.D.2. below, we believe 
that the Health Insurance Portability and Accountability Act (HIPAA) 
Privacy and Security rules would also provide a degree of protection 
for this information, especially when it is in the hands of providers 
of services and suppliers. CMS is committed to protecting the privacy 
and security of beneficiary identifiable data provided to qualified 
entities whether they are subject to HIPAA or not. Such data are 
carefully protected by a number of laws and policies, including HIPAA, 
when it is in the hands of CMS or one of its contractors. While 
qualified entities would not legally be a contractor of CMS and 
therefore would not be subject to these laws and policies, we believe 
that these protections should not cease merely because CMS is making 
these data available to another entity for other purposes that are 
perceived to have a public benefit.
    As described below, we propose to require qualified entities to 
apply privacy and security protections similar to those we require when 
we make beneficiary claims data available to external organizations for 
research purposes. To ensure that qualified entities apply appropriate 
privacy and security protections, we are proposing that approved 
qualified entities be required to execute a Data Use Agreement (DUA), 
described below, before receipt of any CMS data (the DUA is available 
at http://www.cms.gov/cmsforms/downloads/cms-r-0235.pdf). We note that 
this DUA contains significant penalties for inappropriate disclosures 
of the data, including both civil monetary penalties and criminal 
penalties. We seek comment on our proposal to apply privacy and 
security protections to qualified entities that are similar to those we 
require when we make beneficiary claims data available to external 
organizations for research purposes.
    As described above, we do not propose to send the data in a fully 
identifiable format when we send it to the qualified entity. All of the 
Medicare claims data provided to qualified entities would be furnished 
in a data set that contains a unique encrypted beneficiary 
identification number which would enable the qualified entities to link 
all claims for an individual beneficiary without knowing the identity 
(that is, name and other identifying characteristics) of the 
beneficiary.
    We are considering three potential options for sharing beneficiary 
names with qualified entities, and by extension, providers of services 
and suppliers. Under the first option, qualified entities would be 
provided with a crosswalk file linking all encrypted beneficiary 
identifiers to the patients' names for their Medicare data. We realize 
that this makes a large amount of data identifiable by the qualified 
entity. However, qualified entities would be permitted to give to a 
provider of services or supplier only the names of those beneficiaries 
included in that requester's performance report. Further, the qualified 
entity would only be permitted to provide the claims relevant to the 
particular measure or measure result that the provider of services or 
supplier is appealing, as is discussed in more detail below at section 
II.D.2.
    Under the second option, CMS would only provide beneficiary names 
to qualified entities on a transactional basis for the purposes of 
responding to specific requests for data by providers of services and 
suppliers. Each request for beneficiary names would be addressed on a 
case-by-case basis through the forwarding of each data request by the 
qualified entity to CMS. The qualified entity would receive beneficiary 
names only for those claims that were included in the requester's 
report and would be expected to destroy the identifiable data after 
responding to the providers' request for this data. We believe that 
this approach better safeguards any potential threats to beneficiary 
privacy.
    Under the third option, a provider of services or supplier who 
wishes to receive beneficiary names would request the encrypted claims 
data from the qualified entity as permitted under the statute. The 
provider of services or supplier would then submit a request to CMS for 
the beneficiary names for those specific claims.
    We believe that all three approaches have pros and cons. The first 
option is the least resource intensive from the perspective of both CMS 
and qualified entities. However, this option creates legitimate privacy 
concerns because it results in more data becoming identifiable to the 
qualified entity than is necessary to respond to the requests of 
specific providers of services or suppliers request for beneficiary 
names. The second option would be potentially more resource intensive 
for both CMS and qualified entities, but we believe it addresses many 
of the concerns posed by the first option because it would result in 
beneficiary names being made available only on an as-needed basis. The 
third option would also be

[[Page 33576]]

potentially more resource intensive for CMS and more resource intensive 
for providers of services and suppliers because providers of services 
and suppliers would have to engage in a two-step process involving both 
a qualified entity and CMS to obtain the requested data. We believe 
this may disrupt the relationship between the qualified entity and the 
provider of services or supplier, which is important for error 
correction and confidence in measure results.
    Having considered these things, we propose the second option 
because we believe it represents the best compromise between adequately 
safeguarding beneficiary privacy and fostering strong and productive 
relationships between qualified entities and providers of services and 
suppliers. If a qualified entity receives a request for data from a 
provider of services or supplier, we propose that the qualified entity 
would be required to submit a request to CMS in writing with a signed 
provider of services or supplier request appended as an attachment. 
However, we seek comment on all three options, as well as suggestions 
for other approaches not proposed here.
1. Privacy and Security Requirements for Qualified Entities
    We are proposing to require that qualified entities have in place 
security protections for all data released by CMS, and any derivative 
files, including any Medicare claims data and any beneficiary 
identifiable data. As part of their applications, qualified entities 
would have to explain how they would ensure that only the minimum 
necessary beneficiary identifiable data would be disclosed to the 
provider of services or supplier in the event of a request by a 
provider of services or supplier, and how data would be securely 
transmitted to the provider.
    In fulfilling these requirements, we are proposing at Sec.  
401.703(a)(1)(viii), that in order to be eligible to apply to receive 
Medicare data as a qualified entity, the applicant must demonstrate its 
capabilities to establish, maintain, and monitor a rigorous data 
privacy and security program, including ensuring compliance with plans 
related to the privacy and security of data. Additionally, Sec.  
401.703(a)(3) requires the applicant to submit to CMS a description of 
its rigorous data privacy and security policies including enforcement 
mechanisms.
    As noted above, we intend to provide a DUA to potential qualified 
entities at the time of their application. This DUA would be CMS' 
current standard data use agreement for research disclosures (available 
at http://www.cms.gov/cmsforms/downloads/cms-r-0235.pdf), but would be 
customized for the purposes of the qualified entity program through 
addenda to paragraph 12, which allows CMS to add attachments to the DUA 
to address the specific needs of the data recipient. We seek comment on 
the current DUA and any modifications that might be necessary for the 
purposes of providing data to qualified entities.
    Specifically, the current DUA requires a level and scope of 
security that is not less than the level and scope of security 
requirements established by the Office of Management and Budget (OMB) 
in OMB Circular No. A-130, Appendix III--Security of Federal Automated 
Information Systems (http://www.whitehouse.gov/omb/circulars/a130/a130.html) as well as Federal Information Processing Standard 200 
entitled ``Minimum Security Requirements for Federal Information 
Systems'' (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf); and Special Publication 800-53 ``Recommended Security 
Controls for Federal Information Systems'' (http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf).
    We propose prohibiting the use of unsecured telecommunications to 
transmit beneficiary identifiable data or deducible information derived 
from any CMS data file(s).
    Further, we propose to require qualified entities to disclose as 
part of their data privacy and security policies the circumstances 
under which data provided by CMS would be stored and/or transmitted.
    We propose to require compliance with the listed OMB and NIST 
requirements in all of the qualified entities' activities with CMS data 
received through the qualified entity program, including but not 
limited to the receipt, storage, and possession of these data for 
purposes of calculating and reporting performance measures, beginning 
with the qualified entities' receipt of encrypted file(s) from CMS.
    We propose to require qualified entities to ensure that they bind 
any contractors or subcontractors that are working on behalf of the 
qualified entities to these same limitations and requirements. We 
propose that, if approved, qualified entities would have to attest that 
they have extended and applied CMS' security requirements to their 
contractors before receiving CMS data. We solicit comments on our 
proposals.
    In order to meet the requirements in Sec.  401.707 to establish, 
maintain, and monitor a security and privacy program, and to assure 
data are kept private and secure, we propose to require qualified 
entities to maintain their privacy and security programs throughout the 
duration of their participation as qualified entities, and through 
their winding down of business as a qualified entity, including the 
return or destruction of CMS data and any and all derivative files. 
Failure to comply with these requirements would result in a qualified 
entity being disqualified from further participation in the program. We 
propose to require the return or destruction of all CMS data files and 
derivative files in the possession of the qualified entity or its 
contractors and subcontractors within 30 days of any disqualification 
from the program or voluntary withdrawal from the program.
    Finally, we are seeking public comment on the appropriateness of 
accepting some form of independent accreditation or certification of 
compliance with data privacy and security requirements from qualified 
entities, and what that accreditation or certification might entail. 
The accreditation or certification would need to be at a level and 
scope of security that is not less than the level and scope of security 
requirements described above.
2. Privacy and Security of Data Released to Providers of Services and 
Suppliers
    We have also considered how to ensure the security and privacy of 
the beneficiary identifiable data after it has been placed in the hands 
of a provider of services or supplier during the report review and 
error correction process. We believe that the HIPAA Privacy and 
Security rules would apply to a majority of providers of services and 
suppliers who would receive beneficiary identifiable data from 
qualified entities. We base this belief on CMS' claims processing 
experience. Due to the statutory requirement that Medicare claims be 
filed electronically, the electronic claim filing rates are very high. 
However, there are exceptions to electronic filing. For example, 
certain small providers are exempt. For institutional claim billers 
(for example, hospitals, SNFs, HHAs) the rate of providers filing 
electronically is approximately 99.9 percent, and for non-institutional 
claims (for example, physicians, other practitioners, labs, ambulance) 
the rate is 98.2 percent.
    By law, providers that transmit any beneficiary identifiable health 
information in the context of an electronic transaction for which there 
is a HIPAA standard transaction are HIPAA covered entities that are 
subject

[[Page 33577]]

to the HIPAA Security and Privacy rules. Providers of services and 
suppliers that are already subject to the HIPAA Privacy and Security 
rules are required to have policies and procedures in place to protect 
the privacy and security of beneficiary identifiable data. We believe 
that the HIPAA Privacy and Security rules provide an appropriate level 
of protection of beneficiary identifiable data received by a provider 
of services or supplier from a qualified entity as the result of an 
appeal process or error correction request.
    However, qualified entities may generate performance reports for 
providers of services and suppliers not subject to HIPAA. For those few 
providers that are not subject to HIPAA because they do not transmit 
beneficiary identifiable health information in the context of an 
electronic transaction for which there is a HIPAA standard transaction, 
we propose to require that qualified entities include a plan in their 
application materials for assuring protection of the data that is 
released as a part of the measure report review process, such as 
requiring a signed privacy and security agreement between the qualified 
entity and the provider of services or supplier that includes the same 
privacy and security protections as the qualified entity is subject to 
under the DUA it enters into with CMS. We believe that the few 
providers this affects would be willing to enter into such agreements, 
and that this would ensure that beneficiary level data that is given to 
a provider of services or supplier through an appeals process would 
remain secure and protected, and only used for purposes related to the 
appeal. We seek comments on these proposals.
    Section 1874(e)(4)(B)(v) of the Act requires qualified entities to 
make the Medicare claims data they receive available to providers of 
services and suppliers. We believe that for many providers of services 
and suppliers, the beneficiary name may be of more practical use in 
determining the accuracy of the measures results than the underlying 
claims used to calculate the measures. However, the statute does 
explicitly acknowledge that upon request qualified entities would need 
to share with providers of services or suppliers ``data made available 
under this subsection.'' We would like to make it clear that we do not 
interpret this provision to mean that providers could receive all 
Medicare claims data for a given patient or patients. Rather, we 
interpret this to mean that in certain circumstances, qualified 
entities may have to provide all the claims relevant to the particular 
measure or measure results the provider of services or supplier is 
appealing. Therefore, a provider requesting claims data in relation to 
a diabetes quality measure would only receive the claims related to the 
calculation of that quality measure. We realize this may result in 
providers of services or suppliers receiving claims submitted by 
another provider. For example, the provider that performs a test on a 
patient may not be the provider who is ultimately determined by the 
qualified entity to be responsible for the care of that patient. 
Therefore, if the responsible provider requests access to the 
underlying claims data informing their measure results, some of that 
claims data may be from other providers. We solicit comment on any 
privacy or security issues related to this situation.
    We also believe that the intent of this program is not just for 
qualified entities to engage in measure calculation and reporting to 
providers, but for the reports generated by qualified entities to 
result in meaningful quality improvement activities by providers. As a 
result, we believe that it is appropriate for providers of services and 
suppliers to use the claims data and beneficiary name received as part 
of an appeal to engage in quality improvement activities as long as the 
quality improvement work is in accordance with the HIPAA limitations 
discussed herein.
3. Beneficiary Privacy and Security Concerns
    Following provision of the performance reports on a confidential 
basis to providers of services or suppliers, qualified entities are 
required to make performance information public. We note that the 
publication is only of aggregated, non-beneficiary identifiable data 
that would not be able to be reidentifed (for example, a provider 
conducted an annual HbA1C test for 70 percent of their diabetic 
patients). We propose to require that qualified entities ensure that 
all publicly available reports do not contain beneficiary identifiable 
information. Additionally, we propose to prohibit qualified entities 
from disclosing information in their publicly available reports that 
there is a reasonable basis to believe can be used in combination with 
other publicly available information to re-identify individual 
patients. We expect that this reporting of aggregate non-identifiable 
data should not compromise beneficiary privacy.
    We also propose requiring qualified entities to have in place a 
process to respond to beneficiary queries or complaints regarding the 
privacy and security of their data. In addition, we propose to require 
qualified entities to inform beneficiaries of a breach pursuant to the 
requirements in paragraph 13 of the DUA. Finally, we propose below at 
section F of the preamble that qualified entities submit information on 
privacy or security breaches to CMS, to allow CMS to monitor qualified 
entity actions in this area. We seek comments on these proposals.

E. Confidential Opportunities to Review, Appeal, and Correct Reports

    The statute describes two requirements to ensure that providers of 
services and suppliers are afforded an opportunity to provide input on 
the reporting of their performance metrics. Section 1874(e)(4)(C)(ii) 
of the Act requires qualified entities to make their reports available 
confidentially to providers of services and suppliers identified in the 
reports prior to the public release of such reports, and to offer them 
the opportunity to appeal and correct errors. Additionally, section 
1874(e)(4)(B)(v) of the Act requires qualified entities to release 
relevant Medicare claims data that was made available to them under 
section 1874 of the Act to providers of services and suppliers who 
request it. We interpret this section of the Act to indicate that 
qualified entities must provide relevant data made available to them 
under this subsection to any provider of services or supplier 
identified in the qualified entity's report who requests such data. By 
relevant data, we mean the underlying claims data used to calculate the 
results for any measure that a provider wishes to appeal. We assume 
that the reason providers of services and suppliers would make requests 
for data is so they can appeal and request the correction of errors in 
their reports.
    To ensure that qualified entities have a method to address these 
two requirements, we propose, at Sec.  401.704(b), to require that 
applicants include a plan for their process for confidential report 
review, appeals, and error correction processes in their application 
materials.
    We are proposing that these plans would contain several elements. 
First, a qualified entity would need to provide for a means of 
informing providers of services and suppliers of the specific steps 
that were taken in order to generate their performance reports in order 
for providers of services and suppliers to be able to understand their 
performance reports. We propose requiring that this plan include an

[[Page 33578]]

explanation of the measurement methodology, estimates of statistical 
reliability, and information on how to interpret the results to help 
providers of services and suppliers understand their performance 
relative to others. To the greatest extent possible, these explanations 
and information should be written using a language and formats that are 
as easily understood as possible. As discussed below, the qualified 
entity would also be required to have a plan for informing providers of 
services or suppliers about their rights to request data, appeal the 
reports, and request error correction.
    Second, the qualified entity would be required to describe the 
means by which providers of services and suppliers may request the 
Medicare data that was used to calculate the performance measures they 
wish to appeal and, if necessary, correct. The qualified entities would 
be required to describe how they would ensure that the information that 
is shared would be limited to those beneficiaries included in the 
requestor's performance report and only contains those claims relevant 
to the particular measure(s) being appealed.
    Third, as discussed above in this section, we are proposing to 
require that qualified entities describe their means of confidentially 
sharing results with providers of services and suppliers (for example 
secure Web site or e-mail) in their application. Qualified entities 
would be required to use secure methods suitable for transmitting or 
otherwise providing secure access to identifiable health information to 
providers of services or suppliers. We seek comment on the appropriate 
secure methods that should be required for sharing the information with 
providers of services or suppliers, such as two factor authentication.
    Fourth, we propose to require a description of the means by which 
providers of services and suppliers can submit appeals for error 
correction. This process must describe the timeframes for providers of 
services or suppliers to submit requests for data and requests for 
error correction. The timeframes must meet several parameters. We 
believe these timeframes are reasonable because they balance the need 
for careful review by providers of services and suppliers with one of 
the main intents of the program, which is to make performance 
information available to the public. Qualified entities must share 
measures, measurement methodology, and measure results with providers 
of services and suppliers at least 30 business days prior to making 
measure results public. Additionally, qualified entities must allow 
providers of services and suppliers at least 10 business days to make a 
request for data, and an additional 10 business days for a provider to 
request an error correction. Per the qualified entity's request, the 
provider of services or supplier may be required to provide comments, 
additional data, or documentation for consideration.
    Fifth, the qualified entity must make clear to providers of 
services and suppliers that reports would be made public after a 
specified date (at a minimum 30 business days after sharing measure 
results with providers of services and suppliers), regardless of the 
status of any providers of services or suppliers' requests for error 
correction. We propose to encourage qualified entities to dedicate 
appropriate resources, including qualified staff, to resolving good 
faith questions regarding performance results to both parties' 
satisfaction whenever possible. If the request for a data or error 
correction is still outstanding at the time of making the reports 
public, we propose the qualified entity must, if feasible, post 
publicly the name of the appealing provider and a description of the 
appeal request. While we understand that this proposal means that some 
provider of services and supplier requests for error correction might 
not be resolved prior to publication of the results, we have included 
this requirement to ensure that providers do not make spurious requests 
for error correction to prevent the publication of measure results. We 
want to ensure that providers of services and suppliers have the 
opportunity to correct their results in situations where there are 
errors, but also ensure that performance results are released in a 
timely manner.
    CMS proposes to monitor the number of provider appeals for each 
qualified entity, both as a mechanism for ensuring the overall quality 
of individual qualified entity reporting mechanisms and to identify any 
situations where providers of services or suppliers might be appealing 
on spurious grounds so that CMS can determine whether to further 
investigate any such situations.
    Finally, qualified entities must describe the means by which they 
would notify the provider of services or supplier of the outcome of the 
request for error correction and basis for the decision.
    We request comments on our proposed approach to requiring potential 
qualified entities to describe their processes for providers of 
services and suppliers to review reports confidentially, request data, 
and appeal to the qualified entity for error correction in their 
applications.
    Additionally, although we do not have the statutory authority to 
require it, we strongly encourage qualified entities to share not only 
Medicare data but also their claims data from other sources with 
providers of services and suppliers, if they ask to correct an error or 
appeal their results on specific measures.

F. Monitoring, Oversight, Sanctioning, and Termination

    CMS is committed to ensuring the successful implementation of this 
program, maximizing the appropriate use of Medicare data for the 
production of performance reports, while minimizing the risk of 
inappropriate disclosure of beneficiary information. Section 
1874(e)(2)(B) of the Act authorizes CMS to require qualified entities 
to meet any other requirements we specify, ``such as ensuring the 
security of data.'' We have outlined a range of requirements in this 
rule that qualified entities would be expected to meet and maintain on 
an ongoing basis. In order to ensure that the highest standards are 
adhered to by all qualified entities, we are proposing a monitoring 
program which would assess qualified entities' compliance with the 
requirements laid out in this rule and assess sanctions or termination 
as deemed appropriate by CMS. We are proposing at Sec.  401.710(a)(1) 
that CMS, or one of its designated contractors, would periodically 
audit qualified entities use of Medicare data for the production of 
performance reports on providers of services or suppliers to ensure 
that the Medicare data is being used only for its intended purpose, 
that is, in combination with claims data from other sources to 
calculate and report either standard or alternative claims-based 
measures to providers of services and suppliers. We propose that these 
audits be done at the discretion of CMS.
    We also propose that CMS would monitor the amount of claims data 
from other sources being used in the production of performance reports 
to ensure that it is equal to or greater than the amount promised by 
the qualified entity in its application. This would require production 
of documentation on data sources and quantities of data, and may 
necessitate a site visit to the qualified entity by data experts. 
Again, if CMS finds that qualified entities are not, in fact, 
calculating performance reports using the amount and type of data 
specified in its initial application that would also be grounds for 
sanction or termination.
    We recognize that in certain circumstances the amount of claims 
data from other sources a qualified

[[Page 33579]]

entity has access to may decrease. For example, a qualified entity may 
lose access to a data set in the second year of their participation in 
the program or may discover that some of the other claims data they 
possess is inaccurate and therefore unusable. In these cases, we 
propose that the qualified entity must immediately inform CMS of the 
reduction in the amount of other claims data it possesses and provide 
documentation that the remaining other claims data is still sufficient 
to address the concerns regarding sample size and reliability expressed 
by stakeholders regarding the calculation of performance measures from 
a single payer source. We would review this information and determine 
whether the qualified entity may continue to participate in the 
program. If CMS determines the amount of data is not sufficient to meet 
the requirements, the qualified entity would have 60 days to acquire 
new claims data and submit documentation to CMS. Under no circumstances 
may a qualified entity issue a report, use a measure, or share a report 
during this 60 day period. If after the 60 days, the qualified entity 
does not have access to new data or if CMS decides the qualified entity 
still does not possess an adequate amount of additional claims data, 
CMS would terminate its relationship with the qualified entity. We 
solicit comments on our proposal for regarding the CMS response to a 
decrease in the amount of claims data possessed by a qualified entity.
    We propose requiring qualified entities to submit an annual report 
to CMS covering two topics, as described in further detail below: (1) 
General program adherence and (2) engagement of providers of services 
and suppliers.
    1. General Program Adherence: To monitor general program adherence, 
we propose that qualified entities would submit an annual report 
containing the number of Medicare and other claims combined, the 
percent of the overall market share the number of claims represents in 
the qualified entity's area, the number of measures calculated, the 
number of providers of services and suppliers profiled by type of 
provider and supplier, and a measure of the public use of the reports 
(for example, the number of Web site hits).
    2. Engagement of Providers of Services and Suppliers: We believe 
that one of the most important outcomes of this program would be the 
engagement of providers of services and suppliers with qualified 
entities to improve health care quality and efficiency. We want to 
ensure that qualified entities engage providers of services and 
suppliers in a constructive and respectful manner, and diligently work 
to address the concerns of the providers of services or suppliers 
throughout any appeal and error correction processes. Therefore, we are 
also proposing to impose reporting requirements so that CMS would be 
able to monitor the requests from providers of services and suppliers 
for information, error correction, and appeals, as well as the 
responsiveness of the qualified entity to those requests. In order to 
permit CMS to monitor these requests, we propose that qualified 
entities would provide a yearly report to CMS regarding: (1) The number 
of requests for data and the number of requests fulfilled; (2) the 
number of subsequent error corrections; (3) the type of problem(s) 
leading to the appeal or request for error correction; (4) the time for 
the qualified entity to acknowledge the request for data or error 
correction; (5) the time for the qualified entity to respond to the 
request for appeal or error correction; and (6) the number of requests 
for appeal or error correction that are resolved.
    As stated above, CMS is committed to ensuring that qualified 
entities protect the privacy and security of beneficiary information. 
To monitor qualified entities actions in this area, we are proposing 
that qualified entities would submit to CMS information regarding any 
inappropriate disclosures or uses of beneficiary identifiable data 
pursuant to the requirements in the DUA. We solicit comment on our 
proposal as well as other indicators that would demonstrate that a 
qualified entity is appropriately responding to the requests from 
providers of services or suppliers.
    If, based upon the monitoring activities described above or by any 
other manner, we conclude that a qualified entity is not adequately 
observing the requirements of the program we propose that CMS, in its 
sole discretion, may take any or all of the following actions:
     Provide a warning notice, which indicates that future 
deficiencies could lead to termination, to the qualified entity of the 
specific performance concern;
     Request a corrective action plan (CAP) from the qualified 
entity;
     Place the qualified entity on a special monitoring plan;
     Terminate the qualified entity.
    The level of sanctions and/or termination would depend on an 
assessment by CMS of the seriousness of the observed deficiency or 
deficiencies by the qualified entity. One or more disclosures of 
beneficiary identifiable information would likely to result in 
termination. Additionally, since the statute explicitly bars the reuse 
of Medicare claims for purposes other than generating performance 
reports, we propose CMS terminate its relationship with the qualified 
entity in the event of reuse of Medicare claims. Other deficiencies 
that may be the result of employee error and can be easily corrected in 
the future would likely just result in a warning notice. However, as 
noted above, any time the qualified entity is terminated we propose to 
require the destruction or return of any Medicare data within 30 days.

G. Qualified Entity Application Content

    In accordance with these proposals, if finalized, CMS proposes to 
develop an application process for potential qualified entities that 
would require the following information:
    1. Applicant name and entity description.
    2. A description of the applicant's organizational and governance 
qualifications as laid out in Section II.A.2. above and at Sec.  
401.703(a)(1).
    3. A description of the business model the applicant plans to use 
for covering the costs of the required functions.
    4. A description of the additional claims data the applicant would 
use in combination with the requested Medicare data, and the amount of 
data that would be combined with Medicare data.
    5. A description of geographic area(s) for which Medicare data 
would be requested.
    6. Documentation of its proposed data privacy and security policies 
and enforcement mechanisms.
    7. A description of the proposed measures it intends to calculate 
and report, including the name of the measure, the name of the measure 
developer, the measure specifications, the rationale for selecting 
those measures including the relationship of the measures to existing 
measurement efforts and the relevancy to the proposed population in the 
proposed geographic area, and a description of the methodologies it 
intends to use in creating reports; if seeking approval of an 
alternative measure, documentation that the proposed alternative 
measure has been accepted by the Secretary as an alternative measure 
through notice and comment rulemaking.
    8. A description of the process it would establish to allow 
providers of services and suppliers to review draft reports 
confidentially, request data and appeal to correct errors before the 
reports are made public.
    9. A prototype report for reporting findings to providers of 
services and suppliers, and if different, to consumers,

[[Page 33580]]

including any standard explanatory language (narrative), an easily 
comprehensible description of the proposed measures, the rationale for 
use of those measures, a description of the methodologies to be used, 
and a description of the data specifications and limitations, as well 
as a dissemination plan for reports.
    We propose to assess the veracity of each applicant's assertions 
through a comprehensive review of their supporting documentation as 
part of the application review process.
    Applications would generally be approved based on the overall 
expertise and sustained experience demonstrated. We are not proposing 
to limit the number of qualified entities or review the applications 
against one another. We believe our proposed approach to determining 
qualified entity eligibility balances the need to ensure fairness in 
qualified entities' evaluation of providers of services and suppliers 
with beneficiaries' needs for confidentiality of their health care 
information. We seek comments on our proposed application requirements 
and the total burden associated with them.
    We recognize that by not limiting the number of qualified entities 
in any particular geographic region, in certain circumstances providers 
of services and suppliers might receive multiple reports from different 
qualified entities. We believe that given the requirement that 
qualified entities contribute claims data from other sources, the 
likelihood of multiple qualified entities in the same area is low. 
However, we seek comment on the implications of providers of services 
and suppliers receiving multiple reports. We also seek comment on 
whether CMS should limit the number of qualified entities that are 
approved for a particular region, as well as other methods to address 
this issue.
    In selecting qualified entities, CMS would evaluate all 
applications received and identify those that meet these requirements. 
We propose that applications for participation in the program would be 
available on the CMS Web site beginning January 1, 2012. Applications 
would only be collected and processed once a year. We propose that 
applications would be due on March 31, 2012, and by the close of the 
first quarter of the calendar year each year thereafter. We considered, 
instead, using a rolling application process, where organizations could 
apply at any point in the year. However, we are concerned about the 
burden this would place on CMS in processing and reviewing 
applications. We seek comment on our proposed application process, 
specifically our decision to have a yearly application date rather than 
using a rolling application process.
    Applicants would be approved for a period of three years from the 
date of notification of the application approval by CMS. In order to 
continue to serve as a qualified entity for any subsequent three year 
periods, the qualified entity would need to reapply. To reapply, a 
qualified entity would need to submit to CMS documentation of any 
changes to what was included in their original application. Qualified 
entities would need to submit this documentation at least 6 months 
before the end of their three-year approval period. If a qualified 
entity has submitted a reapplication, it would be able to continue to 
serve as qualified entities until the re-application is either approved 
or denied by CMS. If the re-application is denied, CMS would terminate 
its relationship with the qualified entity. We propose that a qualified 
entity would need to be in good standing in order to reapply. A 
qualified entity would be considered in good standing if it had no 
violations of the requirements of the program or if the qualified 
entity was addressing any past deficiencies either on its own or 
through the implementation of a corrective action plan.

III. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995, we are required to 
provide 60-day notice in the Federal Register and solicit public 
comment before a collection of information requirement is submitted to 
the Office of Management and Budget (OMB) for review and approval. In 
order to fairly evaluate whether an information collection should be 
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act 
of 1995 requires that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.
     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    We are soliciting public comment on each of these issues for the 
following sections of this proposed rule that contain information 
collection requirements (ICRs).
    If finalized, these regulations would require an organization 
seeking to receive data as a qualified entity to submit an application. 
Specifically, an applicant must submit the information listed in 
proposed Sec. Sec.  401.703-401.705. The burden associated with this 
requirement is the time and effort necessary to gather, process, and 
submit the required information to CMS. We estimate that 35 
organizations would submit applications to receive data as qualified 
entities. We further estimate that it would take each applicant 500 
hours to gather, process and submit the required information. The total 
estimated burden associated with this requirement is 500 hours at an 
estimated cost of $795,641.
    Proposed Sec.  401.707(a)(iv) states that as part of the 
application review and approval process, a qualified entity would be 
required to execute a Data Use Agreement (DUA) with CMS, that among 
other things, reaffirms the statutory bar on the use of Medicare data 
for purposes other than those referenced above. The burden associated 
with executing this DUA is currently approved under OMB control number 
0938-0734.
    Proposed Sec.  401.705(f) would require qualified entities in good 
standing to re-apply for qualified entity status 6 months before the 
end of their three-year approval period. We estimate that 25 entities 
would be required to comply with this requirement. We estimate that it 
would take 120 hours to reapply to CMS. The total estimated burden 
associated with this requirement is 120 hours at an estimated cost of 
$136,396.
    Proposed Sec.  410.710(b) requires qualified entities to submit 
annual reports to CMS as part of CMS' ongoing monitoring of qualified 
entity activities. We estimate that the 25 entities in the program will 
be required to comply with this requirement. We estimate that it will 
take 150 hours to complete an annual monitoring report. The total 
estimated burden associated with this requirement is 150 hours at 
$170,475.

[[Page 33581]]

                                              Table 1--Estimated Annual Recordkeeping and Reporting Burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                           Hourly       Total
                                                                                 Burden per     Total    labor cost  labor cost     Total
     Regulation section(s)         OMB Control No.     Respondents    Responses   response     annual        of          of        capital/   Total cost
                                                                                   (hours)     burden     reporting   reporting  maintenance      ($)
                                                                                               (hours)       ($)        ($)*      costs ($)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Sec.   401.703(a)..............  0938-New..........              35          35         500      17,500          **     795,641            0     795,641
Sec.   401.705(f)..............  0938-New..........              25          25         120       3,000          **     136,396            0     136,396
Sec.   401.710(b)..............  0938-New..........              25          25         150       3,750          **     170,475            0     170,475
                                                    ----------------------------------------------------------------------------------------------------
    Total......................  ..................              35          35  ..........      24,250  ..........  ..........  ...........   1,102,512
--------------------------------------------------------------------------------------------------------------------------------------------------------
* Total labor cost assuming 92% of total hours are professional and technical and 8% are legal.
** Wage rates vary by level of staff involved in complying with the information collection request (ICR).

    To obtain copies of the supporting statement and any related forms 
for the proposed paperwork collections referenced above, access CMS' 
Web site at http://www.cms.gov/PaperworkReductionActof1995/PRAL/list.asp#TopOfPage or e-mail your request, including your address, 
phone number, OMB number, and CMS document identifier, to 
Paperwork@cms.hhs.gov, or call the Reports Clearance Office at 410-786-
1326.
    If you comment on these information collection and recordkeeping 
requirements, please do either of the following:
    1. Submit your comments electronically as specified in the 
ADDRESSES section of this proposed rule; or
    2. Submit your comments to the Office of Information and Regulatory 
Affairs, Office of Management and Budget, Attention: CMS Desk Officer, 
[CMS-5059-P], Fax: (202) 395 6974; or E-mail: OIRA_submission@omb.eop.gov.

IV. Regulatory Impact Analysis

A. Overall Impact

    We have examined the impacts of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), the 
Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), 
section 1102(b) of the Social Security Act, section 202 of the Unfunded 
Mandates Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on 
Federalism (August 4, 1999), and the Congressional Review Act (5 U.S.C. 
804(2)).
    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). A regulatory impact 
analysis (RIA) must be prepared for major rules with economically 
significant effects ($100 million or more in any 1 year). For the 
reasons discussed below, we estimate that the total impact of this 
proposed rule would be less than $90 million and therefore, it would 
not reach the threshold for economically significant effects and is not 
considered a major rule.
    The RFA requires agencies to analyze options for regulatory relief 
of small businesses, if a rule has a significant impact on a 
substantial number of small entities. For purposes of the RFA, we 
estimate that most hospitals and most other providers are small 
entities as that term is used in the RFA (including small businesses, 
nonprofit organizations, and small governmental jurisdictions). 
However, since the total estimated impact of this rule is less than 
$100 million, and the total estimated impact would be spread over both 
qualified entities and providers of services and suppliers, no one 
entity would face significant impact. Thus, we are not preparing an 
analysis of options for regulatory relief of small businesses because 
we have determined that this rule would not have a significant economic 
impact on a substantial number of small entities.
    We estimate that two types of entities may be affected by the 
program established by section 1874(e) of the Act: Organizations that 
desire to operate as qualified entities and the providers of services 
and suppliers who receive performance reports from qualified entities.
    We anticipate that most providers of services and suppliers 
receiving qualified entities' performance reports would be hospitals 
and physicians. Many hospitals and most other health care providers and 
suppliers are small entities, either by being nonprofit organizations 
or by meeting the Small Business Administration definition of a small 
business (having revenues of less than $34.5 million in any 1 year) 
(for details see the Small Business Administration's Web site at http://sba.gov/idc/groups/public/documents/sba_homepage/serv_sstd_tablepdf.pdf (refer to the 620000 series). For purposes of the RFA, 
physicians are considered small businesses if they generate revenues of 
$10 million or less based on Small Business Administration size 
standards. Approximately 95 percent of physicians are considered to be 
small entities.
    The analysis and discussion provided in this section and elsewhere 
in this proposed rule complies with the RFA requirements. Because we 
acknowledge that many of the affected entities are small entities, the 
analysis discussed throughout the preamble of this proposed rule 
constitutes our regulatory flexibility analysis for the remaining 
provisions and addresses comments received on these issues.
    In addition, section 1102(b) of the Act requires us to prepare a 
regulatory impact analysis, if a rule may have a significant impact on 
the operations of a substantial number of small rural hospitals. Any 
such regulatory impact analysis must conform to the provisions of 
section 603 of the RFA. For purposes of section 1102(b) of the Act, we 
define a small rural hospital as a hospital that is located outside of 
a metropolitan statistical area and has fewer than 100 beds. We do not 
believe this proposed rule has impact on significant operations of a 
substantial number of small rural hospitals because we anticipate that 
most qualified entities would focus their performance evaluation 
efforts on metropolitan areas where the majority of health services are 
provided. As a result, this rule would not have a significant impact on 
small rural hospitals. Therefore, the Secretary has determined that 
this proposed rule would not have a significant impact on the 
operations of a substantial number of small rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2011, that 
threshold is approximately $136 million. This proposed rule would not 
mandate any requirements for State,

[[Page 33582]]

local, or tribal governments in the aggregate, or by the private 
sector, of $136 million. Specifically, as explained below we anticipate 
the total impact of this rule on all parties to be approximately $87 
million.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on State 
and local governments, preempts State law, or otherwise has Federalism 
implications. We have examined this proposed rule in accordance with 
Executive Order 13132 and have determined that this regulation would 
not have any substantial direct effect on State or local governments, 
preempt States, or otherwise have a Federalism implication.

B. Anticipated Effects

1. Impact on Qualified Entities
    Because section 1874(e) of the Act establishes a new program, there 
is little quantitative information available to inform our estimates. 
However, we believe that many or most qualified entities are likely to 
resemble community quality collaborative programs such as participants 
in the CMS Better Quality Information for Medicare Beneficiaries pilot 
(https://www.cms.gov/BQI/) and the AHRQ Chartered Value Exchange (CVE) 
program (http://www.ahrq.gov/qual/value/lncveover.htm). Community 
quality collaboratives are community-based organizations of multiple 
stakeholders that work together to transform health care at the local 
level by promoting quality and efficiency of care, and by measuring and 
publishing quality information. Consequently, we have examined 
available information related to those programs to inform our 
assumptions, although there is only limited available data that is 
directly applicable to this analysis.
    We estimate that 35 organizations would submit applications to 
participate as qualified entities. We anticipate that the majority of 
applicants would be nonprofit organizations such as existing community 
collaboratives. In estimating qualified entity impacts, we used hourly 
labor costs in several labor categories reported by the Bureau of Labor 
Statistics (BLS) at http://data.bls.gov/pdq/querytool.jsp?survey=ce. We 
used the annual rates for 2009 and added 33 percent for overhead and 
fringe benefit costs. These rates are displayed in Table 2.

                           Table 2--Labor Rates for Qualified Entity Impact Estimates
----------------------------------------------------------------------------------------------------------------
                                                            2009 hourly wage    OH and fringe     Total hourly
                                                               rate  (BLS)          (33%)             costs
----------------------------------------------------------------------------------------------------------------
Professional and technical services.......................            $34.08            $11.25            $45.33
Legal review..............................................             35.35             11.67             47.02
Custom computer programming...............................             40.37             13.32             53.69
Data processing and hosting...............................             29.36              9.69             39.05
Other information services................................             30.62             10.10             40.72
----------------------------------------------------------------------------------------------------------------

    We estimate that preparation of an application would require a 
total of 500 hours of effort, requiring a combination of staff in the 
professional and technical services and the legal labor categories. We 
seek comment on our estimate that 35 organizations would apply to 
become qualified entities and encourage any interested organizations to 
signal their intent to apply as qualified entities in their comments on 
this rule.
    We estimate that 25 of these applicants would be approved as 
participating qualified entities, and that each qualified entity would 
request Medicare claims data accompanied by payment for these data. 
Because of the eligibility criteria we are proposing for qualified 
entities, we believe that it is likely that all of these organizations 
would already be performing work related to calculation of quality 
measures and production of performance reports for health care 
providers, so the impact of the program established by section 1874(e) 
of the Act would be an opportunity to add Medicare claims data to their 
existing function.
    The statute directs that the fees for these data be equal to the 
government's cost to make the data available. We are proposing to 
initially provide three years of data to qualified entities with yearly 
updates thereafter. Based on CMS past experience providing Medicare 
data to research entities, we estimate that the total approximate costs 
to provide three years of data for 2.5 million beneficiaries to a 
qualified entity would be $200,000. As shown in Table 3, this would 
include approximately $75,000 in costs to produce the claims data, as 
well as approximately $125,000 in additional costs associated with 
technical assistance, processing applications and requests for data, 
and monitoring.
    We estimate that, on average, each qualified entity's activity to 
analyze the Medicare claims data, calculate performance measures and 
produce provider performance reports would require 5,500 hours of 
effort. While qualified entities would not be able to calculate or 
produce alternative measures in the first year of serving as a 
qualified entity, they may submit measures for approval in the first 
year of the program, so we have also included estimates here of the 
level of effort required to develop and submit alternative measures. We 
estimate that half of the qualified entities (13) would propose 
alternative performance measures, which would involve an additional 
2,100 hours of effort for each entity.
    We further estimate that, on average, each qualified entity would 
expend 5,000 hours of effort processing providers' and suppliers' 
appeals of their performance reports and producing revised reports, and 
2,000 hours making information about the performance measures publicly 
available. These estimates assume that, as discussed below in the 
section on provider and supplier impacts, on average 25 percent of 
providers or services and suppliers would appeal their results from a 
qualified entity. These assumptions are based on a belief that in the 
first year of the program many providers would want to appeal their 
results prior to performance reports being made available to the 
public. Responding to these appeals in an appropriate manner would 
require a significant investment of time on the part of qualified 
entities. This equates to an average of four hours per appeal for each 
qualified entity. We assume that the complexity of appeals would vary 
greatly, and as such, the time required to address them would also vary 
greatly. Many appeals may be able to be dealt with in an hour or less 
while some appeals may require multiple meetings

[[Page 33583]]

between the qualified entity and the affected provider of services or 
supplier. On average however, we believe that this is a realistic and 
reasonable estimate of the burden of the appeals process on qualified 
entities. We discuss the burden of the appeals process on providers of 
services and suppliers below.
    We anticipate that qualified entities would expend 2,000 hours of 
effort developing their proposed performance report. These estimated 
hours are separated into labor categories in Table 3 below, with the 
pertinent hourly labor rates and cost totals.
    Finally, we estimate that each qualified entity would spend 255 
hours of effort submitting information to CMS for monitoring purposes. 
This would include audits and site visits as discussed above. It would 
also include an annual report that contains measures of general program 
adherence, measures of the provider of services and suppliers data 
sharing, error correction, and appeals process, and measures of the 
success of the program with consumers. Finally, qualified entities 
would be required to notify CMS of inappropriate disclosures or use of 
beneficiary identifiable data pursuant to the requirements in the DUA. 
We believe that many of the required data elements in both the annual 
report and the report generated in response to an inappropriate 
disclosure or use of beneficiary identifiable data would be generated 
as a matter of course by the qualified entities and therefore, would 
not require significant additional effort. Based on the assumptions we 
have described, we estimate the total impact on qualified entities for 
the first year of the program to be a cost of $49,003,203.

                                         Table 3--Impact on Qualified Entities for the First Year of the Program
                                                             [Impact on Qualified Entities]
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                     Hours
                                          -----------------------------------------------------------
                 Activity                                                              Data process-     Labor       Cost per    Number of    Total cost
                                            Professional     Legal       Computer        sing and     hourly cost   applicant    applicants     impact
                                            and technical               programming       hosting
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                    APPLICATION COSTS
--------------------------------------------------------------------------------------------------------------------------------------------------------
Preparation of application by candidate    ..............  .........  ..............  ..............  ...........  ...........  ...........  ...........
 QEs.....................................
a. Prepare draft application.............             360  .........  ..............  ..............       $45.33      $16,319  ...........  ...........
b. Legal review..........................  ..............         40  ..............  ..............       $47.02       $1,881  ...........  ...........
c. Revisions to draft application........              60  .........  ..............  ..............       $45.33       $2,720  ...........  ...........
d. Senior management review and signature              40  .........  ..............  ..............       $45.33       $1,813  ...........  ...........
Total: application preparation...........             460         40  ..............  ..............  ...........      $22,733           35     $795,641
Medicare data purchase costs by approved   ..............  .........  ..............  ..............           NA      $75,000           25   $1,875,000
 QEs.....................................
Additional Medicare data application       ..............  .........  ..............  ..............           NA     $125,000           25   $3,125,000
 costs...................................
Total: Applications......................  ..............  .........  ..............  ..............  ...........  ...........  ...........   $5,795,641
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                   QE OPERATIONS COSTS
--------------------------------------------------------------------------------------------------------------------------------------------------------
Database administration..................  ..............  .........  ..............             500       $39.05  ...........           25     $488,125
Data analysis/measure calculation/report   ..............  .........            2500  ..............       $53.69     $134,225           25   $3,355,625
 preparation.............................
                                           ..............  .........  ..............            2500       $39.05      $97,625           25   $2,440,625
Development and submission of alternative            1000  .........  ..............  ..............       $45.33      $45,330           13     $589,290
 measures................................
                                           ..............  .........             100  ..............       $53.69       $5,369           13      $69,797
                                           ..............  .........  ..............            1000       $39.05      $39,050           13     $507,650
QE processing of provider appeals and                4000  .........  ..............  ..............       $45.33     $181,320           25   $4,533,000
 report revision.........................
                                           ..............       1000  ..............  ..............       $47.02      $47,020           25   $1,175,500
Development of proposed performance                  1000  .........  ..............  ..............       $45.53      $45,530           25   $1,138,250
 report formats..........................
                                           ..............  .........            1000  ..............       $53.69      $53,690           25   $1,342,250
Publication of performance reports.......  ..............  .........            1000  ..............       $53.69      $53,690           25   $1,342,250
                                           ..............  .........  ..............            1000       $39.05      $39,050           25     $976,250
Monitoring...............................  ..............  .........  ..............             255       $39.05       $9,958           25     $248,950

[[Page 33584]]

 
Computer hardware and processing.........  ..............  .........  ..............  ..............  ...........   $1,000,000           25   $25,000,00
                                                                                                                                                       0
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total: Operations........................  ..............  .........  ..............  ..............  ...........  ...........  ...........  $43,207,562
                                          --------------------------------------------------------------------------------------------------------------
    Total QE Impacts (application plus     ..............  .........  ..............  ..............  ...........  ...........  ...........  $49,003,203
     operations).........................
--------------------------------------------------------------------------------------------------------------------------------------------------------

2. Impact on Health Care Providers of Services and Suppliers
    Table 4 reflects the hourly labor rates used in our estimate of the 
impacts of the first year of section 1874(e) of the Act on health care 
providers of services and suppliers. We note that numerous health care 
payers, community quality collaboratives, States, and other 
organizations are producing performance measures for health care 
providers of services and suppliers using data from other sources, and 
that providers of services and suppliers are already receiving 
performance reports from these sources. We anticipate that the Medicare 
claims data would merely be added to those existing efforts to improve 
the statistical validity of the measure findings, and therefore the 
impact of including Medicare claims data in these existing performance 
reporting processes is likely to be marginal. However, we invite 
comments on the impact of this new voluntary program.

                         Table 4--Labor Rates for Provider and Supplier Impact Estimates
----------------------------------------------------------------------------------------------------------------
                                                                                Overhead and
                                                            2009 hourly wage   fringe benefits    Total hourly
                                                               rate (BLS)           (33%)             costs
----------------------------------------------------------------------------------------------------------------
Physicians' offices.......................................            $30.90            $10.20            $41.10
Hospitals.................................................             26.44              8.73             35.17
----------------------------------------------------------------------------------------------------------------

    We anticipate that the impacts on providers of services and 
suppliers consist of costs to review the performance reports generated 
by qualified entities and, if they choose, appeal their performance 
calculations. Based on a review of available information from the 
Better Quality Information and the Charter Value Exchange programs, we 
estimate that, on average, each qualified entity would distribute 
performance reports to 5,000 health providers of services and 
suppliers. We anticipate that the largest proportion of providers of 
services and suppliers would be physicians because they comprise the 
largest group of providers of services and suppliers, and are a primary 
focus of many recent performance evaluation efforts. Based on our 
review of information from these existing programs, we assume that 95 
percent of the recipients of performance reports (that is, an average 
of 4,750 per qualified entity) would be physicians, and 5 percent (that 
is, an average of 250 per qualified entity) would be hospitals and 
other suppliers. Providers of services and suppliers receive these 
reports with no obligation to review them, but we assume that most 
would do so to verify that their calculated performance measures 
reflect their actual patients and health events. We estimate that, on 
average, each provider of services or supplier would devote five hours 
to reviewing these reports. We also estimate that 25 percent of the 
providers of services and suppliers would decide to appeal their 
performance calculations, and that preparing the appeal would involve 
an average of ten hours of effort on the part of a provider of services 
or supplier. As with our assumptions regarding the level of effort 
required by qualified entities in operating the appeals process, we 
believe that this average covers a range of provider efforts from 
providers who would need just one or two hours to clarify any questions 
or concerns regarding their performance reports to providers who would 
devote significant time and resources to the appeals process.
    Using the hourly costs displayed in Table 4, the impacts on 
providers of services and suppliers are calculated below in Table 5. 
Based on the assumptions we have described, we estimate the total 
impact on providers for the first year of the program to be a cost of 
$38,262,815.
    As stated above in Table 3, we estimate the total impact on 
qualified entities to be a cost of $49,003,203. Therefore, the total 
impact on qualified entities and on providers of services and suppliers 
for the first year of the program is estimated to be $87,266,018.

[[Page 33585]]

                                Table 5--Impact on Providers of Services and Suppliers for the First Year of the Program
                                                     [Impact on Providers of Services and Suppliers]
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                   Hours per provider
                                                                ------------------------    Labor       Cost per    Number of    Number of    Total cost
                            Activity                              Physician              hourly cost   applicant    providers       QEs         impact
                                                                   offices    Hospitals                               per QE
--------------------------------------------------------------------------------------------------------------------------------------------------------
Provider review of performance reports.........................           5  ..........       $41.10         $206        4,750           25  $24,403,125
                                                                 ..........           5        35.17          176          250           25    1,099,063
Preparing and submitting appeal request to QEs.................          10  ..........        41.10          411         1188           25   12,206,700
                                                                 ..........          10        35.17          352           63           25      533,928
                                                                ----------------------------------------------------------------------------------------
    Total Provider Impacts.....................................  ..........  ..........  ...........  ...........  ...........  ...........   38,262,815
--------------------------------------------------------------------------------------------------------------------------------------------------------

C. Alternatives Considered

    The statutory provisions that were added by section 10332 of the 
Affordable Care Act are detailed and prescriptive about the eligibility 
for, and requirements of the Qualified Entity Program. Consequently, we 
believe there are limited approaches that would ensure program success 
and statutory compliance. We considered proposing a less comprehensive 
set of eligibility criteria for qualified entities (for example, 
eliminating requirements that applicants demonstrate capabilities 
related to calculation of measures, developing performance reports, 
combining Medicare claims data with other claims, and data privacy and 
security protection). While such an approach might have reduced certain 
application and operating costs for these entities, we did not adopt 
such an approach for several reasons. An important consideration is the 
protection of beneficiary identifiable data. We believe if we do not 
require qualified entities to provide sufficient evidence of data 
privacy and security protection capabilities, there would be increased 
risks related to the protection of beneficiary identifiable data.
    Additionally, we believe that requiring less stringent requirements 
regarding the production and reporting of measures would lead to 
increases in the number of provider appeals, and consequently in 
appeals-related costs of both providers and qualified entities. We 
expect that such a scenario would not support the development of a 
cooperative relationship between qualified entities and providers of 
services and suppliers. We request public comments on other approaches 
that could be considered.

D. Conclusion

    As explained above, we estimate the total impact for the first year 
of the program on qualified entities and providers to be a cost of 
$87,266,018. Based on these estimates, we conclude this proposed rule 
does not reach the threshold for economically significant effects and 
thus is not considered a major rule.
    In accordance with the provisions of Executive Order 12866, this 
regulation was reviewed by the Office of Management and Budget.

List of Subjects in 42 CFR Part 401

    Claims, Freedom of information, Health facilities, Medicare, 
Privacy.

    For the reasons set forth in the Preamble, the Centers for Medicare 
and Medicaid Services proposes to amend 42 CFR Chapter IV as set forth 
below:

PART 401--GENERAL ADMINISTRATIVE REQUIREMENTS

    1. The authority citation for part 401 is revised to read as 
follows:

    Authority:  Secs. 1102, 1871, and 1874(e) of the Social Security 
Act (42 U.S.C. 1302, 1395hh, and 1395w-5).

    2. A new subpart G is added to part 401 to read as follows:
Subpart G--Availability of Medicare Data for Performance Measurement
Sec.
401.701 Purpose and scope.
401.702 Definitions.
401.703 Eligibility criteria for qualified entities.
401.704 Operating and governance requirements for qualified 
entities.
401.705 The application process and requirements.
401.706 Updates to plans submitted as part of the application 
process.
401.707 Ensuring the privacy and security of data.
401.708 Selection and use of performance measures.
401.709 Provider of services and supplier requests for error 
correction.
401.710 Monitoring and sanctioning of qualified entities.
401.711 Termination of qualified entities.

Subpart G--Availability of Medicare Data for Performance 
Measurement

Sec.  401.701  Purpose and scope.

    The regulations in this subpart implement section 1874(e) of the 
Social Security Act as it applies to the Centers for Medicare & 
Medicaid Services (CMS). The rules apply to Medicare data made 
available to qualified entities for the evaluation of the performance 
of providers of services and suppliers.

Sec.  401.702  Definitions.

    (a) Qualified entity. A qualified entity is defined as a public or 
private entity that:
    (1) Is qualified, as determined by the Secretary, to use claims 
data to evaluate the performance of providers of services and suppliers 
on measures of quality, efficiency, effectiveness, and resource use, 
and
    (2) Agrees to meet the requirements described in Section 1874(e) of 
the Social Security Act and meets the requirements at Sec. Sec.  
401.703 through 401.710.
    (b) Provider of services. A provider of services under this subpart 
is defined in the same manner as the identical term at section 1861(u) 
of the Social Security Act.
    (c) Supplier. A supplier under this subpart is defined in the same 
manner as the identical term at section 1861(d) of the Social Security 
Act.
    (d) Claims. Claims are itemized billing statements from providers 
of services and suppliers that, except in the context of Part D drug 
event date, request reimbursement for a list of services and supplies 
that were provided to a Medicare beneficiary in the Medicare fee-for-
service context, or to a participant in other insurance or entitlement 
program contexts. In the Medicare program, claims files are available 
for each institutional (inpatient, outpatient, skilled nursing 
facility, hospice, or home health agency) and non-institutional 
(physician and durable medical equipment providers

[[Page 33586]]

and suppliers) claim type as well as Medicare Part D (Prescription 
Drug) Event data.
    (e) Standardized data extract. For purposes of this subpart, the 
standardized data extract is the subset of Medicare claims data that 
the Secretary would make available to qualified entities under this 
subpart.
    (f) Beneficiary identifiable data. For the purposes of this 
subpart, beneficiary identifiable data is any data that contains the 
beneficiary name or beneficiary name and any other direct identifying 
factors, including, but not limited to, race, sex, age, or address.
    (g) Encrypted data. For the purposes of this subpart, encrypted 
data is any data that does not contain the beneficiary name or any 
other direct identifying factors, but does include a unique beneficiary 
identifier that allows for the linking of claims without divulging the 
direct identifier of the beneficiary.

Sec.  401.703  Eligibility criteria for qualified entities.

    (a) Eligibility criteria: To be eligible to apply to receive data 
as a qualified entity under this section, an applicant generally must 
demonstrate expertise and sustained experience, defined as three or 
more years, to the Secretary's satisfaction in the following three 
areas:
    (1) Organizational and governance criteria, including:
    (i) Accurately calculating quality, efficiency, effectiveness, and 
resource use measures from claims data, including:
    (A) Indentifying an appropriate method to attribute a particular 
patient's services to specific providers of services and suppliers.
    (B) Ensuring the use of approaches to ensure statistical validity 
such as a minimum number of observations or minimum denominator for 
each measure.
    (C) Using methods for risk-adjustment to account for variation in 
both case-mix and severity among providers of services and suppliers.
    (D) Identifying methods for handling outliers.
    (E) Correcting measurement errors and assessing measure 
reliability.
    (F) Identifying appropriate peer groups of providers and suppliers 
for meaningful comparisons.
    (ii) A business model that would cover the costs of performing the 
required functions, including the fee for the data.
    (iii) Successfully combining claims data from different payers to 
calculate performance reports.
    (iv) Designing, and continuously improving the format of 
performance reports on providers of services and suppliers.
    (v) Preparing an understandable description of the measures used to 
evaluate the performance of providers of services and suppliers so that 
consumers, providers of services and suppliers, health plans, 
researchers, and other stakeholders can assess performance reports.
    (vi) Implementing and maintaining a process for providers of 
services and suppliers identified in a report to review the report 
prior to publication and providing a timely response to provider of 
services and supplier inquiries regarding requests for data, error 
correction, and appeals.
    (vii) Establishing, maintaining, and monitoring a rigorous data 
privacy and security program, including disclosing to CMS any 
inappropriate disclosures of beneficiary identifiable information or 
HIPAA violations for the preceding 10-year period, and any corrective 
actions taken to address such issues.
    (viii) Accurately preparing performance reports on providers of 
services and suppliers and making performance report information 
available to the public in aggregate form, that is, at the provider of 
services or supplier level.
    (2) Ability to combine Medicare claims data with claims data from 
other sources, including demonstrating to the Secretary's satisfaction 
that the claims data from other sources that it intends to combine with 
the Medicare data received under this subpart address many of the 
methodological concerns expressed by multiple stakeholders regarding 
the calculation of performance measures from a single payer source.
    (3) Documentation of rigorous data privacy and security policies 
including enforcement mechanisms.
    (b) [Reserved]

Sec.  401.704  Operating and governance requirements for qualified 
entities.

    (a) Submit to CMS a list of all measures it intends to calculate 
and report, the geographic areas it intends to serve, and the methods 
of creating and disseminating reports. This list must include the 
following information:
    (1) Name of the measure, and whether it is a standard or 
alternative measure,
    (2) Name of the measure developer/owner,
    (3) Measure specifications, including numerator and denominator,
    (4) The rationale for selecting each measure, including the 
relationship to existing measurement efforts and the relevancy to the 
population in the geographic area(s) the entity would serve, including:
    (i) A specific description of the geographic area or areas it 
intends to serve, and
    (ii) A specific description of how each measure evaluates providers 
of services and suppliers on quality, efficiency, effectiveness, and/or 
resource use.
    (5) A description of the methodologies it intends to use in 
creating reports with respect to all of the following topics:
    (i) Attribution of beneficiaries to providers and/or suppliers,
    (ii) Benchmarking performance data, including:
    (A) Methods for creating peer groups,
    (B) Justification of any minimum sample size determinations made, 
and
    (C) Methods for handling statistical outliers.
    (iii) Risk adjustment.
    (b) Submit to CMS a description of the process it would establish 
to allow providers of services and suppliers to view reports 
confidentially, request data, and ask for the correction of errors 
before the reports are made public.
    (c) Submit to CMS a prototype report and a description of their 
plans for making the reports available to the public.

Sec.  401.705  The application process and requirements.

    (a) Application deadline. Qualified entity applications must be 
submitted by March 31, 2012 and by the close of the first quarter of 
the calendar year each year thereafter.
    (b) Selection criteria. To be approved as a qualified entity under 
this subpart, the applicant must meet the eligibility and operational 
and governance requirements, and fulfill all of the application 
requirements to CMS' satisfaction, agree to pay a fee equal to the cost 
of CMS making the data available, and execute a Data Use Agreement with 
CMS, that among other things, reaffirms the statutory ban on the use of 
Medicare data provided to the qualified entity by CMS under this 
subpart for purposes other than those referenced in this subpart.
    (c) Duration of approval. The entity would be permitted to 
participate as a qualified entity for a period of three years from the 
date of notification of application approval by CMS. The qualified 
entity must abide by all CMS regulations and instructions for this 
program. If the qualified entity wishes to continue performing the 
tasks under this subpart after the three-year approval period, the 
entity may re-apply for qualified entity status following the 
procedures set forth below.
    (d) Reporting period. Unless otherwise specified, the qualified 
entities must produce reports on the

[[Page 33587]]

performance of providers of services and suppliers annually beginning 
in the calendar year after they are approved by CMS.
    (e) The distribution of data. Once a qualified entity is approved 
by CMS under this subpart, it would be required to pay a fee equal to 
the cost of CMS making this data available. After the qualified entity 
pays the fee, CMS would release claims data to the qualified entity.
    (1) CMS would release standardized extracts of encrypted data from 
Medicare parts A and B claims data, and D drug event data for the most 
recent three years of data available at that time. The data would be 
limited to the geographic spread of the qualified entity's other claims 
data as determined by CMS.
    (2) After the first year of participation, CMS would provide 
qualified entities with the most recent additional year of data on a 
yearly basis. Qualified entities would be required to pay a fee equal 
to the cost of CMS making this data available before CMS would release 
the most recent year of additional data to the qualified entity.
    (f) Re-application. Qualified entities in good standing may re-
apply for qualified entity status. A qualified entity would be 
considered in good standing if it has had no violations of the 
requirements of the program or if the qualified entity is addressing 
any past deficiencies either on its own or through the implementation 
of a corrective action plan. To reapply a qualified entity would need 
to submit to CMS documentation of any changes to what was included in 
their original application. Reapplicants would need to submit this 
documentation at least 6 months before the end of their three year 
approval period and would be able to continue to serve as qualified 
entities until the re-application is either approved or denied by CMS. 
If the re-application is denied, CMS would terminate its relationship 
with the qualified entity.

Sec.  401.706  Updates to plans submitted as part of the application 
process.

    (a) If a qualified entity wishes to make changes to:
    (1) Its list of proposed measures, the qualified entity must send 
all the information referenced in Sec.  401.704(a) for the new measure 
to CMS at least 90 days prior to its intended confidential release to 
providers of services and suppliers.
    (2) Its proposed prototype report, the qualified entity must send 
the new prototype report to CMS at least 90 days prior to its intended 
confidential release to providers of services and suppliers.
    (3) Its plans for sharing the reports with the public, the 
qualified entity must send the new plans to CMS at least 90 days prior 
to its intended confidential release to providers of services and 
suppliers.
    (b) The qualified entity would be notified when its proposed 
changes are approved or denied for use. Under no circumstances may a 
qualified entity issue a report, use a measure, or share a report 
without first obtaining CMS approval.
    (c) If the amount of claims data from other sources available to a 
qualified entity decreases, the qualified entity must immediately 
inform CMS and submit documentation that the remaining claims data from 
other sources is sufficient to address the methodological concerns 
regarding sample size and reliability. Under no circumstances may a 
qualified entity issue a report, use a measure, or share a report after 
this point.
    (1) If CMS determines that the remaining claims data is not 
sufficient, the qualified entity would have 60 days to acquire new data 
and submit new documentation to CMS. If after 60 days, the qualified 
entity does not have access to new data or if CMS decides the qualified 
entity still does not possess the need amount of additional claims 
data, CMS shall terminate its relationship with the qualified entity.
    (2) If CMS determines that the remaining claims data is sufficient, 
the qualified entity may resume issuing reports, using measures, and 
sharing reports.

Sec.  401.707  Ensuring the privacy and security of data.

    (a) Qualified entities must comply with the data requirements in 
the data use agreement (DUA) with CMS. The DUA would require the 
qualified entity to maintain privacy and security protocols throughout 
the duration of their agreement with CMS and would ban the use of data 
for purposes other than those referenced in this subpart. The DUA would 
also prohibit the use of unsecured telecommunications to transmit CMS 
data and would require disclosure of the circumstances under which CMS 
data would be stored and transmitted.
    (b) Qualified entities must inform each beneficiary whose 
beneficiary identifiable data has been or is reasonably believed to 
have been inappropriately accessed, acquired, or disclosed pursuant to 
the DUA.

Sec.  401.708  Selection and use of performance measures.

    (a) Standard measure. A standard measure is defined as a measure 
that can be calculated from the standardized extracts of Medicare Parts 
A and B claims, and Part D drug event data that:
    (1) Meets one of the following criteria:
    (i) Endorsed by the entity with a contract under section 1890(a) of 
the Social Security Act;
    (ii) Time-limited endorsed by the entity with a contract under 
Section 1890(a) of the Social Security Act until such time as the full 
endorsement status is determined;
    (iii) Developed pursuant to section 931 of the Public Health 
Service Act; or
    (iv) Can be calculated from standardized extracts of Medicare parts 
A or B claims or part D drug event data, was adopted through notice and 
comment rulemaking and is currently being used in CMS programs that 
include quality measurement.
    (2) Is used in a manner that follows the measure specifications as 
written (or as adopted through notice and comment rulemaking), 
including all numerator and denominator inclusions and exclusions, 
measured time periods, and specified data sources.
    (b) Alternative measure. (1) An alternative measure is defined as a 
measure that is not a standard measure, but that can be calculated from 
the standardized extracts of Medicare Parts A and B claims, and Part D 
drug event data that:
    (i) Has been found by the Secretary through a notice and comment 
rulemaking process, to be more valid, reliable, responsive to consumer 
preferences, cost-effective, or relevant to dimensions of quality and 
resource use not addressed by standard measures, and,
    (ii) Is used by a qualified entity in a manner that follows the 
measure specifications as written (or as adopted through notice and 
comment rulemaking), including all numerator and denominator inclusions 
and exclusions, measured time periods, and specified data sources.
    (2) An alternative measure may be used up until the point that a 
standard measure for the particular clinical area or condition becomes 
available at which point the qualified entity must switch to the 
standard measure within 6 months or submit additional scientific 
justification and receive approval from the Secretary to continue using 
the alternative measure.
    (3) To submit an alternative measure for consideration for use in 
the following calendar year an entity must submit the following by May 
31st:

[[Page 33588]]

    (i) The name of the alternative measure.
    (ii) The name of the alternative measure's developer or owner.
    (iii) Detailed specifications for the alternative measure.
    (iv) Information demonstrating how the alternative measure is more 
cost-effective, relevant to consumer preferences, cost-effective, or 
relevant to dimensions of quality and resource use not addressed by 
standard measures.

Sec.  401.709  Provider of services and supplier requests for error 
correction.

    (a) Qualified entities must confidentially share measures, 
measurement methodologies, and measure results with providers of 
services and suppliers at least 30 business days prior to making 
reports public. The 30 days begins on the date on which qualified 
entities send the confidential reports to providers of services and 
suppliers.
    (b) Qualified entities must allow providers of services and 
suppliers at least 10 business days after receipt of a report to make a 
request for the data.
    (c) Qualified entities must allow providers of services and 
suppliers at least 10 business days after receipt of the data to make a 
request for error correction.
    (d) If a qualified entity receives a request for beneficiary names 
from a provider of services or supplier, the qualified entity must 
forward that request to CMS including a copy of the signed request from 
the provider of services or supplier as an attachment.
    (1) After the qualified entity receives the beneficiary names from 
CMS and sends the information to the requesting provider of services or 
supplier, the qualified entity must immediately destroy that data and 
is not permitted to retain or use the beneficiary names in any way.
    (2) If a qualified entity does not immediately destroy all 
identifiable data after sharing the information with the requesting 
provider of services or supplier, it will be subject to the penalties 
referenced in Sec.  401.710(d).
    (e) Qualified entities must inform providers of services and 
suppliers that reports would be made public, including information 
related to the status of any data or error correction requests, after a 
specified date (at least 30 business days after the report was 
originally shared with providers of services and suppliers), regardless 
of the status of any requests for error correction.
    (f) If a provider of services or supplier still has a data or error 
correction request outstanding at the time of making the reports 
public, the qualified entity must, if feasible, post publicly the name 
of the appealing provider and the category of the appeal request.

Sec.  401.710  Monitoring and sanctioning of qualified entities.

    (a) CMS would monitor and assess the performance of qualified 
entities using the following methods:
    (1) Audits
    (2) Submission of documentation of data sources and quantities of 
data upon the request of CMS and/or site visits
    (3) Analysis of specific data reported to CMS by qualified entities 
through annual reports, as described in paragraph (b) of this section, 
and reports on inappropriate disclosures or uses of beneficiary 
identifiable data, as described in paragraph (c) of this section.
    (4) Analysis of beneficiary and/or provider complaints
    (b) Qualified entities must provide annual reports to CMS 
containing information related to:
    (1) General program adherence, including:
    (i) The number of Medicare and private claims combined.
    (ii) The percent of the overall market share the number of claims 
represents in the qualified entity's area.
    (iii) The number of measures calculated.
    (iv) The number of providers of services and suppliers profiled by 
type of provider and supplier.
    (v) A measure of public use of the reports.
    (2) The provider of services and suppliers data sharing, error 
correction, and appeals process, including:
    (i) The number of providers of services and suppliers requesting 
claims data.
    (ii) The number of requests for claims data fulfilled.
    (iii) The number of error corrections.
    (iv) The type(s) of problem(s) leading to the request for error 
correction.
    (v) The time to acknowledge the request for data or error 
correction.
    (vi) The time to respond to the request for error correction.
    (vii) The number of requests for error correction resolved.
    (c) Qualified entities must inform CMS of inappropriate disclosures 
or uses of beneficiary identifiable data pursuant to the requirements 
in the DUA.
    (d) CMS may take the following actions against qualified entities 
if it is determined that they are violation of any of the requirements 
of the qualified entity program, regardless of how CMS learns of the 
violation:
    (1) Provide a warning notice, which indicates that future 
deficiencies could lead to termination, to the qualified entity of the 
specific concern
    (2) Request a corrective action plan (CAP) from the qualified 
entity
    (3) Place the qualified entity on a special monitoring plan
    (4) Terminate the qualified entity

Sec.  401.711  Termination of qualified entities.

    (a) Grounds for terminating a qualified entity agreement. CMS may 
terminate an agreement with a qualified entity if the qualified entity:
    (1) Engages in one or more serious violations of the requirements 
of the qualified entity program.
    (2) Fails to completely and accurately report information to CMS or 
fails to make timely corrections to reported performance information 
per providers of services and supplier requests for such correction.
    (3) Fails to submit an approvable corrective action plan (CAP), 
fails to implement an approved CAP, or fails to demonstrate improved 
performance after the implementation of a CAP.
    (4) Improperly uses or discloses claims information received from 
CMS in violation of the requirements of the regulations in this 
subpart.
    (5) Based on their reapplication, no longer meets the requirements 
in this subpart.
    (b) Return of CMS data upon voluntary or involuntary termination 
from the qualified entity program:
    (1) If a qualified entity's agreement with CMS is terminated by 
CMS, it must immediately upon receipt of notification of such 
termination commence returning or destroying any and all CMS data (and 
any derivative files). In no instance should this process exceed 30 
days.
    (2) If a qualified entity voluntarily terminates participation in 
the program, it must return to CMS, or destroy, any and all CMS data in 
its possession within 30 days notifying CMS of its intent to end 
participation.

(Catalog of Federal Domestic Assistance Program No. 93.773, 
Medicare--Hospital Insurance; and Program No. 93.774, Medicare--
Supplementary Medical Insurance Program)

    Dated: May 4, 2011.
Donald M. Berwick,
Administrator, Centers for Medicare & Medicaid Services.
    Approved: June 1, 2011.
Kathleen Sebelius,
Secretary, Department of Health and Human Services.
[FR Doc. 2011-14003 Filed 6-3-11; 11:15 am]
BILLING CODE 4120-01-P
```