76542 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

42 CFR Part 401 

[CMS–5059–F] 

RIN 0938–AQ17 

Medicare Program; Availability of 

Medicare Data for Performance 

Measurement 

AGENCY: Centers for Medicare & 

Medicaid Services (CMS), HHS. 

ACTION: Final rule. 

SUMMARY: This final rule implements 

Section 10332 of the Affordable Care 

Act regarding the release and use of 

standardized extracts of Medicare 

claims data for qualified entities to 

measure the performance of providers of 

services (referred to as providers) and 

suppliers. This rule explains how 

entities can become qualified by CMS to 

receive standardized extracts of claims 

data under Medicare Parts A, B, and D 

for the purpose of evaluation of the 

performance of providers and suppliers. 

This rule also lays out the criteria 

qualified entities must follow to protect 

the privacy of Medicare beneficiaries. 

DATES: Effective Date: These regulations 

are effective January 6, 2012. 

FOR FURTHER INFORMATION CONTACT: 

Colleen Bruce, (410) 786–5529. 

SUPPLEMENTARY INFORMATION: 

I. Background 

The Patient Protection and Affordable 

Care Act (Pub. L. 111–148), enacted on 

March 23, 2010, and the Health Care 

and Education Reconciliation Act of 

2010 (Pub. L. 111–152), enacted on 

March 30, 2010, are collectively referred 

to in this final rule as the ‘‘Affordable 

Care Act.’’ Effective January 1, 2012, 

section 10332 of the Affordable Care Act 

would amend section 1874 of the Social 

Security Act (the Act) by adding a new 

subsection (e) requiring standardized 

extracts of Medicare claims data under 

parts A, B, and D to be made available 

to ‘‘qualified entities’’ for the evaluation 

of the performance of providers and 

suppliers. Qualified entities may use the 

information obtained under section 

1874(e) of the Act for the purpose of 

evaluating the performance of providers 

and suppliers, and to generate public 

reports regarding such performance. 

Qualified entities may receive data for 

one or more specified geographic areas 

and must pay a fee equal to the cost of 

making the data available. Congress also 

required that qualified entities combine 

claims data from sources other than 

Medicare with the Medicare data when 

evaluating the performance of providers 

and suppliers. 

Section 1874(e) of the Act requires 

potential qualified entities that wish to 

request data under this provision to 

submit an application to the Secretary 

that includes, among other things, a 

description of the methodologies that 

the applicant proposes to use to 

evaluate the performance of providers 

and suppliers in the geographic area(s) 

they select. Qualified entities generally 

must use standard measures for 

evaluating the performance of providers 

and suppliers unless the Secretary, in 

consultation with appropriate 

stakeholders, determines that use of 

alternative measures would be more 

valid, reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by standard measures. 

Reports generated by the qualified 

entities may only include information 

on individual providers and suppliers 

in aggregate form, that is, at the provider 

or supplier level, and may not be 

released to the public until the 

providers and suppliers have had an 

opportunity to review them and, if 

necessary, ask for corrections. Congress 

included a provision at section 

1874(e)(3) of the Act to allow the 

Secretary to take such actions as may be 

necessary to protect the identity of 

individuals entitled to or enrolled in 

Medicare. 

We believe the sharing of Medicare 

data with qualified entities through this 

program and the resulting reports 

produced by qualified entities will be an 

important driver of improving quality 

and reducing costs in Medicare, as well 

as for the health care system in general. 

Additionally, we believe this program 

will increase the transparency of 

provider and supplier performance, 

while ensuring beneficiary privacy. 

II. Provisions of the Proposed Rule and 

Analysis of and Responses to Public 

Comments 

We received approximately 100 

comments from a wide variety of 

individuals and organizations. About 

half of the comments were from 

providers and suppliers, or 

organizations representing providers 

and suppliers. The other half of the 

comments were from organizations 

engaged in performance measurement or 

data aggregation that may potentially be 

approved to receive Medicare data as 

qualified entities under this program. 

We also received a number of comments 

from consumer advocacy organizations. 

A. Definition, Eligibility Criteria, and 

Operating Requirements of Qualified 

Entities 

Almost all of the comments were 

positive and praised CMS’ proposals 

regarding how the qualified entity 

program would operate. Commenters 

also had a range of suggestions for how 

CMS should administer the program, 

including several comments on 

performance measurement in general. 

We also received numerous comments 

on data privacy and security, which are 

discussed in more detail in subsection 

D below. 

1. Definitions 

In the proposed rule, we defined a 

qualified entity as a public or private 

entity that meets two standards. The 

first is that the entity is qualified, as 

determined by the Secretary, to use 

claims data to evaluate the performance 

of providers and suppliers on measures 

of quality, efficiency, effectiveness, and 

resource use. The second is that the 

entity agrees to meet the requirements 

described in Section 1874(e) of the 

Social Security Act and at §§ 401.703– 

401.710 of the proposed rule. 

Comment: We received several 

comments, suggestions, and questions 

regarding the use of the Medicare data 

qualified entities receive through this 

program. Section 1874(e)(4)(B) of the 

Act specifies the uses of the Medicare 

data. Some commenters requested that 

qualified entities be allowed to use the 

data for purposes other than 

performance reporting, such as internal 

analyses, pay-for-performance 

initiatives, and provider tiering; other 

commenters requested that CMS clarify 

that the data provided would be used 

for performance reporting only. 

Response: The statute bars the re-use 

of the Medicare claims data provided to 

qualified entities under section 1874(e) 

of the Social Security Act (the Act). 

Section 1874(e)(4)(D) provides that the 

qualified entity ‘‘shall only use such 

data, and information derived from such 

evaluation’’ for performance reports on 

providers and suppliers. Additionally, 

the Data Use Agreement (DUA, 

discussed in more detail below) bars reuse of the data for other purposes; 

violation of the DUA may result in a 

qualified entity’s access to data under 

1874(e) of the Act being terminated. 

However, while the data itself and any 

derivative data may only be used for 

creating the prescribed reports, section 

1874(e) does not address the use of the 

publically reported result. Subject to 

any limitations imposed by other 

applicable laws (for example, copyright 

laws), these publicly reported results 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76543 

could be used by any party, including 

the qualified entity, for activities such 

as internal analyses, pay-forperformance initiatives, or provider 

tiering. 

Qualified entities will not be allowed 

to do performance measurement with 

Medicare data alone. Section 

1874(e)(4)(B)(iii) specifically provides 

that qualified entities must include 

‘‘claims data from sources other than 

claims data under this title in the 

evaluation of performance of providers 

of services and suppliers.’’ We have 

added a definition of ‘‘claims data from 

other sources’’ at § 401.703(h). 

We have made several technical 

changes to the definitions at § 401.703 

to reflect the regulatory interpretation of 

the statutory provisions cited in the 

proposed rule. We have modified the 

definition of a qualified entity to require 

the entity to agree to meet the 

requirements in §§ 401.705–401.721 of 

the final rule, removing the proposed 

rule’s reference to section 1874(e) of the 

Act. We have also modified the 

definitions of provider and supplier; 

specifically we have defined both terms 

in terms of the definitions for the 

identical terms at § 400.202. 

We have also added a definition of 

clinical data. This addition is discussed 

in further detail below. 

2. Eligibility Criteria 

In determining the eligibility 

standards for qualified entities we 

sought to balance the needs to: (1) 

Ensure the production of timely, high 

quality, and actionable reports on the 

performance of providers and suppliers, 

(2) protect beneficiary privacy and 

security, and (3) ensure providers and 

suppliers have an appropriate amount of 

time to review the reports, appeal, and, 

if necessary, correct errors prior to 

public reporting. We therefore proposed 

to evaluate an organization’s eligibility 

to serve as a qualified entity across three 

areas: Organizational and governance 

capabilities, addition of claims data 

from other sources, and data privacy 

and security. 

Additionally, we proposed not to 

limit the number of qualified entities 

eligible to serve in an area. Any entity 

that satisfactorily meets the eligibility 

criteria would be able to participate in 

the program. 

Comment: We received several 

comments on the eligibility criteria as a 

whole. Many commenters supported the 

proposed eligibility standards; however 

others said the eligibility standards were 

too prescriptive. Several commenters 

asked CMS to clarify qualified entities’ 

ability to combine expertise across more 

than one entity to meet the requirements 

in the rule related to experience or 

amount of other claims data. 

Response: We thank commenters for 

their support for the eligibility 

standards. While we understand that the 

eligibility standards necessitate that 

prospective qualified entities have 

extensive experience in performance 

measurement, access to data, and 

appropriate privacy and security 

protocols, we believe these standards 

are essential to ensure both the privacy 

and security of beneficiary data and the 

acceptance of the program by providers 

and suppliers. 

We clarify, however, that qualified 

entities do not need to be composed of 

a single legal entity. A qualified entity 

applicant may contract with other 

entities to achieve the ability to meet the 

eligibility criteria. If an entity chooses to 

contract with one or more other entities 

to meet the eligibility standards, the 

application must be submitted by one 

lead entity. This lead entity must submit 

documentation describing the 

contractual relationships that exist 

between and among all entities applying 

together under the lead entity to become 

a qualified entity. In addition, as 

discussed in subsection D.1. below, 

contractors will be required to abide by 

the same privacy and security 

requirements as the lead entity, 

including signing a data use agreement 

prior to being given access to Medicare 

claims data or beneficiary information. 

Contractors will also be subject to CMS 

monitoring and their actions may result 

in sanctions and/or termination of the 

qualified entity. 

We believe that requiring contractual 

arrangements among the members of 

such a group will ultimately protect 

both the providers and suppliers 

receiving reports, as well as the 

beneficiaries seeking to use this 

information to make health care 

decisions by ensuring that the lead 

entity has partners with the necessary 

expertise to carry out the duties of a 

qualified entity and that the qualified 

entity’s partners are committed to the 

project through legally enforceable 

agreements. 

In a contractual arrangement, there 

would be breach of contract liability if 

one of the members of the group fails to 

deliver, and there would be the 

potential of collecting damages for that 

failure to perform. Such damages would 

potentially provide the lead entity with 

the resources that would be necessary 

for finding and hiring another entity to 

carry out the functions of a contractor/ 

subcontractor that failed to perform. 

Any other less formal arrangement 

among a group of entities that, in sum, 

possessed the requisite traits required of 

a qualified entity, such as a partnership 

or other consortium-like affiliation, 

would not offer the breach of contract 

protections that would provide 

assurances that the entities listed as 

participants in the group would in fact 

provide the services/skills/resources 

that the qualified entity applicant 

asserts. In a non-contractual 

arrangement, participating members of 

the group could stop performing at any 

time, leaving the remainder of the group 

with little recourse and, possibly, not 

qualified to carry on as a qualified 

entity. This could prevent the issuance 

of the desired reports. It could also leave 

providers and suppliers, as well as 

beneficiaries, without any recourse for 

remedying reporting errors or answering 

questions related to the reports. This 

would have a very negative effect on the 

program as a whole, and jeopardize this 

important transparency effort. 

We emphasize that a single entity may 

seek to fulfill all of the eligibility 

standards; there is no requirement that 

a qualified entity must be a group of two 

or more entities. However, we believe 

that more potential qualified entities 

would apply if they use contractual 

relationships to address any 

requirements that they may be lacking. 

Comment: Several commenters 

suggested additions to the eligibility 

standards. A handful of commenters 

recommended adding a public input 

component as part of the eligibility 

process. Commenters also suggested 

evaluating provider complaints against 

applicants when making determinations 

about qualified entity eligibility. One 

commenter asked CMS to create a 

provisional track for entities without the 

necessary experience or the nonMedicare data to serve as a qualified 

entity in the general program. 

Response: Through evaluating each 

entity’s (including the lead entity’s and 

any contractors’) past experience, other 

claims data, and privacy and security 

protocols, we are confident that entities 

approved as qualified entities will meet 

the requirements of the program. 

Extensive monitoring requirements for 

the lead entity and any contractors, as 

well as the ability to terminate our 

agreement with a qualified entity, will 

ensure that the highest standards are 

adhered to by all qualified entities. 

However, we are interested in 

beneficiary and/or provider complaints 

against a qualified entity once that 

entity is approved. As discussed below 

in section II.F., we have included an 

analysis of beneficiary and/or provider 

complaints as part of the monitoring 

and performance assessment of 

qualified entities. 


emcdonald on DSK5VPTVN1PROD with RULES2
76544 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

While we appreciate the interest in 

allowing a variety of organizations to 

serve as qualified entities, we believe a 

provisional track is not consistent with 

the requirement in the statute that 

entities be qualified, as determined by 

the Secretary, to use claims data to 

evaluate provider and supplier 

performance. We hope that the 

discussion above, which notes that 

potential qualified entity applicants 

may form contractual agreements to 

meet the eligibility requirements, will 

allow entities with less experience or 

limited other claims data to gain the 

necessary expertise or gather the needed 

data to be approved as a qualified 

entities. We also have added a 

conditional approval process, discussed 

in more detail below, for those 

applicants that do not have access to 

claims data from other sources at the 

time of their application. 

Comment: We received several 

comments requesting CMS limit the 

organizations eligible to serve as 

qualified entities to non-profit and 

government organizations. However, we 

also received comments asking CMS to 

continue to allow any organization that 

meets the eligibility requirements and 

submits an application to serve as a 

qualified entity. 

Response: On balance, we believe it is 

appropriate for CMS to continue to 

allow any organization that meets the 

eligibility requirements and the 

requirements at sections §§ 401.703– 

401.710 of the proposed rule to serve as 

a qualified entity, which appear, as 

modified in the following discussion, in 

sections §§ 401.705–401.721 of this final 

rule. 

Comment: While we received several 

comments supporting our proposal not 

to limit the number of qualified entities 

in a geographic region, we also received 

comments suggesting we limit the 

number of qualified entities eligible to 

serve in an area. Many of those who 

suggested limiting the number of 

qualified entities in an area expressed 

concern that allowing multiple qualified 

entities in a region would lead to 

multiple reports on the same provider or 

supplier, which would confuse both the 

individual or entity being measured and 

the consumer. One commenter 

suggested CMS take a phased approach 

to the number of qualified entities, 

allowing providers to get accustomed to 

measurement before expanding the 

number of qualified entities. 

Response: We acknowledge 

commenters’ desire to limit the number 

of reports on a provider or supplier; 

however, we do not anticipate many 

regions will have multiple entities that 

meet the requirements to serve as 

qualified entities. Specifically, it is 

difficult to imagine there will be many 

areas where multiple organizations will 

possess sufficient claims data from other 

sources. Additionally, we believe 

allowing all eligible organizations to 

serve as qualified entities will 

encourage innovation in measure 

development and performance 

reporting. In the case that there are 

multiple organizations in an area that 

could serve as individual qualified 

entities, we would like to reiterate that 

these organizations could form 

contractual arrangements with each 

other and apply for the program under 

a lead applicant. 

a. Organizational and Governance 

Capabilities 

Under organizational and governance 

capabilities, we proposed to evaluate 

the applicant’s capability to perform a 

variety of tasks related to serving as a 

qualified entity. Tasks included the 

ability to accurately calculate measures 

from claims data, successfully combine 

claims data from different payers, 

design performance reports, prepare an 

understandable description of measures, 

implement a report review process for 

providers and suppliers, maintain a 

rigorous data privacy and security 

program, and make reports containing 

provider and supplier level data 

available to the public. We proposed to 

generally require applicants to 

demonstrate expertise and sustained 

experience on each of the criteria, 

which could be demonstrated by three 

or more years of experience in each 

area. We also proposed to consider 

applications with fewer years 

experience handling claims data and 

calculating measures, and/or limited 

experience implementing or 

maintaining a report review process for 

providers and suppliers as long as the 

applicant has sufficient experience in 

all other areas. 

Comment: Commenters had mixed 

opinions about the proposed 

requirement of three or more years of 

experience. Commenters who did not 

support a minimum three years 

experience were concerned about 

limiting eligibility of otherwise viable 

entities. On the other hand, commenters 

who strongly supported the eligibility 

criteria suggested lengthening the time 

requirement to five years. 

Response: While we are sensitive to 

the desire to allow all interested 

organizations to serve as qualified 

entities, we believe that many viable 

entities will possess three years of 

experience, particularly now that we 

have clarified that a qualified entity may 

contract with other entities in order to 

demonstrate required experience. It is 

essential for the success of the qualified 

entity program that organizations 

approved as qualified entities have the 

necessary expertise and experience to 

successfully perform all the functions 

required in the statute. We believe the 

experience requirements we have 

included are sufficient to ensure 

organizations approved as qualified 

entities possess the necessary 

experience to successfully meet the 

requirements of the program. 

Comment: Commenters suggested 

changes to specific tasks in the 

organizational and governance 

capabilities section of the eligibility 

criteria. Several commenters asked CMS 

to only require expertise in the areas of 

measurement the entity is proposing to 

use instead of all four areas of 

measurement: Quality, efficiency, 

effectiveness, and resource use. 

Similarly, commenters also noted that 

not all measures require risk-adjustment 

and requested CMS only require 

experience in risk-adjustment if the 

entity is planning on using measures 

that incorporate risk-adjustment. 

Commenters also recommended 

removing the requirement that 

organizations have experience 

successfully combining claims data 

from different payers, arguing that this 

requirement would necessitate that 

applicants currently have data from two 

or more payers other than Medicare. 

Response: We agree with commenters 

about the proposal that would have 

required expertise in all four areas of 

measurement. As a result, we are 

modifying the eligibility requirements 

related to these areas of performance 

measurement and will require all 

applicants to have experience 

calculating quality measures, and, to the 

extent that they propose using such 

measures, experience calculating 

efficiency, effectiveness and resource 

use measures. Similarly, we will only 

require entities to have experience with 

risk-adjustment, if they propose using 

measures requiring risk adjustment. 

Finally, the law requires that a qualified 

entity combine data from different 

payers, so we will retain that 

requirement in this final rule. 

Comment: One commenter requested 

that CMS only approve applicants with 

a demonstrated track record of working 

with providers and suppliers and 

helping them with quality 

improvement. 

Response: While we hope this 

program will support quality 

improvement efforts, the statute only 

requires qualified entities to 

confidentially make reports available 

prior to publication and to allow 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76545 

providers and suppliers the opportunity 

to request error correction. We believe 

that our requirement that applicants 

submit documentation of experience in 

both maintaining a process for providers 

and suppliers to review their reports 

prior to publication, and providing 

timely response to requests for error 

correction will be adequate to ensure an 

applicant’s ability to work with 

providers and suppliers to ensure the 

availability of reports and appropriate 

correction mechanisms. 

Comment: We received several 

comments on our proposal to require 

applicants to disclose inappropriate 

disclosures of beneficiary identifiable 

information. Specifically, one 

commenter suggested that requiring 

disclosure of a 10-year privacy breach 

history is unreasonable. Another 

commenter requested that CMS include 

a requirement that applicants disclose 

confirmed violations of State privacy 

laws, in addition to inappropriate 

disclosures of beneficiary identifiable 

information. 

Response: We believe that requiring 

an applicant to disclose 10 years’ worth 

of inappropriate disclosures of 

beneficiary information is a reasonable 

requirement, but we recognize that some 

applicants may not have a 10 year 

history. For those entities that do not 

have a 10 year history, we will require 

reporting the required information for 

the length of time the organization has 

been in existence. We clarify, however, 

that a qualified entity’s application to 

receive Medicare data will be evaluated 

based on all of the information 

submitted; a past inappropriate 

disclosure of beneficiary identifiable 

information will not automatically 

disqualify an entity from participation 

in the program. If an entity’s application 

lists these events, CMS will engage in 

further discussions with that applicant 

to determine what corrective processes 

the entity has put in place to avoid 

future inappropriate disclosure of 

beneficiary identifiable information. We 

agree that violations of State, as well as 

federal, privacy and security laws 

should also be submitted to CMS and 

will add this requirement to the 

eligibility criteria. For clarity, we have 

rephrased the proposed language in 

§ 410.705(a)(1)(vii) that referred to 

violations of State privacy laws or 

HIPAA violations to read ‘‘violations of 

applicable federal and State privacy and 

security laws and regulations’’ to 

encompass the full range of information 

privacy and security laws and 

regulations at both the federal and State 

levels with which the applicant may 

have to comply. In addition to 

demonstrating experience and expertise, 

we also proposed to require qualified 

entities to submit a business model for 

covering the cost of required functions. 

Comment: Some commenters argued 

that requiring prospective applicants to 

submit a business model is too 

prescriptive, while others were 

supportive of this requirement. A 

handful of commenters asked CMS for 

guidance on financing mechanisms, as 

well as whether they could change a fee 

for the reports or license the data for 

secondary use. 

Response: In requiring submission of 

a business model, it was not our intent 

to be overly prescriptive. Rather, we 

were seeking to ensure that the qualified 

entities would have the resources 

necessary to carry out what we expect 

would be a relatively resource-intensive 

and important undertaking. We expect 

that by requiring submission of a 

business plan qualified entities would 

be more likely to have a viable business 

model under which they would be able 

to carry out their obligations under the 

qualified entity program. We do not 

intend to limit an organization’s ability 

to change or adapt its business plan 

once approved as a qualified entity. We 

only ask that the qualified entity 

demonstrate that it has thought through 

what it would need to do to succeed. 

Finally, as for financing mechanisms, 

we note that the qualified entity 

program regulations do not generally 

place any added limitations on what is 

otherwise feasible under applicable 

laws. For example, the content of the 

publicly released reports will be subject 

to existing laws on copyright. Qualified 

entities cannot, however, charge 

providers or suppliers for the 

confidential copies of the prepublication reports that qualified 

entities are required to provide in 

advance of publication. Furthermore, 

qualified entities must publically report 

measure results free of charge and in a 

manner that is consistent with the 

requirements in Section 1874(e)(4)(C) of 

the Act. We encourage qualified entities 

to be innovative in creating business 

models to support their efforts. 

b. Addition of Claims Data From Other 

Sources 

In accordance with the statutory 

requirements at section 

1874(e)(4)(B)(iii), we proposed to 

require entities to have claims data from 

non-title 18 (Medicare) sources to 

combine with Medicare data. We 

proposed to require possession of such 

other data at the time of their 

application. We defined claims data as 

administrative claims, meaning data 

that is not chart-abstracted data, registry 

data, or data from electronic health 

records. We proposed to require entities 

to demonstrate to CMS that the other 

claims data they possess is sufficient to 

address issues of sample size and 

reliability expressed by stakeholders 

regarding the calculation of performance 

measures from a single payer source. We 

also requested comment on whether 

CMS should require entities to possess 

claims data from two or more other 

sources to be eligible to serve as a 

qualified entity. 

Comments: Some commenters were 

supportive of the requirement that 

entities possess claims data from other 

sources at the time of application, but 

others argued that this requirement is 

too restrictive and not consistent with 

the intent of the statute. Specifically, 

commenters argued that it might be 

difficult to acquire claims data from 

other sources without approval from 

CMS to serve as a qualified entity. Other 

commenters sought clarification on 

whether qualified entities had to 

physically possess claims data from 

other sources or whether agreements 

with owners of claims data from other 

sources and proof of a functioning 

distributed data approach, meaning that 

claims data from different sources 

residing at different physical locations 

as long as measure results could be 

securely and accurately aggregated, 

would suffice. 

Response: While most organizations 

that are experienced in performance 

measurement will already have claims 

data they are using for performance 

measurement, we understand 

commenters’ concerns about the 

requirement that entities possess claims 

data from other sources at the time of 

application. Therefore, for those 

applicants that do not have access to 

other claims data at the time of their 

application, we will create a conditional 

approval process. First, applicants that 

are found to meet all the requirements 

of the program, but do not have access 

to other claims data at the time of their 

application, will receive a conditional 

acceptance. Then, once an entity with a 

conditional acceptance gets access to 

adequate claims data from other 

sources, it will submit documentation 

that the claims data from other sources 

that it intends to combine with the 

Medicare data received under this 

subpart address the methodological 

concerns regarding sample size and 

reliability that have been expressed by 

stakeholders regarding the calculation of 

performance measures from a single 

payer source. CMS will review the 

documentation and if the amount of 

other claims data is found to be 

sufficient, the entity will pay a fee equal 

to the cost of CMS making the data 


emcdonald on DSK5VPTVN1PROD with RULES2
76546 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

available and execute a Data Use 

Agreement (DUA) with CMS to be 

approved as a qualified entity. A 

conditionally approved qualified entity 

will not be eligible to receive Medicare 

claims data or the beneficiary crosswalk 

(discussed further in Section D.1) until 

it has received full approval, pays a fee 

equal to the cost of making the data 

available, and signs a DUA. 

This conditional approval process 

will be in addition to the normal 

approval process that will remain in 

place for those applicants that have 

access to a sufficient amount of other 

claims data at the time of their 

application. Additionally, we want to 

clarify that distributed data approaches, 

as described above, are permissible 

under the scope of this program. 

Comment: We received several 

comments asking CMS to clarify the 

amount of other claims data applicants 

must possess. Commenters also asked if 

CMS would consider Medicaid data to 

be other claims data. 

Response: As stated in the proposed 

rule, we do not believe it is feasible to 

establish an absolute threshold for a 

minimum amount of additional claims 

data. Rather, we ask applicants to 

explain how the data they do have for 

use in the qualified entity program will 

be adequate to address the concerns 

about small sample size and reliability 

that have been expressed by 

stakeholders regarding the calculation of 

performance measures from a single 

payer source. Each application will be 

evaluated on its collective merits, 

including the amount of claims data 

from other sources and its explanation 

on why that data, in combination with 

the requested Medicare data, is adequate 

for the stated purposes of this program. 

‘‘Other claims data’’ can include 

Medicaid data as well as any private 

payer claims data. 

Comment: We also received mixed 

comments on our proposal to require 

organizations to have two or more data 

sources at the time of application. Some 

commenters said this requirement 

seemed appropriate, while others 

argued it was too burdensome. One 

commenter argued that unless combined 

data represents at least 90 percent of a 

provider’s practice, any resulting quality 

measurements will not be meaningful. 

Response: We based our proposal 

about acquiring data from two or more 

sources on the interests of providers, 

suppliers, and consumers to have 

reports that provide valid results that 

cover an adequate portion of the 

providers’ or suppliers’ patients. 

However, in certain cases, one source 

may provide a sufficient amount of 

other claims data such that, when the 

other claims data is combined with 

Medicare data, it covers a considerable 

portion of a provider’s or supplier’s 

patients. We will therefore not require 

an applicant to have two sources of 

additional claims data, but we note that 

claims data from two or more sources is 

preferable to data from only one other 

source. We acknowledge that it is 

important for the combined data to 

represent a large portion of a provider’s 

business, but believe an arbitrary 

requirement of 90 percent is 

unnecessarily high, especially given that 

the program is just beginning. 

c. Data Privacy and Security 

We proposed to require applicants to 

demonstrate their capabilities to 

establish, maintain, and monitor a 

rigorous privacy and security program, 

including programs to educate staff on 

privacy and data security protocols. 

Comments related to the proposed 

data privacy and security eligibility 

criteria requirements are covered in the 

Data Security and Privacy section below 

in section II.D. of this final rule. 

3. Operating and Governance 

Requirements for Serving as a Qualified 

Entity 

We require documentation of 

operating and governance requirements 

at the time of application for several key 

activities. We proposed that applicants 

would submit as part of their 

application: (1) The measures they 

intend to use, including methodologies 

and a rationale for using the measure; 

(2) the report review process they would 

use with providers and suppliers, 

including addressing requests for data 

and error correction; and (3) a prototype 

for required reports, including the 

methods for disseminating reports. 

Comments: We received several 

comments that the submission of 

measures and methodologies, as well as 

a prototype for reports at the time of 

application is too burdensome. 

Additionally, commenters argued that 

90 days notice for approval of changes 

was too long and that certain types of 

minor changes to the report prototype 

need not trigger CMS approval. Several 

commenters also argued that submitting 

specifications on standard measures is 

unnecessary since these measures have 

established specifications and are 

generally publically available. 

Response: We understand 

organizations’ desire to have flexibility 

in selecting measures and report 

formats. We also believe that making 

these decisions is a key aspect of serving 

as a qualified entity and is important 

enough to require the submission of 

proposed plans prior to being approved 

as a qualified entity. However, we 

recognize commenters’ desire to ensure 

measures and report formats are 

approved and available for use as 

quickly as possible. Therefore, we will 

change the timeframe for CMS approval 

to 30 days. Qualified entities may 

change selected measures, and may 

modify their report prototype, with 30 

days notice to CMS and CMS approval 

of the changes or modifications. We 

believe that the majority of changes 

proposed by qualified entities will be 

straightforward and CMS will be able to 

comfortably conduct a review and 

approval within 30 days of submission; 

however, in certain circumstances CMS 

may request an additional 30 days to 

approve more wide-reaching changes or 

modifications. If a CMS decision on 

approval or disapproval for a change or 

modification is not forthcoming within 

30 days and CMS does not request an 

additional 30 days for review, the 

change or modification shall be deemed 

to be approved. 

We acknowledge the interest in only 

requiring CMS approval for substantive 

changes in the prototype reports. 

However, as it is the first year of the 

program, we are still determining the 

types of changes to the prototype reports 

that qualified entities will need to 

submit to CMS for approval. CMS is 

considering releasing guidance on the 

types of changes to the report prototype 

that need not be submitted once the 

qualified entity program has started. 

We agree with commenters that 

including standard measure 

specifications is unnecessary. Thus far, 

available standard measures only 

include measures endorsed by the 

National Quality Forum and CMS 

measures; and the specifications for 

these measures are available to the 

public. Therefore, we will only require 

applicants to include measure 

specifications for alternative measures. 

We will use future rulemaking to 

address the submission of specifications 

for standard measures if the public 

availability of standard measure 

specifications changes in the future. 

Comment: One commenter requested 

that CMS require each applicant to 

submit an analytic plan clarifying its 

goals relative to the statute. 

Response: We believe that the 

requirement for entities to submit a 

rationale for selecting each measure, 

including its relationship to existing 

measurement efforts, addresses the issue 

of an organization’s goals as they relate 

to the statute. We believe this is 

sufficient documentation of an 

organization’s plans. 

Comment: One commenter requested 

that CMS require applicants to submit 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76547 

conflict of interest information. 

Commenters were concerned that 

conflicts of interest could result in 

inaccurate or misleading reporting. One 

commenter specifically requested that 

qualified entities be required to attest 

that they have no relationship or 

affiliation with any health plans, 

insurers, providers, suppliers, 

manufacturers or other entities that may 

have an interest in or use for the data. 

Response: We do not believe it is 

necessary for applicants to submit 

information on conflicts of interest to 

CMS. We expect that many qualified 

entities will have relationships with 

health plans, insurers, providers and 

suppliers, and other entities that have 

an interest in or use for the data in order 

to meet the requirements of the 

qualified entity program, such as 

obtaining other claims data or 

disseminating performance results. We 

believe the eligibility requirements and 

monitoring requirements will ensure 

that the organizations who serve as 

qualified entities comply with the 

requirements of the program. 

B. Definition, Selection, and Use of 

Performance Measures 

1. Standard and Alternative Measures 

The statute permits qualified entities 

to use both standard and alternative 

measures. We proposed to define 

standard measures as any claims-based 

measure endorsed (or time-limited 

endorsed) by the entity with a contract 

under section 1890(a) of the Act 

(currently the National Quality Forum), 

any claims-based measure that is 

currently being used in a CMS program 

that includes quality measurement, or 

any measure developed pursuant to 

Section 931 of the Public Health Service 

Act. The statute requires the Secretary 

to consult with appropriate stakeholders 

as to whether the use of alternative 

measures would be more valid, reliable, 

responsive to consumer preferences, 

cost-effective, or relevant to dimensions 

of quality and resource use not 

addressed by standard measures. In 

light of these requirements, we 

proposed to define alternative measures 

as any claims-based measure that, while 

not a standard measure, was adopted by 

the Secretary through a notice and 

comment rulemaking process. Qualified 

entities would submit proposed 

alternative measures to CMS who would 

then make the proposed alternative 

measures available for stakeholder input 

via a proposed rule, and, where 

appropriate, following receipt of public 

comments, the Secretary would 

determine which alternative measures 

to approve for use in the program. 

Comment: Some commenters 

suggested that qualified entities be 

allowed to calculate measures that are 

not based solely on claims data. 

Specifically, commenters were 

interested in calculating measures that 

involve combining claims data with 

clinical data (for example, registry data 

or chart-abstracted data). Commenters 

argued that allowing qualified entities to 

use these measures would expand the 

list of available measures. Several 

commenters also expressed that the use 

of these types of measures would help 

produce a more accurate picture of 

provider and supplier performance. 

Response: We recognize commenters’ 

desire to use clinical data combined 

with claims data when calculating 

standard and alternative measures. 

Given the added value that clinical data 

brings to performance measurement, 

whenever standard or alternative 

measures provide for the use of clinical 

data, we will allow qualified entities to 

use clinical data in combination with 

Medicare and other claims data to 

calculate those standard and alternative 

measures. We have added a definition of 

clinical data at § 401.703(i), specifically 

clinical data is registry data, chartabstracted data, laboratory results, 

electronic health record information, or 

other information relating to the care or 

services provided to patients that is not 

included in administrative claims data. 

Measurement efforts using clinical data 

would only be supported under the 

qualified entity program if the clinical 

data is combined with the qualified 

entity’s Medicare and other claims data 

to calculate the measures. These 

regulations do not address the use and 

publication of purely clinical-based 

measures. 

Furthermore, we recognize the near 

impossibility of combining Medicare 

claims data with clinical data without 

an identifier to link them. As a result, 

we are changing the proposed process 

for releasing beneficiary identifiable 

information to allow—with strict 

privacy and security standards—for the 

disclosure of identifiers to qualified 

entities; this change is discussed in 

more detail in the Privacy and Security 

requirements section below. 

Comment: Many commenters were 

supportive of the alternative measure 

review process. However, several 

commenters argued that the notice and 

comment rulemaking process was 

overly burdensome on qualified entities, 

would significantly restrict innovation 

in measure development and use, and 

was contrary to the overall goals of the 

provision. Some commenters proposed 

that qualified entities only be required 

to seek the permission of local 

stakeholders before calculating and 

reporting alternative measures. 

However, other commenters argued that 

the notice and comment rulemaking 

process provided appropriate safeguards 

against the public reporting of untested 

measures. 

Response: We believe that the intent 

of the alternative measure provision in 

statute is to promote innovation in 

claims-based performance 

measurement, while ensuring that 

measures are not used in the qualified 

entity program without proper testing 

and validation. That said, in light of the 

comments received, we believe that 

greater flexibility could be afforded to 

qualified entities to better balance 

innovation with appropriate use. We are 

therefore adding additional flexibility 

into the alternative measure process by 

adding a second avenue by which to 

seek Secretarial approval of alternative 

measures. In order to receive approval 

to use an alternative measure under this 

new avenue, a qualified entity will need 

to submit documentation to CMS 

outlining consultation and agreement 

with stakeholders in the geographic 

region the qualified entity serves, and 

evidence that the measure is ‘‘more 

valid, reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by such standard 

measures’’ in accordance with the 

statutory requirements at Section 

1874(e)(4)(B)(ii)(II). Stakeholders must 

include a valid cross representation of 

providers, suppliers, employers, payers, 

and consumers. At a minimum, a 

qualified entity must submit: 

• A description of the process by 

which the qualified entity notified 

stakeholders of its intent to seek 

approval of an alternative measure. 

• A list of stakeholders from whom 

feedback was solicited, including the 

stakeholder names and each 

stakeholder’s role in the community. 

• A description of the discussion 

about the proposed alternative measure, 

including a summary of all pertinent 

arguments for and against use of the 

measure. 

• An explanation backed by scientific 

evidence that demonstrates why the 

measure is ‘‘more valid, reliable, 

responsive to consumer preferences, 

cost-effective, or relevant to dimensions 

of quality and resource use not 

addressed by [a] standard measure.’’ 

CMS will review the submission and 

make a decision as to whether the 

qualified entity has consulted the 

appropriate stakeholders and whether 

the new measure meets the 

requirements for alternative measures at 

Section 1874(e)(4)(B)(ii)(II) of the Act. 


emcdonald on DSK5VPTVN1PROD with RULES2
76548 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

Qualified entities must send all the 

information required for approval of an 

alternative measure to CMS at least 60 

days prior to its intended use of the 

measure. CMS will make every effort to 

ensure that measures are approved 

during the 60 day period. If a CMS 

decision on approval or disapproval for 

an alternative measure is not 

forthcoming within 60 days, the 

measure shall be deemed to be 

approved. However, CMS retains the 

right to disapprove a measure if, even 

after 60 days, in accordance with the 

statutory requirements at Section 

1874(e)(4)(B)(ii)(II) it is found to not be 

‘‘more valid, reliable, responsive to 

consumer preferences, cost-effective, or 

relevant to dimensions of quality and 

resource’’ than a standard measure. 

Once a measure is approved CMS will 

release the name of the measure, as well 

as the scientific evidence that 

demonstrates why the measure is ‘‘more 

valid, reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by [a] standard measure.’’ 

Alternative measures submitted and 

approved using this process may only 

be used by the qualified entity that 

submitted the measure for consideration 

because the stakeholder consultation 

approval process only requires 

consultation with stakeholders in the 

geographic region the qualified entity 

serves. If another qualified entity wishes 

to use the same measure, it would need 

to consult with stakeholders in its own 

community, and submit its own request 

for alternative measure approval under 

the rulemaking or stakeholder 

consultation approval process. 

However, we recognize that scientific 

evidence demonstrating that the 

measure is ‘‘more valid, reliable, 

responsive to consumer preferences, 

cost-effective, or relevant to dimensions 

of quality and resource use not 

addressed by [a] standard measure’’ will 

not differ for a measure in use across 

communities. Therefore, once an 

alternative measure is approved for use 

via the stakeholder consultation 

approval process, future requests for use 

of an identical measure will not need to 

include the same explanation backed by 

scientific evidence that demonstrates 

why the measure is ‘‘more valid, 

reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by [a] standard measure.’’ 

However, if there is scientific evidence 

that has become available since the 

measure was approved by CMS, the 

qualified entity seeking to use that 

measure must conduct the necessary 

research and provide that new scientific 

evidence to CMS. 

We will also retain the notice and 

comment rulemaking process as a 

second option for the approval of 

alternative measures. As discussed in 

the proposed rule, alternative measures 

approved through notice and comment 

rulemaking may be used by any 

qualified entity up until the point that 

an equivalent standard measure for the 

particular clinical area or condition 

becomes available. 

Comment: One commenter suggested 

that the alternative measure process as 

outlined conflicted with the process 

under Section 3014 of the Affordable 

Care Act. 

Response: Section 1874(e)(4)(B)(ii)(I) 

provides for the use of standard 

measures such as the measures 

endorsed by the entity with a contract 

under section 1890(a) of the Act 

(currently NQF) and measures 

developed pursuant to section 931 of 

the Public Health Service Act. Section 

1874(e)(4)(B)(ii)(II) provides for use of 

additional measures that are not 

approved by such entities. This latter 

category explicitly provides for the 

approval and use of non-NQF standards. 

Furthermore, section 3014 of the 

Affordable Care Act does not require the 

Secretary to use the recognized 

standards by the entity with a contract 

under section 1890(a) of the Act. It 

merely serves to provide 

recommendations on appropriate 

standards to consider. 

Comment: Several commenters 

questioned whether the requirement for 

qualified entities to cease using 

alternative measures within six months 

of an equivalent standard measure being 

endorsed was reasonable. 

Response: We believe six months is a 

reasonable time period for qualified 

entities to transition to using newly 

endorsed standard measures equivalent 

to existing alternative measures or to 

submit scientific justification to file a 

request for alternative measure 

approval. 

Comment: We received several 

comments on our definition of standard 

measures. While many commenters 

were supportive of our definition, one 

commenter suggested that we change 

our definition of standard measures to 

include measures endorsed by 

consensus-based entities other than the 

NQF. The commenter specifically 

mentioned the Patient Charter, a 2008 

agreement among consumer, purchaser, 

provider and insurer groups on 

principles to guide performance 

reporting. Other commenters asked if all 

NQF-endorsed measures were standard 

measures. One commenter asked that 

standard measures be limited to true 

outcome measures in order to measure 

the effectiveness of care. 

Response: We appreciate the 

suggestion to include measures 

endorsed by consensus-based entities 

other than the NQF and have changed 

our definition of standard measures to 

include such measures. Specifically, we 

will now include as a standard measure 

any measure calculated in full or in part 

from claims data that is endorsed by a 

consensus-based entity, providing that 

the consensus-based entity has been 

approved as such by CMS. Rather than 

defining consensus-based entities in 

advance, CMS will approve 

organizations as consensus based 

entities on an as needed basis. 

To receive approval as a consensusbased entity, an organization will need 

to submit information to CMS 

documenting their processes for 

stakeholder consultation and measure 

approval. Such documentation must 

show that the entity has a prescribed 

process for vetting and approving 

measures that includes representation 

from all types of stakeholders relevant 

to the topic being measured. The 

description of the approval process 

must be publicly available and the 

stakeholder consultation must be open 

to any that are interested in 

participating. Additionally, 

organizations will only receive approval 

as a consensus-based entity if all 

measure specifications are publicly 

available. Consensus-based entities will 

receive approval for a time period of 

three years and their endorsed measures 

will be made available to all qualified 

entities. CMS will also make a list of 

approved consensus-based entities 

available publicly. After three years, 

organizations will simply have to 

resubmit documentation on their 

processes for stakeholder consultation 

and measure again, noting any changes 

from their original submission. 

Regarding the request that we add a 

requirement that standard measures be 

‘‘outcome measures,’’ which we 

understand to mean measures that 

evaluate final results, such as mortality 

rates, we feel that imposing this 

requirement would substantially reduce 

the number of available standard 

measures. Additionally, while we agree 

that outcome measures may be better 

indicators of the effectiveness of care, 

we feel process measures will also offer 

the public, as well as providers and 

suppliers, important information on 

performance. Therefore, we have not 

incorporated this suggestion. 

Comment: One commenter suggested 

that the rule should permit the use of 

composite measures. 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76549 

Response: We believe that composite 

measures can be calculated and reported 

under the revised alternative measure 

process we established in this final rule. 

Comment: One commenter suggested 

that the rule should permit qualified 

entities to withdraw measures prior to 

public reporting if the measure results 

turn out to be unreliable. 

Response: We appreciate this 

suggestion; however, the statute requires 

public reporting of all measures. 

Specifically, Section 1874(e)(4)(C)(iv) 

requires the reports be made available to 

the public, while allowing for 

confidential review by providers and 

suppliers. We note that this does not 

prohibit commentary on the measure 

and results in the report. We hope that 

qualified entities will take the 

requirement of public reporting into 

consideration when determining which 

measures should be calculated under 

this program. We recognize that there 

may be errors in measure calculation 

and believe that the confidential 

reporting and appeals process will help 

qualified entities discover and correct 

any errors in the calculation of 

measures. 

Comment: We received a variety of 

comments on measurement 

methodologies. Several commenters 

suggested that CMS should be more 

proscriptive regarding the types of 

attribution, risk adjustment, and 

benchmarking methods qualified 

entities should employ and that 

methodology descriptions should be 

standardized across payers and 

qualified entities. Commenters were 

also concerned about payment 

standardization as it relates to efficiency 

and resource use measures. Payment 

standardization is viewed as an 

important methodological approach to 

normalize comparisons of resource use 

across providers and suppliers. Several 

commenters also stressed the need for 

accurate attribution and risk adjustment 

in general. One commenter asked if 

methodologies employed by the 

qualified entity could change during the 

three-year agreement period. One 

commenter urged CMS to require 

qualified entities to submit to CMS a 

specific description of how it will 

handle outlier providers and ensure that 

a report of a provider’s or supplier’s 

performance is accurately adjusted as 

appropriate to reflect characteristics of 

the patient population. 

Response: The statute does not 

require CMS to be proscriptive in this 

regard. Consistent with the statute, the 

proposed rule would require qualified 

entities to submit to the Secretary a 

description of methodologies that the 

qualified entity proposes to use to 

evaluate the performance of providers 

and suppliers. The proposed rule would 

also require qualified entities to include 

an understandable description of their 

attribution, risk adjustment, and 

benchmarking methods so that report 

recipients can properly assess such 

reports. We agree with commenters that 

payment standardization is an 

important aspect of measurement 

methodologies, and agree that payment 

standardization methodologies should 

be included where appropriate. 

Therefore, we have added a requirement 

that qualified entities include 

information on payment standardization 

when appropriate. 

Additionally, we feel that 

performance measurement is evolving, 

and that clear standards for attribution, 

risk adjustment, and benchmarking have 

not yet emerged, and therefore it would 

be inappropriate for CMS to 

preemptively determine such standards. 

We are confident that as qualified 

entities and the performance 

measurement environment matures over 

the coming years methodologies will 

begin to coalesce around clearly defined 

standards. As discussed above, qualified 

entities can change methodologies 

during the three year agreement period 

provided they give appropriate notice to 

CMS and receive CMS’ approval. 

Regarding outliers, we feel that this 

issue will be adequately addressed in 

the requirements at § 401.707(b)(5)(ii) 

for a qualified entity to provide details 

on methodologies it intends to use in 

creating reports with respect to 

benchmarking performance data, 

including methods for creating peer 

groups, justification of minimum 

sample size determinations, and 

methods for handling statistical outliers, 

to both CMS and users of the reports. 

Comment: One commenter asked 

about the release of the details of 

proprietary methodologies and 

proprietary measure specifications to 

CMS. 

Response: While we understand the 

concerns about releasing methodologies 

for proprietary measures, we believe 

that the goal of this program is to 

increase transparency. As discussed 

above in section II.A.3., we are not 

requiring qualified entities to submit 

measure specifications for standard 

measures because, thus far, all 

specifications for these measures are 

available to the public. However, we 

believe that, in order for CMS to 

evaluate a qualified entity’s proposed 

plan for calculating measures, 

disclosure of proprietary measure 

methodologies and proprietary 

specifications for alternative measures 

to CMS as part of the application 

process is warranted. The Trade Secrets 

Act (18 U.S.C. 1905) bars CMS from redisclosing proprietary information 

unless it is authorized to do so by law. 

Any disclosure to CMS regarding 

measurement methodologies or 

specifications will generally not be 

made public by CMS. As a result, we 

feel it is appropriate to require the 

disclosure of detailed methodologies 

and specifications for alternative 

measures to CMS as part of the 

application. 

Additionally, qualified entities will be 

required to disclose proprietary measure 

methodologies to providers and 

suppliers as a part of the confidential 

review process. We believe it is 

essential for providers and suppliers to 

understand exactly how the measure is 

calculated in order to review their 

results. To protect proprietary 

methodologies, a qualified entity may 

choose to limit further disclosure of 

proprietary measure methodologies, 

perhaps by requiring a provider or 

supplier to execute a non-disclosure 

agreement as a condition of that 

disclosure; however, the qualified entity 

must share the proprietary measure 

methodologies with the provider or 

supplier regardless of whether they are 

willing to execute a non-disclosure 

agreement. If a qualified entity does not 

wish to share proprietary measure 

methodologies with both CMS and 

providers or suppliers, it should not 

seek approval to use those measures in 

the qualified entity program. 

Comment: One commenter suggested 

that all proposed measures, both 

standard and alternative, be open for 

public review by providers and 

suppliers prior to approval. 

Response: We do not feel that this 

requirement is necessary. Standard 

measures as currently defined have 

already been subject to multi 

stakeholder input and approval either 

through the entity with a contract under 

section 1890(a) of the Act (currently 

NQF) or through public comment via 

notice and comment rulemaking in the 

case of CMS measures. Also, any 

measures developed by a consensus 

based entity will have gone through 

some form of stakeholder consultation. 

Thus far, there have been no measures 

developed pursuant to section 931 of 

the Public Health Service Act; however, 

section 931 requires consultation with 

stakeholders during the quality measure 

development process. Further, both of 

the alternative measure processes 

include requirements regarding 

stakeholder input. 

Comment: Several commenters urged 

CMS to provide a comprehensive list of 


emcdonald on DSK5VPTVN1PROD with RULES2
76550 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

the standard and alternative measures 

that qualified entities may use. 

Response: We plan to release a list of 

standard measures to potential qualified 

entity applicants prior to the start of the 

program. We would like to note, 

however, that this list will be dynamic 

since the entity with the contract under 

section 1890(a) of the Act (currently 

NQF) is continually reviewing measures 

for endorsement and CMS is continually 

undergoing rulemaking to add measures 

to our programs. Additionally, as new 

consensus based entities are approved 

by CMS, additional standard measures 

will be available for use by qualified 

entities. We will also release a list of 

approved alternative measures once 

alternative measures are approved. 

Qualified entities are encouraged to 

check these lists frequently to ensure 

they have the most accurate information 

regarding acceptable measures. 

2. Reports and Reporting 

Section 1874(e)(4)(C)(ii) of the Act 

requires qualified entities to make their 

draft reports available in a confidential 

manner to providers and suppliers 

identified in the reports before such 

reports are released publicly in order to 

offer them an opportunity to review 

these reports, and, if appropriate, appeal 

to request correction of any errors. After 

reports have been shared confidentially 

with providers and suppliers, and there 

has been an opportunity to have any 

errors corrected, Section 

1874(e)(4)(C)(iv) of the Act requires the 

reports to be made available to the 

public. 

As stated in the statute at Section 

1874(e)(4)(C)(i) of the Act, the reports 

must include ‘‘an understandable 

description’’ of the measures, rationale 

for use, methodology (including riskadjustment and physician attribution 

methods), data specifications and 

limitations, and sponsors. We 

interpreted ‘‘an understandable 

description’’ to mean any descriptions 

that can be easily read and understood 

by a lay person. Additionally, the 

reports to the public may only include 

data on providers or suppliers at the 

provider or supplier level with no claim 

or patient-level information to ensure 

beneficiary privacy. 

We proposed requiring qualified 

entities to submit prototype reports for 

both the reports they would send to 

providers and suppliers, and the reports 

they would release to the public (if they 

are different) in their application, 

including the narrative language they 

plan to use in the reports to describe the 

data and results. 

Comment: We received several 

comments about the reporting process 

generally. One commenter asked that 

qualified entities be required to report 

less frequently than once per year, as 

proposed. Other commenters asked that 

qualified entities be required to report 

more frequently than once per year. Yet 

other commenters expressed concern 

about public reporting and asked that no 

measurement data be publicly reported 

at all. 

Response: The statute, at 

1874(e)(C)(iv), requires qualified entity 

reports to be made available to the 

public after they are made available to 

providers and suppliers for review and 

requests for corrections. We have no 

discretion to allow qualified entities to 

produce reports for confidential use 

only. While the statute does not 

mention any specific frequency of 

public reporting, we believe that once 

per year is an appropriate requirement. 

Requiring public reporting once per year 

strikes a balance between reporting 

frequently enough that the information 

is actionable for consumers, and not 

reporting so frequently that providers 

and suppliers constantly have to 

confidentially review reports. However, 

we note that reporting once per year is 

the minimum requirement. A qualified 

entity may choose to report more 

frequently than once per year, as long as 

it is still able to meet the requirement 

of allowing providers and suppliers the 

opportunity to review and request error 

correction. 

Comment: Commenters raised 

questions about the possibility of 

providers and suppliers receiving 

multiple reports, which may potentially 

contain contradictory or confusing 

performance measure results. Some 

commenters requested that CMS 

standardize the report formats among 

qualified entities to make them easier to 

interpret, and others simply asked CMS 

to clarify how we will address this 

issue. 

Response: As discussed in the 

proposed rule and above, we do not 

intend to limit the number of qualified 

entities accepted for participation into 

this program, and therefore, it is 

possible that there will be more than 

one qualified entity working in the same 

geographic area. While we are requiring 

qualified entities to submit prototype 

reports for CMS approval before use, we 

do not intend to standardize the reports. 

We believe this program is intended to 

supplement measurement activity 

already ongoing at the community level, 

and excessive CMS involvement will 

erode the relationships qualified entities 

either already have, or will develop, 

with providers and suppliers. This is 

precisely why providers and suppliers 

are afforded the opportunity to review 

their reports and work through any 

issues directly with the qualified entity, 

and not with CMS. 

Comment: We received several 

comments regarding the provider or 

supplier’s role in the reporting process. 

One commenter stated that providers 

and suppliers should be allowed to 

petition CMS to require qualified 

entities to modify report formats. 

Another commenter requested that 

qualified entities should be required to 

include providers’ or suppliers’ 

comments in the public reports. And 

finally, one commenter requested that 

qualified entities be required to be 

capable of allowing providers and 

suppliers to download reports 

electronically. 

Response: As stated in the proposed 

rule, and discussed elsewhere in this 

final rule, CMS’ direct role in this 

program is relatively limited, and 

includes only the functions necessary 

for reviewing applications from 

qualified entities and providing 

standardized data extracts to those 

entities that meet the requirements, as 

well as describing the program to the 

public. We believe these comments 

about issues related to how the qualified 

entities publicly report data are outside 

the scope of CMS’ statutory authority 

under section 1874(e). Therefore, 

providers and suppliers will not be 

allowed to petition CMS to change the 

reports, and a qualified entity will 

decide itself whether to post comments 

in a public report or make its reports 

available for download in an electronic 

format. 

Comment: One commenter noted that 

the proposed rule could be interpreted 

as requiring qualified entities to do all 

reporting at the individual physician 

level. Another commenter noted that, in 

terms of performance measurement, 

specialty hospitals need to be accounted 

for differently. 

Response: The statute does not 

specify the level at which reports are to 

be generated (that is, individual 

physician, physician group, integrated 

delivery system, etc.), nor does it 

specify the types of providers and 

suppliers to be measured. A qualified 

entity may choose to which providers 

and/or suppliers it will apply measures, 

and in so doing, for which entities its 

reports will be generated. Reporting may 

be at any level for which the measures 

can be used, but reports must be devoid 

of patient identifiers to protect the 

identity of the beneficiaries. 

Comment: One commenter requested 

that CMS require qualified entities to 

license or otherwise make available 

quality measures to other entities that 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76551 

have the ability to publish performance 

measurement information. 

Response: As stated above, these 

regulations will generally not place any 

added limitations on what is otherwise 

feasible under applicable law (such as 

copyright law). Qualified entities 

cannot, however, charge providers or 

suppliers for the confidential prepublication reports, and they must make 

reports available to the public free of 

charge in accordance with section 

1874(e)(4)(c)(iv). 

C. Data Extraction and Dissemination 

Section 1874(e)(3) of the Act requires 

the Secretary to provide qualified 

entities with standardized extracts of 

claims data from Medicare parts A, B, 

and D for one or more specified 

geographic areas and time periods. For 

Medicare parts A and B, we proposed 

that these data extracts would include 

information from all seven claim types 

that are submitted for payment in the 

Medicare Fee-For-Service Program, 

including both institutional and noninstitutional claims. Institutional claim 

types include inpatient hospital, 

outpatient hospital, skilled nursing 

facility, home health, and hospice 

services, whereas non-institutional 

claim types include physician/supplier 

and durable medical equipment claims. 

Medicare institutional and noninstitutional claims include, but are not 

limited to, the following data elements: 

Beneficiary ID, claim ID, the start and 

end dates of service, the provider or 

supplier ID, the principal procedure and 

diagnosis codes, the attending 

physician, other physicians, and the 

claim payment type. 

We proposed that qualified entities 

would also receive certain Part D 

information for beneficiaries enrolled in 

the Medicare Fee-For-Service Program. 

The Part D information is known as 

‘‘drug event’’ information, as opposed to 

‘‘claims’’ information, because 

prescription drug coverage under Part D 

is provided by private insurance plans 

or ‘‘Part D plan sponsors.’’ Part D plans 

are responsible for paying a claim for 

benefits at the pharmacy. The Part D 

plan then submits a Prescription Drug 

Event record or ‘‘PDE’’ to CMS. The key 

data elements in the Part D prescription 

drug event database include: Beneficiary 

ID, prescriber ID, drug service date, drug 

product service ID, quantity dispensed, 

days’ supply, gross drug cost, brand 

name, generic name, and drug strength. 

CMS will also include an indication if 

the drug is on the formulary of the Part 

D plan. 

In order to allow qualified entities to 

link Medicare claims for an individual 

beneficiary, with appropriate security 

and privacy protections, we proposed 

that all claims files would contain a 

unique encrypted beneficiary 

identification (ID) number, rather than 

the actual beneficiary Medicare Health 

Insurance Claim Number (HICN). 

Comment: We received several 

comments regarding data extract 

structure. A number of commenters 

requested clarification on how the data 

linkage across data sets will be 

accomplished. Several comments asked 

how qualified entities would identify 

the provider or supplier associated with 

a claim. One commenter expressed 

concern that no accurate or acceptable 

physician contact data base or directory 

is currently available on a nationwide 

level. An additional comment asked if 

CMS plans to make changes to the data 

in the CMS database if a qualified 

entity, provider, or supplier determines 

there is an error in the Medicare claims 

data. 

Response: CMS understands the 

importance of linking beneficiaries 

across Medicare data sets in a way that 

is secure and protects beneficiaries’ 

privacy. All claims files provided to 

qualified entities will contain a unique 

encrypted beneficiary identification 

number that will allow a qualified entity 

to link claims for an individual 

beneficiary across all Medicare claim 

types and across all years. That is, a 

unique encrypted beneficiary ID number 

will be assigned to an individual 

beneficiary and will remain the same for 

that individual beneficiary across 

Medicare claim types and years. This 

encrypted beneficiary ID is unique to 

the qualified entity program and will be 

included on each file the qualified 

entity receives. With appropriate 

security and privacy protections, these 

files will also contain beneficiary date of 

birth, race, and gender, important 

elements for calculating performance 

measures. 

Additionally, to allow qualified 

entities to identify the provider or 

supplier associated with a claim, the 

files will contain the actual provider or 

supplier ID or, where required by law, 

the National Provider Identifier (NPI). 

Although, in HIPAA standard 

transactions the NPI must be used in 

lieu of other provider numbers, CMS 

will also make the Unique Physician 

Identification Number (UPIN) associated 

with the claim available to qualified 

entities. CMS maintains both a 

publically available query-only database 

and a publically available downloadable 

file that links the NPI to other 

information on a provider such as the 

provider name and mailing address. We 

believe that this national-level database 

and downloadable file will allow 

qualified entities to identify the 

provider or supplier associated with the 

claim. Furthermore, given the eligibility 

requirements described above in Section 

II.A.1.a., we expect approved qualified 

entities to have experience in accurately 

identifying a provider or supplier across 

multiple data sources. 

As to reporting suspected issues with 

CMS data, CMS currently has a process 

in place for reporting, tracking, and 

resolving potential errors or issues 

identified in CMS data. Once approved, 

each qualified entity will receive 

guidance and training in this area. 

Comment: Several commenters raised 

concerns about some of the data 

elements we proposed to release. A 

number of commenters expressed 

concern on the release of drug cost 

information in the Part D data, as well 

as the release of Part D plan identifiers. 

Additionally, a handful of commenters 

suggested that private physician 

financial information contained in the 

Part B data is protected from disclosure 

under the Privacy Act. 

Response: CMS is aware of the 

concerns and restrictions on releasing 

certain Part D drug cost information. 

Given these concerns, in the files 

provided to qualified entities, CMS will 

release the Total Drug Cost element, 

which is derived from the sum of four 

elements: Ingredient Cost, Dispensing 

Fee, Vaccine Administration Fee, and 

Total Amount Attributable to Sales Tax. 

However, to protect the Part D plans’ 

proprietary cost information, these 

individual component costs will not be 

released. We believe the aggregation of 

cost information will help to ensure that 

the most confidential information—the 

separate amounts paid by Part D 

sponsors for ingredient cost or 

dispensing fee—will not be released. 

This approach is also consistent with 

the treatment of these data under the 

regulations governing the use and 

disclosure of Part D data for nonpayment related purposes. See 73 FR 

30,664, 30669 (May 28, 2008). 

Furthermore, the Part D data will not 

identify individual Part D plans, but 

will include an encrypted plan ID 

number. We believe this encryption will 

afford further protection for Part D drug 

cost information. 

While certain physician payment 

information contained in the Part B 

claims data is protected from disclosure 

to the general public by court 

injunctions entered in Florida Medical 

Association, Inc. v. Department of 

Health, Education & Welfare, 479 F. 

Supp. 1291 (M.D. Fla. 1979), and 

American Ass’n of Councils of Medical 

Staffs of Private Hospitals, Inc. v. Health 

Care Financing Administration, No. 78– 


emcdonald on DSK5VPTVN1PROD with RULES2
76552 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

1373 (E.D. La 1980), that protection is 

specific to disclosures under the 

Freedom of Information Act (FOIA) 

exception to the Privacy Act at 5 U.S.C. 

552a(b)(2). Disclosures made under the 

qualified entity program under section 

1874(e) of the Act are not FOIA-based 

disclosures. Rather, they are ‘‘routine 

use’’ disclosures from the National 

Claims History (NCH)—System No. 09– 

70–0558, Medicare Drug Data 

Processing System (DDPS)—System No. 

09–70–0553, Medicare Integrated Data 

Repository (IDR)—System No. 09–70– 

0571, and Chronic Condition Data 

Repository (CCDR)—System No. 09–70– 

0573 systems of records under the 

Privacy Act and these implementing 

regulations. As such, they are not 

subject to the injunction. 

Comment: We received a variety of 

comments on technical assistance for 

qualified entities. Several commenters 

asked that CMS provide technical 

assistance, but not include it in the fee 

charged for the data. Other commenters 

suggested that technical assistance 

would not be needed. 

Response: We plan to provide 

qualified entities with the option to 

request technical assistance. Since we 

are removing all program management 

costs from the fee we will charge 

qualified entities, see discussion below 

at II.C.3., we do not plan to charge for 

these services. 

1. Number of Years of Data 

CMS proposed to provide qualified 

entities with the most recent three 

calendar years of Medicare final action 

data available at the time the qualified 

entity is approved for participation in 

the program. 

Comment: Comments from both 

potential qualified entities and provider 

groups raised concerns about the 

timeliness of the data. Commenters 

generally requested that CMS release 

data on a quarterly basis or a rolling 

12 month basis, with no more than a 

quarterly time lag. One commenter 

suggested that CMS only provide 

qualified entities with two calendar 

years of data because performance 

information regarding care provided in 

2008 is too outdated to be relevant for 

providers or consumers. 

Response: We agree with commenters, 

so we are modifying what we proposed 

to make more timely data available to 

qualified entities. CMS will provide 

qualified entities with the most recent 

available historical data, which, for 

qualified entities approved at the 

beginning of the program, we expect 

would include data for CY2009, 

CY2010, and the first two quarters of 

2011. Then, we would provide quarterly 

data updates on a rolling basis. 

2. Geographic Areas 

CMS proposed to provide qualified 

entities with standardized data extracts 

for either a single geographic area or 

multiple regions, and to limit the 

provision of Medicare data to the 

geographic spread of the qualified 

entity’s other claims data. In the 

proposed rule, we sought comment on 

releasing nationwide extracts of 

Medicare data. 

Comment: Several commenters 

requested that CMS release nationwide 

Medicare claims data. Some expected to 

conduct a nationwide performance 

review program, but many were 

interested in calculating national 

benchmarks. Commenters expressed 

feelings that national Medicare 

benchmarks would foster greater 

consumer and provider understanding 

of local measure results. 

Response: For entities interested in 

conducting a nationwide performance 

review program, we are unsure about 

the ability of any one entity to assemble 

a sufficient amount of data nationally to 

justify a nationwide release of Medicare 

data. If a qualified entity can 

demonstrate it has a sufficient amount 

of data nationwide, however, CMS will 

provide a 100% national extract. 

We agree that nationwide data may 

assist qualified entities in benchmarking 

their results. As a result, qualified 

entities will be allowed to request a 5% 

national sample of Medicare claims for 

the purposes of calculating national 

benchmarks. The 5% national sample of 

claims will not include a crosswalk to 

beneficiary names and Health Insurance 

Claim Numbers, discussed below in 

Section D.1, only the encrypted 

beneficiary ID to allow linking across 

Medicare claims data for measure 

calculation purposes. Qualified entities 

should provide a justification of needing 

a 5% national sample with their request. 

We will include a requirement in the 

Data Use Agreement (DUA, discussed in 

more detail below) prohibiting qualified 

entities from re-identifying claims 

included in the national sample they 

receive. Additionally, as these files are 

already in existence because they are 

used for other purposes, we anticipate 

that the cost of making this data 

available will be nominal. 

Comment: We received several 

comments on how CMS would 

determine which claims apply to a 

certain geographic region. We also 

received comments requesting that CMS 

not limit the provision of Medicare data 

to the geographic spread of the qualified 

entity’s other claims data. 

Response: We will release claims 

based on the location of the beneficiary 

residence, not the location of the 

provider or supplier rendering the 

services. This will mean the qualified 

entity might not receive all of the 

Medicare claims for a given provider or 

supplier. 

While we recognize the desire to 

calculate performance measures for 

areas outside the geographic spread of 

the qualified entity’s other claims data, 

we believe the intent of statute is for 

qualified entities to combine other 

claims data from an area with Medicare 

claims data for that same area to 

produce robust and actionable 

performance measures for providers, 

suppliers, and consumers. 

3. Cost To Obtain Data 

Section 1874(e)(4)(A) of the Act 

requires qualified entities to pay a fee 

for obtaining the data that is equal to the 

cost of making such data available. In 

the proposed rule CMS interpreted the 

cost of making the data available to 

include two parts: (1) The cost of 

running the qualified entity program, 

including costs for processing 

applications, monitoring qualified 

entities, and providing technical 

assistance, and (2) the cost of creating a 

data set specific to each qualified 

entity’s requested geographic area and 

securely transmitting the data set to the 

qualified entity. We estimated that the 

approximate cost to provide data for 2.5 

million beneficiaries to a qualified 

entity would be $200,000. 

Approximately $75,000 of the $200,000 

is cost of the claims data and 

approximately $125,000 is the cost of 

making the data available. We proposed 

that data costs would vary depending on 

the amount of data requested. 

Comment: Many commenters stated 

that CMS was being too broad in our 

interpretation of the statutory 

requirement to charge qualified entities 

for the cost of making the data available. 

Commenters suggested that CMS only 

charge qualified entities for the cost of 

generating the data, and not the cost of 

running the program. The comments 

also noted that high cost would be a 

barrier to entry for non-profit 

organizations and states. 

Response: CMS concurs that there are 

public interests at stake that justify 

narrowing the scope of what constitutes 

the cost of making this data available. 

As such, we will drop the program 

management portion of the costs from 

what is included in the data fee we will 

charge qualified entities. We have also 

worked to identify several efficiencies 

in data preparation and distribution that 

will significantly reduce our initial 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76553 

estimates for data costs. Our initial 

estimates were based on the fee we 

charge researchers for similar data. 

However, because all qualified entities 

will receive a standardized extract of the 

Medicare data, we will not need to 

address each request for data on an 

individual basis as we do with 

researchers, thereby significantly 

reducing the cost of making the data 

available, particularly the costs of 

encrypting the data. 

We estimate that the total 

approximate costs to provide data for 

2.5 million beneficiaries to qualified 

entities would be $40,000 in the first 

year of the program. We estimate that 

the cost to provide ten quarters (CY 

2009, CY 2010, and Q1–Q2 CY2011) of 

data when the qualified entity is first 

approved would be $24,000. Thereafter, 

in 2012 qualified entities would get 2 

additional quarterly updates covering 

the remainder of CY 2011, each for a fee 

of $8,000, bringing the total cost of data 

for the first year of the program to 

$40,000. After the first year, qualified 

entities would get quarterly updates, 

each for a fee of $8,000, bringing the 

total cost to a qualified entity for 

subsequent years of the program to 

$32,000. It is important to note that all 

estimates of data costs are currently 

predicated on an estimate of 25 

qualified entities, so if fewer than 25 

qualified entities are approved, data 

costs per qualified entity will be higher, 

and conversely, if greater than 25 are 

approved, the costs will be lower. 

Additionally, data costs for qualified 

entities will vary depending on the 

amount of Medicare claims data the 

qualified entity requests (for example, 

more than one State, or a nationwide 

extract). CMS also reserves the right to 

revise the cost of the data if 

unanticipated expenses are determined 

in the future. 

D. Data Security and Privacy 

The subpart created by these 

regulations will create a new program 

that provides for the release of Medicare 

beneficiary level data, with appropriate 

privacy and security protections. We 

recognize that many qualified entities 

will have had many years of experience 

using claims data to produce 

performance reports on providers and 

suppliers. Additionally, many qualified 

entities will have received data from 

private health plans through agreements 

that will require that the qualified 

entities observe certain security and 

privacy standards. We also recognize 

that new organizations or combinations 

of organizations may want to serve as 

qualified entities to produce 

performance reports. While CMS is 

committed to ensuring the success of 

qualified entities in combining 

Medicare data with claims data from 

other sources to create comprehensive 

performance reports for providers and 

suppliers, CMS is also committed to 

ensuring that the beneficiary-level data 

provided to qualified entities is subject 

to stringent security and privacy 

standards throughout all phases of the 

performance measure calculation, 

confidential reporting, appeal, and 

public reporting processes. 

In 2008, we published a regulation to 

permit Part D prescription drug event 

data to be used for program monitoring, 

research, public health, care 

coordination, quality improvement, 

population of personal health records, 

and other purposes. See 73 FR 30664. 

We intend to ensure that the release of 

Part D prescription drug event data 

under this program complies with the 

requirements in the Part D data 

regulation, including the minimum 

necessary data policy, and that qualified 

entities take the necessary steps to 

ensure that any prescription drug event 

data released to providers and suppliers 

as part of the review, appeal, and error 

correction process are also safeguarded 

to ensure the privacy and security of 

beneficiary information. 

Comment: Commenters were 

generally supportive of our intent to 

ensure the privacy and security of 

Medicare data under this program. A 

few commenters made specific 

suggestions regarding data privacy in 

general. One commenter suggested we 

clarify the interaction of this program 

and its data privacy and security 

requirements with State data privacy 

laws and specifically requested that 

CMS promulgate regulations that would 

preempt State law. 

Response: On the issue of the 

interaction of this program with State 

laws, we believe the issuance of 

universally applicable privacy 

regulations that would preempt State 

laws is outside the scope of the 

qualified entity program. Qualified 

entities will need to abide by applicable 

state laws in addition to the 

requirements in this subpart. 

1. Privacy and Security Requirements 

for Qualified Entities 

We proposed to require that qualified 

entities have in place security 

protections for all data released by CMS, 

and any derivative files, including any 

Medicare claims data and any 

beneficiary identifiable data. 

We proposed that in order to be 

eligible to apply to receive Medicare 

data as a qualified entity, the applicant 

must demonstrate its capabilities to 

establish, maintain, and monitor a 

rigorous data privacy and security 

program, including ensuring 

compliance with submitted plans 

related to the privacy and security of 

data. Additionally, we proposed a 

requirement that the applicant submit to 

CMS a description of its rigorous data 

privacy and security policies including 

enforcement mechanisms. As part of 

their applications, qualified entities will 

also have to explain how they would 

ensure that only the minimum 

necessary beneficiary identifiable data 

would be disclosed to the provider or 

supplier in the event of a request by a 

provider or supplier in the context of a 

confidential review of a report, and how 

data would be securely transmitted to 

the provider or supplier. 

Comment: Commenters were 

generally supportive of requiring that 

qualified entities have rigorous data 

privacy and security protocols in place. 

Several commenters recommended that 

CMS require qualified entities to impose 

the same data and security requirements 

on the qualified entity’s non-Medicare 

claims data as we require on the 

Medicare claims data. One commenter 

suggested CMS require qualified entities 

and other non-covered entities (that is, 

the small fraction of providers who do 

not submit claims electronically, and 

are therefore not subject to HIPAA) to 

enter into business associate agreements 

with CMS, pursuant to HIPAA. 

Response: We agree that the integrity 

of performance measurement depends 

on the integrity of the data, and CMS 

intends to take very seriously its role in 

ensuring qualified entities use Medicare 

data appropriately. However, we do not 

have the statutory authority to impose 

specific requirements on qualified 

entities with regard to the privacy and 

security of their non-Medicare claims 

data. It is our understanding that 

organizations will have executed 

contracts or other agreements with the 

entities from which they receive the 

non-Medicare claims data (for example, 

commercial insurance plans) that will 

contain the privacy and security 

requirements regarding that data. 

Similarly, we also cannot prescribe how 

or where a qualified entity stores its 

non-Medicare data. 

We seek to clarify the interaction 

between this program and HIPAA. Some 

commenters thought that we could 

address the privacy and security 

concerns related to qualified entities 

and other entities that are not directly 

subject to HIPAA by making them CMS’ 

business associates (BAs). BAs are 

persons who or entities that use or 

disclose individually identifiable health 

information in conducting functions or 


emcdonald on DSK5VPTVN1PROD with RULES2
76554 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

activities on behalf of a covered entity 

(see the definition of a BA at 45 CFR 

160.103), but qualified entities and 

providers and suppliers subject to the 

qualified entity program cannot serve as 

BAs because they are not doing their 

work on behalf of CMS as part of the 

Medicare program. CMS is merely 

providing data to qualified entities in 

accordance with the mandate in the 

Affordable Care Act, and, as such, its 

disclosure of protected health 

information is permitted by the HIPAA 

Privacy Rule as ‘‘required by law’’ 

(45 CFR 164.512(a)). That said, we 

believe our thorough evaluation of 

applicant qualified entities, the 

requirement to sign a Data Use 

Agreement (DUA), and subjecting the 

qualified entities to ongoing monitoring 

will be sufficient to ensure that 

qualified entities are appropriately 

using the Medicare data, as well as 

appropriately disclosing the Medicare 

data to providers and suppliers who 

request it. 

We proposed to require each 

approved qualified entity sign a DUA, 

which requires a level and scope of 

security that is not less than the level 

and scope of security requirements 

established by the Office of Management 

and Budget (OMB) in OMB Circular No. 

A–130, Appendix III—Security of 

Federal Automated Information Systems 

(http://www.whitehouse.gov/omb/

circulars/a130/a130.html) as well as 

Federal Information Processing 

Standard 200 entitled ‘‘Minimum 

Security Requirements for Federal 

Information Systems’’ (http://csrc.nist.

gov/publications/fips/fips200/FIPS-200- 

final-march.pdf); and Special 

Publication 800–53 ‘‘Recommended 

Security Controls for Federal 

Information Systems’’ (http://csrc.nist.

gov/publications/nistpubs/800-53-Rev2/

sp800-53-rev2-final.pdf). 

Comment: Commenters were in 

support of requiring qualified entities to 

sign a DUA with CMS. One commenter 

suggested we ensure the DUA is 

appropriate for this program, since the 

DUA cited in the proposed rule was the 

current DUA used for research 

purposes. Another commenter suggested 

CMS impose civil and criminal 

penalties on any qualified entity that 

causes a data privacy breach or 

violation. In addition, one commenter 

requested that we discuss how a 

qualified entity’s existing DUAs might 

interact with this program. 

Response: We believe the requirement 

for each qualified entity to sign a DUA 

will ensure a high level of privacy and 

security of the Medicare data given to 

qualified entities. Because we have 

clarified that qualified entities do not 

need to be composed of a single legal 

entity, but may contract with other 

entities to achieve the ability to meet the 

eligibility criteria, we also clarify that 

both the lead entity as well as its 

contractors that are anticipated to use 

Medicare claims data or beneficiary 

identifiable data are required to sign the 

DUA. As discussed in the proposed 

rule, the DUA cited in the proposed rule 

is the current research DUA. We intend 

to use the addendum feature provided 

for in paragraph 12 of the document to 

address the specific needs of the 

qualified entity program. With regard to 

the comment suggesting imposition of 

civil and criminal penalties, we point 

out that the DUA currently does, and 

will continue to have, enforcement 

mechanisms including criminal 

penalties. CMS intends to make use of 

these provisions in the event of a breach 

or violation. We do not have the 

statutory authority to impose penalties 

beyond those already listed in the DUA. 

Finally, we note that DUAs are specific 

to a particular data disclosure from CMS 

to a data recipient. Any existing DUAs 

a qualified entity may have in place will 

only affect the data received under those 

DUAs. The qualified entity program 

DUA will govern qualified entity 

program Medicare data. 

Comment: We received some 

comments containing suggestions for 

requirements CMS should impose on 

qualified entities with regard to internal 

qualified entity operations. These 

suggestions included requiring that 

qualified entities limit the number of 

staff with access to identifiable 

information, and that qualified entities 

store Medicare data separately from 

other claims data. 

Response: The DUA, discussed above, 

contains provisions regarding access to 

and storage of CMS data. The DUA 

requires the qualified entity to limit 

access to the identifiable Medicare data 

to the minimum number of individuals 

required to create the performance 

reports. The DUA also requires the 

qualified entity to specify the site where 

the data is to be stored and to grant CMS 

access to the site to confirm compliance 

with the DUA. Additionally, as stated in 

the preamble to the proposed rule, we 

believe the entities that will be 

successful applicants to this program 

are entities that are experienced in 

handling sensitive information and will 

have the appropriate internal protocols 

and procedures in place. 

We also sought public comment on 

the appropriateness of accepting some 

form of independent accreditation or 

certification of compliance with data 

privacy and security requirements from 

qualified entities, and what that 

accreditation or certification might 

entail. The accreditation or certification 

would need to be at a level and scope 

of security that is not less than the level 

and scope of security requirements 

described above. 

Comment: We received no comments 

on this proposal. 

Response: Since we received no 

comments, we will not require qualified 

entities to have any kind of 

accreditation or certification separate 

from CMS’ process in reviewing the 

application and requiring a signed DUA. 

We proposed that all the Medicare 

claims data provided to qualified 

entities would contain a unique 

encrypted beneficiary identification 

number, which would enable the 

qualified entities to link all Medicare 

claims for an individual beneficiary 

without knowing the identity (that is, 

name or Medicare Health Insurance 

Claim Number) of the beneficiary. We 

did not propose to send patient names 

with the claims data that would be 

initially disclosed to qualified entities. 

However, we recognized the need for 

beneficiary names to facilitate provider 

and supplier appeals. 

In the proposed rule, we considered 

three potential options for sharing 

beneficiary identifiers with qualified 

entities, and by extension, providers 

and suppliers. Under the first option, all 

qualified entities would be provided 

with a crosswalk file, with appropriate 

privacy and security protections, linking 

all encrypted beneficiary identifiers to 

the patients’ names for their Medicare 

data. This would provide the qualified 

entity with identifiable data, but 

qualified entities would be permitted to 

give to a provider or supplier only the 

names of the beneficiaries included in 

that requester’s performance report. 

Under the second option, CMS would 

only provide beneficiary names to 

qualified entities on a transactional 

basis for the purposes of responding to 

specific requests for data by providers 

and suppliers. Each request for 

beneficiary names would be addressed 

on a case-by-case basis through the 

forwarding of each data request by the 

qualified entity to CMS. CMS would 

then allow the qualified entity access to 

the beneficiary names for the specific 

data request. Under the third option, a 

provider or supplier who wishes to 

receive beneficiary names would 

request the encrypted claims data from 

the qualified entity as permitted under 

the statute. Then, the provider or 

supplier would submit a request to CMS 

for the beneficiary names for those 

specific claims and CMS would share 

the beneficiary names directly with the 

provider or supplier. Under the third 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76555 

option, the qualified entity would never 

have access to the beneficiary names. 

Comment: Comments were mixed 

between favoring the first option and 

the second option. Very few 

commenters supported the third option. 

As discussed above in Section II.B.1., 

some commenters were interested in 

using measures that incorporate clinical 

data. A number of these commenters 

noted that the information contained in 

the crosswalk under option one 

(beneficiary names) would be necessary 

to their being able to link claims data to 

clinical data. Several commenters also 

noted that they would need an 

additional identifier, like the Medicare 

Health Insurance Claim Number (HICN), 

if they were to ensure the accurate 

linkage. Among other things, they 

asserted that the inclusion of multiple 

identifiers would ensure that they could 

differentiate amongst individuals with 

similar or identical names. 

Additionally, several commenters noted 

that, in instances in which an 

individual moved from coverage under 

one plan (for example, a private plan) to 

coverage under another (for example, 

Medicare), they would need patient 

identifiers in order to track the care 

provided to a patient over time. These 

commenters also supported the first 

option since it would allow qualified 

entities to match an individual’s claims 

from other sources with their Medicare 

claims data. Commenters also supported 

the first option because it would allow 

qualified entities to quickly respond to 

requests for the data from providers and 

suppliers, and argued that the first 

option would be the least burdensome 

for qualified entities. 

One commenter suggested we phasein release of beneficiary-identifiable 

information: In the first year, qualified 

entities would receive the full crosswalk 

so they can easily respond to the 

anticipated high volume of requests 

from providers and suppliers, but in 

later years, after recipients are more 

familiar with the reports, beneficiaryidentifiable information would only be 

released on a transactional basis. Still 

other commenters supported the second 

option because they felt it offered an 

appropriate balance between ensuring 

beneficiary privacy and allowing 

qualified entities to respond to specific 

provider or supplier requests for 

beneficiary names. 

Response: In response to the insights 

offered by the comments, we plan to 

implement a modified version of the 

first option. While we had thought that 

‘‘If one approaches this issue purely 

from the point of view of the ability of 

qualified entities to engage in measure 

calculation and reporting, beneficiary 

identifiable data is not required’’ (76 FR 

33574), it is clear from the comments 

noted above that beneficiary identifiable 

data, with appropriate privacy and 

security protections, is required if 

clinical data is to be used or if a 

qualified entity needs to link an 

individual’s claims records across plans 

as they move over time from plan to 

plan. 

For example, a qualified entity could 

have private plan data for a patient who 

was enrolled in a private health plan in 

2009 and early 2010, but then in May 

2010 enrolled in Medicare. To 

accurately calculate measures, the 

qualified entity may need to be able to 

match the private payer claims data that 

covers 2009 and January to April of 

2010 for the patient with the Medicare 

claims data that covers May 2010 

forward for the same patient. The 

beneficiary name alone would not be 

sufficient to match patients between 

claims data sources because of the high 

likelihood of duplicative names or 

naming variations in the data. To 

accurately match claims data from 

multiple sources, the patient social 

security number would be ideal. 

However, Medicare claims contain the 

Medicare HICN, which for many 

beneficiaries is the beneficiary’s social 

security number plus a letter. In most 

cases the HICN will allow qualified 

entities to differentiate between 

individuals, and may allow for 

accurately matching claims data 

between sources in those instances in 

which it does include the beneficiary’s 

own social security number. We 

acknowledge that there are cases where 

the HICN does not include the 

beneficiary’s social security number, for 

example, for beneficiaries who qualify 

for Medicare through their spouse. In 

these cases, the beneficiary name will be 

the best available identifier to use to 

match records from multiple sources, 

but even if the HICN cannot be used to 

match claims data between sources, it 

will still be needed to differentiate 

individuals with similar names or 

naming variations. 

In light of the overwhelming support 

for the release of a crosswalk file in the 

comments, the likelihood that entities 

will need the identifiers to combine 

clinical data or link claims records 

across plans over time, the need for the 

identifiers to conduct the provider and 

supplier review and appeal process, and 

the considerable costs that would be 

entailed in building a case-by-case 

inquiry capability for qualified entities, 

we will amend our proposal and adopt 

the policy of automatically releasing a 

crosswalk file with appropriate privacy 

and security protections linking the 

encrypted ID to both the beneficiary 

name and the beneficiary Medicare 

HICN to all qualified entities. This 

constitutes a modified version of option 

one. 

We expect that our rigorous eligibility 

requirements, the requirement that the 

lead entity, as well as any contractors 

who use the data, sign a DUA, and 

comprehensive monitoring process will 

ensure that any data shared with 

qualified entities are kept in a manner 

that will not compromise beneficiary 

privacy. As noted above, an applicant 

must have strict data privacy and 

security protocols in place to be eligible 

to serve as a qualified entity. 

Furthermore, the DUA contains a 

requirement that the qualified entity 

establish the ‘‘appropriate 

administrative, technical, and physical 

safeguards to protect the confidentiality 

of the data and to prevent unauthorized 

use or access to it’’ and does not allow 

the data to be physically moved, 

transmitted, or disclosed without 

written approval from CMS. The DUA 

also allows CMS or the Office of the 

Inspector General to access the site 

where the data is stored to confirm 

compliance with required security 

standards. The DUA requires the 

qualified entity to limit access to the 

data to the minimum amount of data 

and minimum number of individuals 

necessary to achieve the purposes of the 

qualified entity program. In the event 

that CMS determines or has a reasonable 

belief that unauthorized uses, reuses, or 

disclosures of the data may have taken 

place, the DUA allows CMS, among 

other things, to require the destruction 

of all data files and to refuse to release 

further CMS data to the qualified entity 

for any period of time. As noted above, 

the DUA also contains criminal 

penalties, including fines and 

imprisonment, for unauthorized 

disclosures of the data. The 

comprehensive qualified entity 

monitoring program is discussed in 

more detail below in section II.F. and 

includes CMS audits of qualified 

entities’ use of the data, site visits, and 

analysis of beneficiary and/or provider 

complaints among other things. 

As a result of the decision to release 

a crosswalk with appropriate privacy 

and security protections to all qualified 

entities, qualified entities will already 

be in possession of patients’ names and 

HICNs at the time providers and 

suppliers are reviewing draft reports 

and making correction requests. We will 

ensure that the qualified entity program 

DUA (discussed above) provides for 

qualified entities releasing names only 

upon request by providers and suppliers 


emcdonald on DSK5VPTVN1PROD with RULES2
76556 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

when that information is relevant to 

their review and requests for correction. 

We recognize that some may question 

why we are retaining our plan to 

include an encrypted beneficiary 

identifier in the claims data if every 

qualified entity will receive the 

crosswalk. We have two reasons to 

separate the claims data from the 

beneficiary names and HICNs. First, 

shipping the claims data separate from 

the crosswalk file adds an additional 

level of security while the data is in 

transit. Second, we believe that 

qualified entities may want to limit 

access to the crosswalk file to ensure the 

utmost privacy and security of this data 

and having two separate files will make 

this much easier. 

It is also worth noting that CMS does 

not ship claims data without first 

encrypting the data. Unlike encrypting 

an individual data element, this process 

involves cryptographically scrambling 

the data so that it cannot be correctly reassembled (that is, deciphered) unless 

the receiving party has the correct key. 

This protects the data while it is in 

transit. 

We hope that through implementing 

this modified version of option one with 

appropriate privacy and security 

protections, qualified entities will be 

able to link clinical data to claims data 

and match claims data from other 

sources to Medicare claims data for the 

same patient. Additionally, 

implementing a modified version of 

option one allows qualified entities to 

quickly respond to requests from 

providers or suppliers for beneficiary 

identifiers during the report review and 

correction request process. 

2. Privacy and Security Requirements of 

Data Released to Providers and 

Suppliers 

Section 1874(e)(4)(B)(v) of the Act 

requires qualified entities to make the 

Medicare claims data they receive 

available to providers and suppliers 

upon their request. We do not interpret 

this requirement to mean that providers 

or suppliers could receive all Medicare 

claims data for a given patient or 

patients. Rather, we proposed to require 

qualified entities to provide, with 

appropriate privacy and security 

protections, only the claims relevant to 

the particular measure or measure 

results being appealed. Therefore, for 

example, a provider or supplier 

requesting claims data in relation to a 

diabetes quality measure would only 

receive the claims related to the 

calculation of that quality measure. We 

realize this may result in providers or 

suppliers receiving data related to 

claims submitted by another provider or 

supplier. We solicited comment on any 

privacy or security issues related to 

release of data to providers or suppliers. 

Comment: We received several 

comments concerning the privacy and 

security of the data released to providers 

and suppliers. One commenter 

suggested we clarify exactly what data 

can be requested from the qualified 

entity. And, as stated above, comments 

included the suggestion that CMS 

require non-covered entities (that is, the 

small fraction of providers who do not 

submit claims electronically, and are 

therefore not subject to HIPAA) to enter 

into business associate agreements with 

CMS, pursuant to HIPAA. 

Response: Regarding the request for 

clarification about what data can be 

released, we stated in the preamble to 

the proposed rule (at 76 FR 33577), that 

we believe that for many providers and 

suppliers, the beneficiary name may be 

of more practical use in determining the 

accuracy of the measure results than the 

underlying claims used to calculate the 

measures. However, the statute does 

explicitly acknowledge that upon 

request qualified entities would need to 

share with providers or suppliers ‘‘data 

made available under this subsection.’’ 

We would like to reiterate that we do 

not interpret this provision to mean that 

providers or suppliers could receive all 

Medicare claims data for a given patient 

or patients. Rather, we interpret this to 

mean that, at the request of providers or 

suppliers, qualified entities will provide 

only claims and/or beneficiary names 

relevant to the particular measure or 

measure results that the provider or 

supplier is appealing. 

Since we made a technical change in 

the regulation text and removed the 

reference to section 1874(e) from the 

definition of a qualified entity (as noted 

above in Section II.A.1.), we have added 

the requirement that qualified entities 

release Medicare claims to providers 

and suppliers to the regulation text. We 

have added a requirement in 

§ 401.717(c) that qualified entities, at 

the request of a provider or supplier and 

with appropriate privacy and security 

protections, release the Medicare claims 

and/or beneficiary names to the 

provider or supplier, but we require 

qualified entities to only release those 

claims and/or beneficiary names 

relevant to the measure or measure 

results being appealed. 

As stated above, we acknowledge that 

the providers and suppliers who request 

data may or may not be covered entities 

under HIPAA. Also, as noted above, a 

BA is limited to a person or an entity 

using or disclosing individually 

identifiable health information on 

behalf of a HIPAA covered entity. The 

qualified entity and providers and 

suppliers in the qualified entity program 

are not going to be doing anything on 

behalf of CMS or the Medicare program. 

They therefore cannot be BAs of CMS by 

virtue of the qualified entity program. 

3. Beneficiary Privacy and Security 

Following provision of the 

performance reports on a confidential 

basis to providers or suppliers, qualified 

entities are required to make 

performance information public. In 

accordance with the statute, we 

proposed to require that qualified 

entities ensure that all publicly 

available reports do not contain 

beneficiary identifiable information. 

Additionally, we proposed to prohibit 

qualified entities from disclosing 

information in their publicly available 

reports that there is a reasonable basis 

to believe can be used in combination 

with other publicly available 

information to re-identify individual 

patients. 

Comment: One commenter suggested 

we allow beneficiaries to opt-out of 

having their data released under this 

program. 

Response: We do not have the 

statutory authority to permit 

beneficiaries to opt out of this program. 

However, we also note that the intent of 

this program is to increase transparency 

and promote innovation in measure 

development which we believe will 

contribute significantly to improving 

beneficiary care in the long run. As 

mentioned above, we also believe the 

final rule contains appropriate 

beneficiary privacy protections and 

penalties for any misuse of the data by 

qualified entities. 

E. Confidential Opportunities To 

Review, Appeal, and Correct Errors 

One important aspect of this program 

is ensuring that providers and suppliers 

are afforded an opportunity to correct 

errors in the reporting of their 

performance metrics. To meet the 

requirements in the statute related to 

appeal and error correction, we 

proposed to require applicants to 

include a plan for their report review, 

appeals, and error correction process in 

their application. This plan would 

contain several elements, including the 

means for sharing results confidentially 

and the means by which a provider or 

supplier can request and receive 

Medicare claims data. We proposed that 

qualified entities would need to 

confidentially share measure results 

with providers and suppliers at least 30 

days prior to making the reports public. 

We also proposed that qualified entities 

must inform providers and suppliers 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76557 

that the report would be made public on 

a certain date (at least 30 days after 

confidentially sharing the measure 

results), regardless of the status of error 

correction. 

Comment: We received several 

comments on the overall review, 

appeals, and error correction process. 

Some commenters asked CMS to 

standardize the process across qualified 

entities. On the other hand, one 

commenter argued that if CMS both 

approves and audits the claims and the 

qualified entity process for creating the 

reports, review by providers and 

suppliers is unnecessary. Another 

commenter asked CMS to require 

qualified entities to automatically 

provide the beneficiary names to 

providers and suppliers. Several 

commenters asked CMS to require 

qualified entities to announce publically 

on a Web site supported by HHS or in 

notifications to major organizations that 

represent providers and suppliers that 

have been evaluated by the qualified 

entity, the availability of reports for 

confidential review. Finally, several 

commenters suggested allowing 

qualified entities to require that a 

provider or supplier document and 

authenticate their identity and, if 

requesting data, their legal right to see 

the data, as well as provide a secure 

communication process for transmission 

of requested information. 

Response: We believe an important 

aspect of the qualified entity program is 

innovation, not only in the development 

of measures, but also in the process for 

sharing measure results with 

physicians, as well as the process for 

responding to requests for data and for 

error correction. To reiterate, this is not 

a Medicare quality measurement 

program—we are merely a data source 

for those who meet the requirements 

laid out in this subpart. Qualified 

entities design their programs within 

the statutory and regulatory limits, 

including crafting their own 

confidential review, appeals, and error 

correction processes. This will result in 

innovations that will improve the way 

providers and suppliers receive reports 

and interact with the qualified entity. 

The statute is clear in the requirement 

that qualified entities develop a 

confidential review, appeals, and error 

correction process, so we do not agree 

that this is an unnecessary part of the 

qualified entity program. Furthermore, 

while we understand the interest in 

obtaining beneficiary names 

automatically, protecting the privacy 

and security of beneficiary identifiable 

information is required by the statute, as 

well as being of the utmost importance 

to CMS. We feel that releasing 

beneficiary names only at the request of 

a provider or supplier and only for the 

measure or measure results being 

appealed strikes the appropriate balance 

between protecting beneficiary privacy 

and allowing providers and suppliers 

the opportunity to provide input on 

their reports. 

The statute requires that qualified 

entities make reports available to 

providers and suppliers prior to the 

public release of reports. Since each 

provider or supplier will confidentially 

receive any report where they are 

identified, we see no need for qualified 

entities to announce publically the 

availability of reports. Additionally, we 

acknowledge the importance of ensuring 

the data is securely transmitted to the 

correct provider or supplier. However, 

we believe that it is the responsibility of 

the qualified entity to ensure that the 

data is delivered using a secure method 

to the appropriate provider or supplier 

and require applicants to describe their 

means of confidentially sharing reports 

with providers and suppliers as part of 

their application. 

Comment: Many commenters argued 

that the proposed time period between 

providers and suppliers confidentially 

receiving reports and the qualified 

entity publically reporting results is too 

short. Commenters suggested a time 

period of 60 or 90 days. 

Response: We recognize, in light of 

the comments, that our proposal may 

not have allowed providers and 

suppliers an appropriate amount of time 

to review their confidential reports. 

However, we also recognize the 

importance of ensuring that report 

results are released to the public in a 

timely manner. Therefore, qualified 

entities must share measures, 

measurement methodology, and 

measure results with providers and 

suppliers at least 60 calendar days prior 

to making the measure results public. 

Beginning on the date on which the 

qualified entity sends the confidential 

reports to a provider or supplier, that 

provider and supplier will have a 

minimum of 60 calendar days to review 

the reports, make a request for the data, 

review the data, and, if necessary, make 

a request for error correction. Qualified 

entities also must inform providers and 

suppliers of the date the reports would 

be made public at least 60 calendar days 

before making the reports public. 

Additionally, the qualified entity must 

publically release reports on the 

specified date regardless of the status of 

any requests for error correction. We 

recognize that this process allows 

providers and suppliers to make a 

request for the data or a request for error 

correction up to the point the reports are 

made public; however, we believe that 

it is up to the qualified entity and 

provider or supplier to manage the 

timing of this process to ensure that 

they have adequate time to request the 

data and, if necessary, request error 

correction(s). 

Comment: We received several 

comments on our proposal that 

qualified entities publish reports on a 

certain date, regardless of the status of 

requests for appeals or error correction. 

Several commenters requested that CMS 

not allow qualified entities to publish 

measure results until the request for 

error correction is resolved. Other 

commenters recommended that we 

create a two-step track where if a 

request cannot be resolved between the 

qualified entity and a provider or 

supplier, the request is elevated to CMS 

for a final decision. Furthermore, some 

commenters wanted CMS to require 

qualified entities to publish provider or 

supplier comments in the report if a 

request is not resolved at the time of 

report publication. One commenter 

requested that CMS allow providers or 

suppliers to publicly defend themselves 

if reports are published prior to 

resolving error correction requests. We 

also received a comment suggesting 

CMS allow providers or suppliers to 

appeal after reports are made public. 

Finally, one commenter asked CMS to 

ensure that qualified entities have the 

appropriate amount of staff to respond 

to appeals. 

Response: We acknowledge the 

interest of providers and suppliers in 

ensuring that any measure results 

reported publicly are correct. However, 

as we mentioned in the proposed rule, 

we included this requirement to prevent 

providers or suppliers from making 

spurious requests for error correction to 

prevent the publication of measure 

results. We will maintain our 

requirement that qualified entities 

publicly report measure results on the 

date specified to the provider or 

supplier when the report is sent for 

review (at least 60 days after the date on 

which the confidential reports are sent 

to a provider or supplier), regardless of 

the status of a request for error 

correction. We hope that by extending 

the amount of time between 

confidentially sharing reports with 

providers and suppliers and publically 

reporting results to at least 60 calendar 

days, we are allowing both providers 

and suppliers ample opportunity to 

resolve the appeals process. If an appeal 

request is still outstanding at the time of 

public reporting, we will maintain the 

requirement that qualified entities post 

publicly the name and category of the 

appeal request for providers or suppliers 


emcdonald on DSK5VPTVN1PROD with RULES2
76558 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

with outstanding requests for error 

correction, if feasible, but do not believe 

that qualified entities should be 

required to publicly post comments 

from providers or suppliers. 

Additionally, since this program does 

not involve CMS contracting with 

qualified entities to carry out a quality 

measurement program on behalf of 

CMS, we do not believe it is appropriate 

for CMS to become involved in the 

appeals and error correction process or 

to offer a public forum for providers or 

suppliers to defend themselves. We 

recognize the concern about ensuring 

that a qualified entity has the 

appropriate staff to respond to requests 

for error correction. However, we are 

certain that the rigorous application 

process will guarantee that only 

qualified organizations receive Medicare 

claims data. Additionally, we will be 

monitoring qualified entities to 

determine if they are promptly 

responding to requests for data and 

requests for error correction. 

In the proposed rule, we 

acknowledged that CMS does not have 

the statutory authority to require 

qualified entities to share their claims 

data from other sources. We encouraged 

qualified entities to share this data with 

providers or suppliers upon request. 

Comment: We received multiple 

comments asking CMS to require 

qualified entities to release their nonMedicare claims data to providers or 

suppliers upon request. Some 

commenters requested that CMS only 

approve entities who agreed to release 

their other claims data. 

Response: We do not have the 

statutory authority to require qualified 

entities to release their non-Medicare 

data. We hope that qualified entities 

will choose to do so whenever it is 

legally permitted, but are aware that 

their ability to release other claims data 

is partially dependent on the terms of 

the arrangement the qualified entity has 

with the entity from whom they 

received the data. 

Comment: Commenters suggested we 

implement 2012 as a ‘‘test year’’ for the 

program and allow qualified entities to 

only produce confidential performance 

reports without any public reporting. 

Response: We do not have the 

statutory authority to implement a ‘‘test 

year’’ for this program. The statutory 

effective date of this provision is 

January 1, 2012, and all requirements 

under the law are applicable on that 

date. 

F. Monitoring, Oversight, Sanctioning, 

and Termination 

To ensure that qualified entities 

adhere to the highest standards, we 

proposed a monitoring program that 

would assess compliance with the 

requirements of the program and assess 

sanctions or termination as deemed 

appropriate by CMS. We proposed that 

CMS, or one of its designated 

contractors, would periodically audit 

(including site visits) qualified entities 

for their use of the Medicare data to 

ensure that the data is only being used 

for its intended purpose. We also 

proposed to monitor the amount of 

claims data from other sources the 

qualified entity is using in the 

production of performance reports using 

documentation produced by the 

qualified entity or, at the discretion of 

CMS, site visits. Additionally, we 

proposed to use analysis of beneficiary 

and/or provider complaints to monitor 

and assess the performance of qualified 

entities. We also proposed to require 

qualified entities to submit an annual 

report covering program adherence (for 

example, number of claims, market 

share, number of measures) and 

engagement of providers and suppliers 

(for example, requests for data, number 

of corrections, time to respond to 

requests for appeal or error correction). 

Finally, we proposed requiring qualified 

entities to submit to CMS information 

regarding any inappropriate disclosures 

or uses of beneficiary identifiable data 

pursuant to the requirements in the 

DUA. 

Comment: We received many 

comments supporting our monitoring 

program. Some commenters specifically 

supported the requirement that 

qualified entities submit a report 

covering the engagement of providers 

and suppliers. One commenter asked 

CMS to ensure that there is appropriate 

funding for CMS to conduct the 

necessary qualified entity monitoring 

activities. 

Response: We would like to reiterate 

our commitment to ensuring the 

successful implementation of this 

program and that all qualified entities 

adhere to the highest standards, which 

includes ensuring that we have the 

necessary funding to support a 

monitoring program. 

Comment: Some commenters made 

suggestions about specific aspects of the 

monitoring plan. One commenter 

suggested that qualified entities only 

submit reports on program adherence 

and engagement of providers and 

suppliers once every two years. 

Additionally, several commenters 

requested CMS not include site visits as 

a part of monitoring because it is too 

burdensome. 

Response: We plan to maintain our 

proposed monitoring process and note 

that, in the cases where a qualified 

entity is composed of a lead entity and 

contractors, contractors will also be 

subject to CMS monitoring. We believe 

that annual reports and site visits are 

essential to allow CMS to best monitor 

the program and to both maximize the 

appropriate use of Medicare data for the 

production of performance reports and 

minimize the risk of inappropriate 

disclosure of beneficiary information. 

We proposed that a qualified entity 

must immediately inform CMS if its 

amount of claims data from other 

sources decreases. We also proposed to 

require that the qualified entity provide 

documentation that the remaining nonMedicare claims data is still sufficient to 

address methodological concerns 

regarding sample size and reliability 

expressed by stakeholders regarding the 

calculation of performance measures 

from a single source. As reflected at 

§ 401.706(c) of the proposed rule, the 

qualified entity would no longer be able 

to issue a report, use a measure, or share 

a report after the amount of claims data 

from other sources decreases until CMS 

made an assessment as to the 

sufficiency of the remaining data. If 

CMS determined that the qualified 

entity’s remaining claims data was not 

sufficient, we proposed that the 

qualified entity would have 60 days to 

acquire new data and submit new 

documentation to CMS. The qualified 

entity would not be able to use 

Medicare data to issue reports, use 

measures, share measures, or share a 

report during this time. If after resubmission of documentation, CMS 

determined the qualified entity still did 

not possess adequate data, we proposed 

to terminate the relationship with the 

qualified entity. If after resubmission of 

documentation, CMS determined that 

the qualified entity did possess 

sufficient data, we proposed the 

qualified entity could resume all 

measurement and reporting activities. 

Comment: Commenters requested two 

changes to our proposed process for 

addressing a decrease in the amount of 

other claims data. First, several 

commenters suggested that qualified 

entities only be required to stop 

measurement and reporting if the 

decrease in other claims data is 

significant. Second, commenters 

requested more time for qualified 

entities to acquire new data. 

Response: While we recognize the 

interest in continuing measurement 

efforts during this review process, we 

believe it is important for CMS to make 

the determination as to whether the 

remaining claims data is adequate to 

ensure that the methodological concerns 

regarding sample size and reliability 

expressed by stakeholders regarding 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76559 

calculation of performance measures 

from a single payer source. To ensure 

that the decrease does not materially 

affect the validity of measure results, we 

will maintain our proposal to require 

qualified entities to stop all activities 

while CMS reviews the documentation 

related to the decrease in other claims 

data; after the amount of claims data 

from other sources decreases, the 

qualified entity would no longer be able 

to create a report, use a measure, or 

share a report (either confidentially or 

publically) using Medicare data until 

CMS determines either that the 

remaining claims data is sufficient, or 

that the qualified entity has collected 

adequate additional data to address any 

deficiencies. That said, we recognize the 

request to extend the amount of time a 

qualified entity has to acquire new data, 

so we will extend this timeframe to 120 

days. 

We also proposed that if a qualified 

entity is not adhering to the 

requirements of the program, CMS may 

take several enforcement actions, such 

as providing a warning notice, 

requesting a corrective action plan, 

placing an entity on a special 

monitoring plan, or terminating the 

qualified entity. These enforcement 

actions are in addition to the actions 

CMS may take if a qualified entity 

violates the DUA, as discussed in more 

detail above in section II.D.1. The 

choice of enforcement action would 

depend on the seriousness of the 

deficiency. Any time a qualified entity 

is voluntarily or involuntarily 

terminated, we proposed requiring the 

destruction or return of Medicare data 

within 30 days. 

Comment: We received some 

comments stating that the proposed 

penalties are not strict enough. 

Additionally, one commenter requested 

that CMS provide for termination for 

inaccurate reporting or for failing to 

make timely corrections upon providers’ 

or suppliers’ request. 

Response: We are limited by the 

statute in the penalties we can impose 

on qualified entities who do not comply 

with the requirements of the program. 

We note, however, that CMS does have 

additional enforcement capabilities for 

violations of the DUA, including 

criminal penalties. As CMS will require 

the lead entity, as well as any 

contractors who have access to the 

Medicare claims data or beneficiary 

identifiable data, to sign the DUA before 

CMS releases any data, these penalties 

will apply to all organizations with 

access to the Medicare data. 

While CMS reserves the right to 

terminate a qualified entity for 

inaccurate reporting, we believe that 

there are degrees of seriousness in 

inaccurate reporting, and some 

situations may not warrant termination, 

particularly if the inaccuracy was 

unintentional, CMS was promptly 

identified, and the inaccuracy was 

promptly resolved. We will therefore 

maintain our proposal to base our 

actions on the seriousness of the 

deficiency. 

Comment: Several commenters 

requested clarification on how long 

qualified entities would be able to keep 

the Medicare data that they receive 

under this program. One commenter 

suggested placing an outer limit on 

retention of files. 

Response: After carefully considering 

the beneficiary privacy and security 

implications of our policy, we do not 

believe that qualified entities must 

destroy or return Medicare data 

(including crosswalks) provided under 

the qualified entity program unless they 

voluntarily leave or are involuntarily 

terminated from the program. Qualified 

entities will need to retain the Medicare 

data, with appropriate privacy and 

security protections, in order to trend 

measure results over time or to calculate 

measures that require a number of years 

of data for measure calculation. We 

understand that this will mean that 

qualified entities will also retain 

beneficiary identifiable data (including 

that found in the crosswalks), but we 

believe that this information will also be 

necessary to calculate measures that 

require a number of years of claims data. 

We feel it is important to note that a 

beneficiary’s encrypted identifier will 

not change from year to year, so unless 

a beneficiary dies or moves out of the 

geographic region, the qualified entity 

will continue to need the crosswalk 

linking the encrypted ID to the 

beneficiary HICN and name to carry out 

the activities outlined above in our 

crosswalk discussion. We have carefully 

considered the beneficiary privacy and 

security implications of our policy, and 

note that the DUA remains in effect so 

long as the qualified entity participates 

in the program. Furthermore, the 

monitoring requirements described 

herein, as well as the requirement that 

qualified entities reapply every three 

years as described below in section II.G., 

should assist in ensuring that this data 

remains secure and private. We would 

like to reiterate, however, that once an 

entity voluntarily leaves or is 

involuntarily terminated from the 

program it must destroy or return all 

CMS data provided under this 

subsection within 30 days. 

G. Qualified Entity Application Content 

We proposed to develop an 

application process for organizations 

interested in becoming qualified entities 

in which they would provide certain 

specified information. We proposed 

applications and related materials 

would be collected and reviewed once 

a year, at the close of the first quarter 

of the calendar year. We proposed 

approval periods of three years, 

followed by an opportunity to reapply. 

Comment: We received comments 

containing suggestions for how CMS 

could improve the application content 

and process. Specifically, one 

commenter suggested using a standard 

electronic application. Additionally, a 

commenter suggested that CMS accept 

applications on a rolling basis. Another 

commenter preferred that CMS not 

require re-application after three years. 

Response: CMS appreciates and 

acknowledges the benefits of accepting 

qualified entity applications on a rolling 

basis instead of once annually. This 

would allow organizations to apply to 

be a qualified entity as soon as they 

believe they meet all the eligibility 

requirements, instead of requiring the 

organization to wait a year until the next 

application cycle. We are therefore 

changing to a rolling application 

process. We will also use an electronic 

application. 

While we understand the burdens that 

re-application will impose, we also need 

to ensure that Medicare data are being 

used appropriately and handled 

securely. While we believe the 

monitoring program described above 

will help ensure qualified entities 

continue to meet the requirements of the 

program, the application process covers 

significantly more aspects of an 

organization’s continuing ability to 

serve as a qualified entity. Therefore, 

CMS believes that requiring reapplication every three years balances 

the burden on qualified entities with the 

need to ensure Medicare data is being 

handled appropriately. 

H. Other Comments 

We received several additional 

suggestions for improvements to the 

program regarding topics that were not 

specifically discussed in the preamble 

to the proposed rule. 

Comment: A few commenters advised 

that CMS require knowledge sharing 

among qualified entities, rather than 

merely suggesting it. 

Response: CMS agrees with 

commenters that performance 

improvement will occur most rapidly in 

an open collaborative environment 

where ideas and knowledge are shared 


emcdonald on DSK5VPTVN1PROD with RULES2
76560 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

freely and openly. CMS will strongly 

encourage and facilitate, where possible, 

collaborative knowledge sharing, but 

will not require it as a condition of 

program participation. 

Comment: Several commenters 

expressed concern about CMS 

conducting performance analysis of 

providers and suppliers. Commenters 

also expressed concern about 

performance measurement generally, 

and had specific concerns about 

performance measurement based solely 

on claims data. 

Response: This program is not a CMS 

measurement program and, therefore, 

CMS will not be conducting 

performance analysis of providers and 

suppliers in this program. Rather 

qualified entities will combine Medicare 

claims data supplied by CMS with other 

claims data to calculate performance 

measures for providers and suppliers. 

We recognize commenters’ concerns 

about the limitations of performance 

measurement based on claims data 

alone. Therefore, as discussed above in 

section II.B.1, we will allow qualified 

entities to use measures that incorporate 

clinical data, as long as the measure can 

be calculated in part from Medicare and 

other claims data. 

Comment: Commenters suggested 

CMS should undertake a public 

education and outreach program to 

inform consumers about the qualified 

entity program and explain the 

limitations of provider and supplier 

performance measurement. 

Response: We agree that CMS should 

inform consumers about the qualified 

entity program. We also believe it is 

essential for CMS to be transparent to 

beneficiaries and the general public 

about our plans for sharing identifiable 

information, with appropriate privacy 

and security protections, with qualified 

entities. CMS will publish educational 

materials on the CMS Web site 

regarding the qualified entity program, 

including a description of the 

beneficiary information that is being 

shared with qualified entities and an 

explanation of the privacy and security 

requirements, as well as the qualified 

entity monitoring program and 

termination policies. 

We also hope that qualified entities 

will engage in public education and 

outreach in the communities where they 

serve. However, we are not requiring 

qualified entities to do public outreach 

beyond making the performance reports, 

with an understandable description of 

the measures, available to the public 

after confidential review by providers 

and suppliers. 

Comment: One commenter requested 

that we clarify how performance 

measurement information will be 

published. 

Response: The statute requires that 

qualified entities allow confidential 

review of the reports, that they be 

provided to the public, and that the 

reports contain understandable 

descriptions of the methodologies used. 

Qualified entities must receive approval 

of report formats before they can be 

published, but each qualified entity has 

the discretion to design reports and 

publish using the approved formats. 

Comment: One commenter suggested 

that CMS make available the full data 

set at no charge to recognized provider 

organizations such as the American 

Medical Association and allow 

providers and suppliers to analyze their 

data there. 

Response: The statute does not permit 

CMS to release the data to any entity 

other than those approved as qualified 

entities. However, as stated in the 

preamble to the proposed rule, we are 

not placing any restrictions on the types 

of organizations that can apply to be a 

qualified entity. If a recognized provider 

organization meets the eligibility 

criteria, it can become a qualified entity 

and receive Medicare data. 

Additionally, the statute does not 

permit CMS to release data at no charge. 

Section 1874(e)(4)(A) states that the data 

‘‘shall be made available * * * at a fee 

equal to the cost of making such data 

available.’’ That said, as discussed in 

section II.C.3. above, we have revised 

our method for pricing this data and we 

believe the data will be significantly 

more affordable than originally 

proposed. 

Comment: One commenter requested 

that CMS clarify that the data released 

to qualified entities will not be subject 

to discovery or admissible as evidence 

in judicial or administrative 

proceedings. 

Response: The statute, at 

1874(e)(4)(D), explicitly states, ‘‘[d]ata 

released to a qualified entity under this 

subsection shall not be subject to 

discovery or admission as evidence in 

judicial or administrative proceedings 

without consent of the applicable 

provider of services or supplier.’’ We 

acknowledge that we did not address 

this specific statement in the preamble 

to the proposed rule, but we believe this 

statement is self-implementing in that it 

requires no further explanation, and the 

data will not be subject to discovery or 

admission as evidence absent the 

described consent(s). 

Comment: One commenter asked 

CMS to clarify that these regulations 

have no effect on any other programs in 

which Medicare claims data are 

released. A second commenter 

requested that we ensure the program 

can accommodate the transition to 

ICD–10. 

Response: We clarify that this 

program will not have any effect on 

other CMS programs in which Medicare 

claims data are released. CMS is 

working to ensure that the transition to 

ICD–10 happens smoothly. 

Comment: One commenter requested 

that CMS only allow measurement and 

rating of providers and suppliers in 

situations where CMS pays for the item 

or services. 

Response: Medicare only pays claims 

for covered services and supplies; if a 

service or supply is not covered, a claim 

will not appear in the Medicare data. 

While a qualified entity could decide to 

produce a measurement report based 

solely on its other claims data, such 

reporting would be outside of the 

qualified entity program and the reports 

would be outside of the reach of these 

regulations. 

III. Provisions of the Final Regulations 

For the most part, this final rule 

incorporates the provisions of the 

proposed rule. Those provisions of this 

final rule that differ from the proposed 

rule are as follows: 

• We have made technical changes to 

the definition of a qualified entity, 

provider, and supplier to reflect 

regulatory interpretation of the statutory 

provisions cited in the proposed rule. 

We have also added a definition of 

claims data from other sources at 

§ 401.703(h) and a definition of clinical 

data at § 401.703(i). 

• We clarify that qualified entities do 

not need to be a single organization. 

Applicants may contract with others to 

achieve the ability to meet the eligibility 

criteria. Specifically, at § 401.705(b) we 

allow entities to demonstrate expertise 

and experience through activities it has 

conducted directly or through (a) 

contract(s) with other public or private 

entities. 

• We changed our eligibility 

requirements at § 401.705(a)(1) to only 

require that entities demonstrate 

expertise in quality measurement and in 

the other three areas of measurement 

(efficiency, effectiveness, and resource 

use) to the extent that they propose to 

use such measures. 

• At § 401.705(a)(1)(ii) we clarify that 

we only expect applicants to submit a 

plan for a business model that is 

projected to cover the costs of 

performing the required functions. We 

realize that qualified entities may need 

to adapt this plan once they are 

approved and do not intend to limit an 

entity’s ability to adapt or change its 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76561 

business plan once approved as a 

qualified entity. 

• We added language at 

§ 401.705(a)(1)(vii) that would require 

qualified entities to also disclose any 

violations of applicable federal and 

State privacy and security laws and 

regulations for the preceding 10-year 

period, in addition to requiring 

qualified entities to disclose any 

inappropriate disclosures of beneficiary 

identifiable information for the 

preceding 10-year period. We also 

clarified that for those entities that have 

not been in existence for 10 years, we 

will require a breach history for the 

length of time the organization has been 

in existence. 

• We have revised the selection 

criteria to allow applicants to apply and 

receive a conditional acceptance as a 

qualified entity if they do not have 

adequate claims data from other sources 

at the time of their application, but meet 

all the other selection requirements. 

• Since standard measure 

specifications are available to the public 

at this time, we removed the 

requirement that qualified entities 

submit measure specifications for 

standard measures the qualified entity 

plans to calculate. 

• We clarified that these regulations 

do not place any added limitations on 

the qualified entity’s ability to copyright 

the content of the publicly released 

reports. We noted, however that the 

qualified entity must provide 

confidential reports to the subject 

providers and suppliers free of charge 

and must provide the final reports to the 

public free of change in a manner 

consistent with the requirements in the 

qualified entity program statute. 

• At § 401.711(a) we allow qualified 

entities to change their list of proposed 

measures, proposed prototype report, 

and plans for sharing reports with the 

public with 30 days notice to CMS, 

instead of 90 days notice to CMS. We 

provide for a possible 30-day extension 

of the review period where necessary. If 

a CMS decision on approval or 

disapproval for a change or modification 

is not forthcoming within 30 days or 

CMS does not request an additional 30 

days for review, the change or 

modification shall be deemed to be 

approved. 

• We will allow qualified entities to 

use standard and alternative measures 

calculated in full or in part from 

Medicare Parts A and B claims, and Part 

D prescription drug event data and 

claims from other sources. This means 

that qualified entities will be allowed to 

calculate measures that include clinical 

data. As noted above, we have added a 

definition of clinical data at § 401.703(i). 

• We have added measures endorsed 

by a CMS-approved consensus-based 

entity to the list of standard measures. 

CMS will approve organizations as 

consensus-based entities based on 

review of documentation of the 

consensus-based entity’s measure 

approval process. 

• We have added a second process by 

which qualified entities may seek 

approval to use alternative measures. 

Organizations and individuals will still 

be able to submit alternative measures 

for approval through the notice and 

comment rulemaking process. However, 

at § 401.715(b)(1)(ii), we also allow an 

entity to submit measures for approval 

by the Secretary by submitting: (1) A 

description of the process by which the 

qualified entity notified stakeholders 

(defined as a valid cross representation 

of providers, suppliers, employers, 

payers, and consumers) in the 

geographic region the qualified entity 

serves of its intent to seek approval of 

an alternative measures; (2) a list of 

stakeholders from whom feedback was 

solicited, including the stakeholder 

names and each stakeholder’s role in the 

community; (3) a description of the 

discussion about the proposed 

alternative measure, including a 

summary of all pertinent arguments for 

and against the measure; and (4) unless 

CMS has already approved the same 

measure for use by another qualified 

entity, an explanation backed by 

scientific evidence that demonstrates 

why the measure meets the 

requirements for alternative measures at 

Section 1874(e)(4)(B)(i)(II) of the Act. If 

a qualified entity is seeking to use an 

alternative measure that CMS has 

already approved for use by another 

qualified entity, the qualified entity 

submitting the measure for approval 

must submit any additional or new 

scientific evidence, if it is available. If 

a CMS decision on approval or 

disapproval of measures submitted via 

the process at 401.715(b)(1)(ii) is not 

forthcoming 60 days after the 

submission of the measure, the measure 

will be deemed approved. However, 

CMS retains the right, even after 60 

days, to direct the qualified entity to 

stop using the measure if we 

subsequently find the measure does not 

meet the requirements at Section 

1874(e)(4)(B)(i)(II) of the Act. 

• We have identified efficiencies that 

will reduce the cost of Medicare claims 

data under the qualified entity program, 

and we have altered the dates of data 

that will be made available through this 

program, thereby increasing the 

timeliness of that data. 

• We will allow qualified entities to 

purchase a 5 percent national sample of 

Medicare claims data for the purpose of 

calculating national benchmarks. 

• Using appropriate privacy and 

security protections, we will provide 

qualified entities (that sign the DUA and 

meet all the privacy and security 

requirements) with a crosswalk file 

linking encrypted beneficiary ID to the 

beneficiary name and beneficiary Health 

Insurance Claim Number. 

• At § 401.717(a), we extended the 

time period between a qualified entity 

sending a confidential report to a 

provider or supplier and public 

reporting of measure results to at least 

60 calendar days. 

• We will allow qualified entities 120 

days to acquire new data if the amount 

of other claims data they have decreases 

and CMS determines the remaining 

amount of other claims data is not 

sufficient. 

• We changed our application process 

and will accept applications on a rolling 

basis as discussed at § 401.709(a). 

IV. Collection of Information 

Requirements 

Under the Paperwork Reduction Act 

of 1995, we are required to provide 

30-day notice in the Federal Register 

and solicit public comment before a 

collection of information requirement is 

submitted to the Office of Management 

and Budget (OMB) for review and 

approval. In order to fairly evaluate 

whether an information collection 

should be approved by OMB, section 

3506(c)(2)(A) of the Paperwork 

Reduction Act of 1995 requires that we 

solicit comment on the following issues: 

• The need for the information 

collection and its usefulness in carrying 

out the proper functions of our agency. 

• The accuracy of our estimate of the 

information collection burden. 

• The quality, utility, and clarity of 

the information to be collected. 

• Recommendations to minimize the 

information collection burden on the 

affected public, including automated 

collection techniques. 

We are soliciting public comment on 

each of these issues for the following 

sections of this document that contain 

information collection requirements 

(ICRs). 

If finalized, these regulations would 

require an organization seeking to 

receive data as a qualified entity to 

submit an application. Specifically, an 

applicant must submit the information 

listed in §§ 401.705–401.709. The 

burden associated with this requirement 

is the time and effort necessary to 

gather, process, and submit the required 

information to CMS. We estimate that 

35 organizations would submit 

applications to receive data as qualified 


emcdonald on DSK5VPTVN1PROD with RULES2
76562 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

entities. We further estimate that it 

would take each applicant 500 hours to 

gather, process and submit the required 

information. The total estimated burden 

associated with this requirement is 500 

hours per applicant at an estimated cost 

of $795,641. 

Section 401.713(a) states that as part 

of the application review and approval 

process, a qualified entity would be 

required to execute a Data Use 

Agreement (DUA) with CMS, that 

among other things, reaffirms the 

statutory bar on the use of Medicare 

data for purposes other than those 

referenced above. The burden associated 

with executing this DUA is currently 

approved under OMB control number 

0938–0734. 

Section 401.709(f) would require 

qualified entities in good standing to reapply for qualified entity status 6 

months before the end of their threeyear approval period. We estimate that 

25 entities would be required to comply 

with this requirement. We estimate that 

it would take 120 hours to reapply to 

CMS. The total estimated burden 

associated with this requirement is 120 

hours at an estimated cost of $136,396. 

Section 410.719(b) requires qualified 

entities to submit annual reports to CMS 

as part of CMS’ ongoing monitoring of 

qualified entity activities. We estimate 

that the 25 entities in the program will 

be required to comply with this 

requirement. We estimate that it will 

take 150 hours to complete an annual 

monitoring report. The total estimated 

burden associated with this requirement 

is 150 hours at $170,475. 

TABLE 1—ESTIMATED ANNUAL RECORDKEEPING AND REPORTING BURDEN

Regulation section(s) OMB control 

No. Respondents Responses 

Burden per 

response 

(hours) 

Total annual 

burden 

(hours) 

Hourly labor 

cost of 

reporting 

($) 

Total labor 

cost of 

reporting 

($) * 

Total 

capital/ 

maintenance 

costs 

($) 

Total cost 

($) 

§ 401.705(a) ............................ 0938–New .. 35 35 500 17,500 ** 795,641 0 795,641 

§ 401.709(f) ............................. 0938–New .. 25 25 120 3,000 ** 136,396 0 136,396 

§ 401.719(b) ............................ 0938–New .. 25 25 150 3,750 ** 170,475 0 170,475 

Total ................................. .................... 35 35 .................... 24,250 .................... .................... .................... 1,102,512 

* Total labor cost assuming 92% of total hours are professional and technical and 8% are legal. 

** Wage rates vary by level of staff involved in complying with the information collection request (ICR). 

To obtain copies of the supporting 

statement and any related forms for the 

proposed paperwork collections 

referenced above, access CMS’ Web site 

at http://www.cms.gov/Paperwork

ReductionActof1995/PRAL/list.asp#

TopOfPage or email your request, 

including your address, phone number, 

OMB number, and CMS document 

identifier, to Paperwork@cms.hhs.gov, 

or call the Reports Clearance Office at 

410–786–1326. 

If you comment on these information 

collection and recordkeeping 

requirements, please submit your 

comments to the Office of Information 

and Regulatory Affairs, Office of 

Management and Budget, 

Attention: CMS Desk Officer, CMS– 

5059–F. 

Fax: (202) 395–6974; or 

Email: 

OIRA_submission@omb.eop.gov. 

V. Regulatory Impact Analysis 

A. Response to Comments 

We received several comments on the 

anticipated effects of the program. 

Comment: Several commenters argued 

that the cost of the data is too high. As 

stated above, these commenters often 

recommended CMS remove the data 

application costs or provide a sliding 

scale fee for the data, charging nonprofits and government organizations a 

lower fee. 

Response: While we do not feel we 

were being too broad in our 

interpretation of the statute, we 

recognize commenters’ concerns and, as 

discussed above, have removed the 

program management costs from the fee 

we will charge for the data. As further 

addressed above, we have also 

identified several efficiencies in the 

creation of the data files which will 

further lower the cost of the data. 

However, we would like to reiterate that 

these estimates are based on a qualified 

entity program with 25 approved 

qualified entities. The cost of the data 

will increase if fewer organizations are 

approved as qualified entities and 

decrease if more organizations are 

approved as qualified entities because 

the fixed costs of providing the data 

would be spread across the total number 

of qualified entities. 

Comment: We received a handful of 

comments stating that the application 

process for qualified entities is too 

burdensome. 

Response: As discussed above, we 

believe ensuring that organizations 

approved as qualified entities are 

experienced in performance 

measurement and reporting and have 

the necessary plans to serve as a 

qualified entity is essential for the 

success of the qualified entity program. 

Thus, we do not believe the application 

is too burdensome. 

Comment: We received several 

comments on the impact on providers 

and suppliers. A number of commenters 

stated that the number of hours 

estimated for a provider or supplier to 

review performance reports or submit 

correction requests is too low. Many 

commenters also argued that the hourly 

wage rate for physicians’ offices is too 

low. Finally, a number of comments 

suggested that providers and suppliers 

might hire contractors to help with 

reviewing draft reports and requesting 

corrections. 

Response: While we understand that 

some providers and suppliers may 

spend many hours reviewing reports 

and submitting correction requests, we 

believe 5 hours reviewing reports is 

appropriate as an average. For example, 

some providers and suppliers will 

spend less than an hour reviewing their 

reports, but others may spend 10 hours. 

The same situation applies for error 

correction requests. Some providers and 

suppliers may only have concerns about 

one measure, and after seeing the data 

may realize that their concerns were 

unfounded. However, others may 

engage in a longer discourse with the 

qualified entity. On average, we believe 

that providers and suppliers will spend 

approximately 10 hours preparing and 

submitting error correction requests. We 

do recognize that some providers and 

suppliers may choose to hire contractors 

to assist in preparing and submitting a 

correction request and have added this 

to the impact on providers and 

suppliers discussed below. 

Additionally, while we understand 

physicians’ hourly wage exceeds $30.90, 

we believe physicians are not the only 

ones in their offices who will be 

reviewing the performance reports and 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76563 

submitting correction requests. Some of 

this work may be done by other 

physician office staff such as 

administrative staff, nurses, physician 

assistants, and case workers. Therefore, 

we believe our average hourly wage rate 

is appropriate to calculate the impact of 

this program on providers and 

suppliers. Changes described in our 

response are reflected in the remainder 

of the Regulatory Impact Analysis. 

B. Overall Impact 

We have examined the impacts of this 

rule as required by Executive Order 

12866 on Regulatory Planning and 

Review (September 30, 1993), Executive 

Order 13563 on Improving Regulation 

and Regulatory Review (January 18, 

2011), the Regulatory Flexibility Act 

(RFA) (September 19, 1980, Pub. L. 96– 

354), section 1102(b) of the Social 

Security Act, section 202 of the 

Unfunded Mandates Reform Act of 1995 

(March 22, 1995, Pub. L. 104–4), 

Executive Order 13132 on Federalism 

(August 4, 1999), and the Congressional 

Review Act (5 U.S.C. 804(2)). 

Executive Orders 12866 and 13563 

direct agencies to assess all costs and 

benefits of available regulatory 

alternatives and, if regulation is 

necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety 

effects, distributive impacts, and 

equity). Executive Order 13563 

emphasizes the importance of 

quantifying both cost and benefits, 

reducing costs, harmonizing rules, and 

promoting flexibility. A regulatory 

impact analysis (RIA) must be prepared 

for major rules with economically 

significant effects ($100 million or more 

in any 1 year). This final rule is not 

economically significant as measured by 

the $100 million threshold, and hence 

not a major rule under the 

Congressional Review Act. We estimate 

the total impact of this final rule to be 

approximately $86 million. We 

provided a detailed assessment of the 

impacts associated with this final rule, 

as noted below. 

The RFA requires agencies to analyze 

options for regulatory relief of small 

businesses, if a rule has a significant 

impact on a substantial number of small 

entities. We estimate that two types of 

entities may be affected by the program 

established by section 1874(e) of the 

Act: Organizations that desire to operate 

as qualified entities and the providers 

and suppliers who receive performance 

reports from qualified entities. We 

anticipate that most providers and 

suppliers receiving qualified entities’ 

performance reports would be hospitals 

and physicians. Many hospitals and 

most other health care providers and 

suppliers are small entities, either by 

being nonprofit organizations or by 

meeting the Small Business 

Administration definition of a small 

business (having revenues of less than 

$34.5 million in any 1 year) (for details, 

see the Small Business Administration’s 

Web site at http://sba.gov/idc/groups/ 

public/documents/sba_homepage/ 

serv_sstd_tablepdf.pdf (refer to the 

620000 series). For purposes of the RFA, 

physicians are considered small 

businesses if they generate revenues of 

$10 million or less based on Small 

Business Administration size standards. 

Approximately 95 percent of physicians 

are considered to be small entities. We 

estimate that most hospitals and most 

other providers are small entities as that 

term is used in the RFA (including 

small businesses, nonprofit 

organizations, and small governmental 

jurisdictions). However, because the 

total estimated impact would be spread 

over a number of providers and 

suppliers, no one entity would face a 

significant impact. Additionally, as 

CMS has reduced the cost of the data for 

qualified entities, we do not anticipate 

that this rule will have a significant 

impact on qualified entities. Therefore, 

the Secretary has determined this final 

rule would not have a significant impact 

on a substantial number of small 

entities. We have voluntarily provided 

an analysis of the estimated impacts on 

qualified entities and providers and 

suppliers below in section V.C., as well 

as alternatives considered in section 

V.D. 

In addition, section 1102(b) of the Act 

requires us to prepare a regulatory 

impact analysis, if a rule may have a 

significant impact on the operations of 

a substantial number of small rural 

hospitals. Any such regulatory impact 

analysis must conform to the provisions 

of section 604 of the RFA. For purposes 

of section 1102(b) of the Act, we define 

a small rural hospital as a hospital that 

is located outside of a metropolitan 

statistical area and has fewer than 100 

beds. We do not believe this final rule 

has impact on significant operations of 

a substantial number of small rural 

hospitals because we anticipate that 

most qualified entities would focus their 

performance evaluation efforts on 

metropolitan areas where the majority of 

health services are provided. Therefore, 

the Secretary has determined that this 

final rule would not have a significant 

impact on the operations of a substantial 

number of small rural hospitals. 

Section 202 of the Unfunded 

Mandates Reform Act of 1995 (UMRA) 

also requires that agencies assess 

anticipated costs and benefits before 

issuing any rule whose mandates 

require spending in any 1 year of $100 

million in 1995 dollars, updated 

annually for inflation. In 2011, that 

threshold is approximately $136 

million. This rule would not mandate 

any requirements for State, local, or 

tribal governments in the aggregate, or 

by the private sector, of $136 million. 

Specifically, as explained below we 

anticipate the total impact of this final 

rule on all parties to be approximately 

$86 million. 

Executive Order 13132 establishes 

certain requirements that an agency 

must meet when it promulgates a final 

rule that imposes substantial direct 

requirement costs on State and local 

governments, preempts State law, or 

otherwise has Federalism implications. 

We have examined this final rule in 

accordance with Executive Order 13132 

and have determined that this 

regulation would not have any 

substantial direct effect on State or local 

governments, preempt States, or 

otherwise have a Federalism 

implication. 

C. Anticipated Effects 

a. Impact on Qualified Entities 

Because section 1874(e) of the Act 

establishes a new program, there is little 

quantitative information available to 

inform our estimates. However, we 

believe that many or most qualified 

entities are likely to resemble 

community quality collaborative 

programs such as participants in the 

CMS Better Quality Information for 

Medicare Beneficiaries pilot (https:// 

www.cms.gov/BQI/) and the AHRQ 

Chartered Value Exchange (CVE) 

program (http://www.ahrq.gov/qual/ 

value/lncveover.htm). Community 

quality collaboratives are communitybased organizations of multiple 

stakeholders that work together to 

transform health care at the local level 

by promoting quality and efficiency of 

care, and by measuring and publishing 

quality information. Consequently, we 

have examined available information 

related to those programs to inform our 

assumptions, although there is only 

limited available data that is directly 

applicable to this analysis. 

We estimate that 35 organizations 

would submit applications to 

participate as qualified entities. We 

anticipate that the majority of applicants 

would be nonprofit organizations such 

as existing community collaboratives. In 

estimating qualified entity impacts, we 

used hourly labor costs in several labor 

categories reported by the Bureau of 

Labor Statistics (BLS) at http:// 


emcdonald on DSK5VPTVN1PROD with RULES2
76564 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

data.bls.gov/pdq/ 

querytool.jsp?survey=ce. We used the 

annual rates for 2010, an update from 

the proposed rule where we used rates 

from 2009, and added 33 percent for 

overhead and fringe benefit costs. These 

rates are displayed in Table 2. 

TABLE 2—LABOR RATES FOR QUALIFIED ENTITY IMPACT ESTIMATES

2010 hourly 

wage rate 

(BLS) 

OH and fringe 

(33%) 

Total hourly 

costs 

Professional & technical services ................................................................................................ $34.63 $11.43 $46.06 

Legal review ................................................................................................................................. 35.98 11.87 47.85 

Custom computer programming .................................................................................................. 40.50 13.37 53.87 

Data processing & hosting .......................................................................................................... 31.57 10.42 41.99 

Other information services ........................................................................................................... 33.55 11.07 44.62 

We estimate that preparation of an 

application would require a total of 500 

hours of effort, requiring a combination 

of staff in the professional and technical 

services and the legal labor categories. 

We estimate that 25 of these 

applicants would be approved as 

participating qualified entities, and that 

each qualified entity would request 

Medicare claims data accompanied by 

payment for these data. Because of the 

eligibility criteria we are proposing for 

qualified entities, we believe that it is 

likely that all of these organizations 

would already be performing work 

related to calculation of quality 

measures and production of 

performance reports for health care 

providers and suppliers, so the impact 

of the program established by section 

1874(e) of the Act would be an 

opportunity to add Medicare claims 

data to their existing function. 

The statute directs that the fees for 

these data be equal to the government’s 

cost to make the data available. We are 

proposing to initially provide ten 

quarters of data to qualified entities 

with quarterly updates thereafter. Based 

on CMS past experience providing 

Medicare data to research entities, we 

estimate that the total approximate costs 

to provide ten quarters (CY 2009, CY 

2010, and Q1–Q2 CY2011) of data for 

2.5 million beneficiaries to a qualified 

entity would be $24,000. Qualified 

entities would also get 2 quarterly 

updates, each for a fee of $8,000, during 

the year, bringing the total cost of data 

for the first year of the program to 

$40,000 as shown in Table 3. 

We estimate that, on average, each 

qualified entity’s activity to analyze the 

Medicare claims data, calculate 

performance measures and produce 

provider and supplier performance 

reports would require 5,500 hours of 

effort. We estimate that half of the 

qualified entities (13) would propose 

alternative performance measures, 

which would involve an additional 

2,100 hours of effort for each entity. 

We further estimate that, on average, 

each qualified entity would expend 

5,000 hours of effort processing 

providers’ and suppliers’ appeals of 

their performance reports and 

producing revised reports, and 2,000 

hours making information about the 

performance measures publicly 

available. These estimates assume that, 

as discussed below in the section on 

provider and supplier impacts, on 

average 25 percent of providers and 

suppliers would appeal their results 

from a qualified entity. These 

assumptions are based on a belief that 

in the first year of the program many 

providers or suppliers would want to 

appeal their results prior to performance 

reports being made available to the 

public. Responding to these appeals in 

an appropriate manner would require a 

significant investment of time on the 

part of qualified entities. This equates to 

an average of four hours per appeal for 

each qualified entity. We assume that 

the complexity of appeals would vary 

greatly, and as such, the time required 

to address them would also vary greatly. 

Many appeals may be able to be dealt 

with in an hour or less while some 

appeals may require multiple meetings 

between the qualified entity and the 

affected provider or supplier. On 

average however, we believe that this is 

a realistic and reasonable estimate of the 

burden of the appeals process on 

qualified entities. We discuss the 

burden of the appeals process on 

providers and suppliers below. 

We anticipate that qualified entities 

would expend 2,000 hours of effort 

developing their proposed performance 

report. These estimated hours are 

separated into labor categories in Table 

3 below, with the pertinent hourly labor 

rates and cost totals. 

Finally, we estimate that each 

qualified entity would spend 255 hours 

of effort submitting information to CMS 

for monitoring purposes. This would 

include audits and site visits as 

discussed above. It would also include 

an annual report that contains measures 

of general program adherence, measures 

of the provider and suppliers data 

sharing, error correction, and appeals 

process, and measures of the success of 

the program with consumers. Finally, 

qualified entities would be required to 

notify CMS of inappropriate disclosures 

or use of beneficiary identifiable data 

pursuant to the requirements in the 

DUA. We believe that many of the 

required data elements in both the 

annual report and the report generated 

in response to an inappropriate 

disclosure or use of beneficiary 

identifiable data would be generated as 

a matter of course by the qualified 

entities and therefore, would not require 

significant additional effort. Based on 

the assumptions we have described, we 

estimate the total impact on qualified 

entities for the first year of the program 

to be a cost of $45,504,048. 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76565 

TABLE 3—IMPACT ON QUALIFIED ENTITIES FOR THE FIRST YEAR OF THE PROGRAM

[Impact on qualified entities] 

Activity 

Hours 

Labor hourly 

cost 

Cost 

per applicant 

Number of 

applicants 

Total cost 

Professional impact 

and technical Legal Computer programming 

Data 

processing 

and hosting 

APPLICATION COSTS 

Preparation of application 

by candidate qualified 

entities 

a. Prepare draft application 360 ........................ ........................ ........................ $46.06 $16,582 ........................ ........................

b. Legal review .................. ........................ 40 ........................ ........................ 47.85 1,914 ........................ ........................

c. Revisions to draft application ............................. 60 ........................ ........................ ........................ 46.06 2,764 ........................ ........................

d. Senior management review and signature ........ 40 ........................ ........................ ........................ 46.06 1,842 ........................ ........................

Total: application preparation ................................. 460 40 ........................ ........................ ........................ 23,102 35 $808,556 

Medicare data purchase 

costs by approved qualified entities .................... ........................ ........................ ........................ ........................ ........................ 40,000 25 1,000,000 

Total: Applications ...... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 1,808,556 

QE OPERATIONS COSTS 

Database administration ... ........................ ........................ ........................ 500 41.99 20,995 25 524,875 

Data analysis/measure calculation/report preparation ................................. ........................ ........................ 2500 ........................

2500 

53.87 

41.99 

134,675 

104,975 

25 

25 

3,366,875 

2,624,375 

Development and submission of alternative measures ................................ 1000 ........................ ........................

100 

........................

1000 

46.06 

53.87 

41.99 

46,060 

5,387 

41,990 

13 

13 

13 

598,780 

70,031 

545,870 

Qualified entity processing 

of provider or supplier 

appeals and report revision ................................ 4000 ........................

1000 

........................ ........................ 46.06 

47.85 

184,240 

47,850 

25 

25 

4,606,000 

1,196,250 

Development of proposed 

performance report formats ............................... 1000 ........................ ........................

1000 

........................ 46.06 

53.87 

46,060 

53,870 

25 

25 

1,151,500 

1,346,750 

Publication of performance 

reports ............................ ........................ ........................ 1000 ........................

1000 

53.87 

41.99 

53,870 

41,990 

25 

25 

1,346,750 

1,049,750 

Monitoring .......................... ........................ ........................ ........................ 255 41.99 10,707 25 267,686 

Computer hardware and 

processing ..................... ........................ ........................ ........................ ........................ ........................ 1,000,000 25 25,000,000 

Total: Operations ....... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 43,695,492 

TOTAL QUALIFIED ENTITY 

IMPACTS (application plus 

operations) ...... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 45,504,048 

b. Impact on Health Care Providers and 

Suppliers 

Table 4 reflects the hourly labor rates 

used in our estimate of the impacts of 

the first year of section 1874(e) of the 

Act on health care providers and 

suppliers, as well as the professional 

and technical services of consultants. 

The rates in Table 4 are for 2010 and 

have been updated from the proposed 

rule where we used rates for 2009. We 

note that numerous health care payers, 

community quality collaboratives, 

States, and other organizations are 

producing performance measures for 

health care providers and suppliers 

using data from other sources, and that 

providers and suppliers are already 

receiving performance reports from 

these sources. We anticipate that the 

Medicare claims data would merely be 

added to those existing efforts to 

improve the statistical validity of the 

measure findings, and therefore the 

impact of including Medicare claims 

data in these existing performance 

reporting processes is likely to be 

marginal. Additionally, while we 

acknowledge that reviewing and 

appealing the reports will be a burden 

for providers and suppliers, we also 

note that there are many benefits of this 

program for providers and suppliers, as 

well as the Medicare program, 

consumers, and purchasers. As a result 

of this program, providers and suppliers 

will likely receive one report covering a 

majority of their patients, rather than a 

report from each payer. Furthermore, 

the transparency of performance results 

will help providers and suppliers 

improve quality and reduce costs. 


emcdonald on DSK5VPTVN1PROD with RULES2
76566 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

TABLE 4—LABOR RATES FOR PROVIDER AND SUPPLIER IMPACT ESTIMATES

2010 hourly 

wage rate 

(BLS) 

Overhead and 

fringe benefits 

(33%) 

Total hourly 

costs 

Labor Rates for Provider and Supplier Impact Estimates 

Physicians’ offices ..................................................................................................... $32.24 $10.64 $42.88 

Hospitals .................................................................................................................... 27.42 9.05 36.47 

Professional and technical services .......................................................................... 34.63 11.43 46.06 

We anticipate that the impacts on 

providers and suppliers consist of costs 

to review the performance reports 

generated by qualified entities and, if 

they choose, appeal their performance 

calculations. Based on a review of 

available information from the Better 

Quality Information and the Charter 

Value Exchange programs, we estimate 

that, on average, each qualified entity 

would distribute performance reports to 

5,000 health providers and suppliers. 

We anticipate that the largest proportion 

of providers and suppliers would be 

physicians because they comprise the 

largest group of providers and suppliers, 

and are a primary focus of many recent 

performance evaluation efforts. Based 

on our review of information from these 

existing programs, we assume that 95 

percent of the recipients of performance 

reports (that is, an average of 4,750 per 

qualified entity) would be physicians, 

and 5 percent (that is, an average of 250 

per qualified entity) would be hospitals 

and other suppliers. Providers and 

suppliers receive these reports with no 

obligation to review them, but we 

assume that most would do so to verify 

that their calculated performance 

measures reflect their actual patients 

and health events. We estimate that, on 

average, each provider or supplier 

would devote five hours to reviewing 

these reports. This average reflects that 

some providers and suppliers will 

spend less than half an hour reviewing 

reports, while others may spend 10 

hours. 

We estimate that 25 percent of the 

providers and suppliers would decide to 

appeal their performance calculations, 

and that preparing the appeal would 

involve an average of ten hours of effort 

on the part of a provider or supplier. We 

assume that 50 percent of the providers 

and suppliers who decide to appeal 

would hire consultants to assist with the 

appeals process. As with our 

assumptions regarding the level of effort 

required by qualified entities in 

operating the appeals process, we 

believe that this average covers a range 

of provider and supplier efforts from 

those who would need just one or two 

hours to clarify any questions or 

concerns regarding their performance 

reports to those who would devote 

significant time and resources to the 

appeals process. 

Using the hourly costs displayed in 

Table 4, the impacts on providers and 

suppliers are calculated below in Table 

5. Based on the assumptions we have 

described, we estimate the total impact 

on providers and suppliers for the first 

year of the program to be a cost of 

$40,458,400. 

As stated above in Table 3, we 

estimate the total impact on qualified 

entities to be a cost of $45,504,048. 

Therefore, the total impact on qualified 

entities and on providers and suppliers 

for the first year of the program is 

estimated to be $85,962,448. 

TABLE 5—IMPACT ON PROVIDERS AND SUPPLIERS FOR THE FIRST YEAR OF THE PROGRAM

Activity 

Hours per provider 

Labor hourly 

cost 

Cost per 

applicant 

Number of 

providers 

per qualified 

entity 

Number of 

qualified 

entities 

Total cost 

Physician impact 

offices Hospitals 

Professional 

and 

technical 

Impact on Providers and Suppliers 

Provider review of performance reports .......... 5 .................... .................... $42.88 $214 4,750 25 $25,460,000 

.................... 5 .................... 36.47 182 250 25 1,139,688 

Preparing and submitting 

appeal request to qualified entities ................... 10 .................... .................... 42.88 429 594 25 6,367,680 

.................... 10 .................... 36.47 365 31 25 282,643 

.................... .................... 10 46.06 461 626 25 7,208,390 

Total provider impacts ...................... .................... .................... .................... .................... .................... .................... .................... 40,458,400 

D. Alternatives Considered 

The statutory provisions that were 

added by section 1874(e) of the Act are 

detailed and prescriptive about the 

eligibility for, and requirements of the 

qualified entity program. Consequently, 

we believe there are limited alternative 

approaches that would ensure program 

success and statutory compliance. We 

considered proposing a less 

comprehensive set of eligibility criteria 

for qualified entities (for example, 

eliminating requirements that 

applicants demonstrate capabilities 

related to calculation of measures, 

developing performance reports, 

combining Medicare claims data with 

other claims, and data privacy and 

security protection). While such an 

approach might have reduced certain 

application and operating costs for these 

entities, we did not adopt such an 

approach for several reasons. An 

important consideration is the 

protection of beneficiary identifiable 

data. We believe if we do not require 

qualified entities to provide sufficient 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76567 

evidence of data privacy and security 

protection capabilities, there would be 

increased risks related to the protection 

of beneficiary identifiable data. 

Additionally, we believe that 

requiring less stringent requirements 

regarding the production and reporting 

of measures would lead to increases in 

the number of provider and supplier 

appeals, and consequently in appealsrelated costs for providers, suppliers 

and qualified entities. We expect that 

such a scenario would not support the 

development of a cooperative 

relationship between qualified entities 

and providers and suppliers. 

E. Conclusion 

As explained above, we estimate the 

total impact for the first year of the 

program on qualified entities, providers 

and suppliers to be a cost of 

$85,962,448. Based on these estimates, 

we conclude this final rule does not 

reach the threshold for economically 

significant effects and thus is not 

considered a major rule. 

In accordance with the provisions of 

Executive Order 12866, this regulation 

was reviewed by the Office of 

Management and Budget. 

List of Subjects in 42 CFR Part 401 

Claims, Freedom of information, 

Health facilities, Medicare, Privacy. 

For the reasons set forth in the 

preamble, the Centers for Medicare & 

Medicaid Services amends 42 CFR 

chapter IV as set forth below: 

PART 401—GENERAL 

ADMINISTRATIVE REQUIREMENTS 

■ 1. The authority citation for part 401 

is revised to read as follows: 

Authority: Secs. 1102, 1871, and 1874(e) of 

the Social Security Act (42 U.S.C. 1302, 

1395hh, and 1395w–5). 

■ 2. A new subpart G is added to part 

401 to read as follows: 

Subpart G—Availability of Medicare Data for 

Performance Measurement 

Sec. 

401.701 Purpose and scope. 

401.703 Definitions. 

401.705 Eligibility criteria for qualified 

entities. 

401.707 Operating and governance 

requirements for qualified entities. 

401.709 The application process and 

requirements. 

401.711 Updates to plans submitted as part 

of the application process. 

401.713 Ensuring the privacy and security 

of data. 

401.715 Selection and use of performance 

measures. 

401.717 Provider and supplier requests for 

error correction. 

401.719 Monitoring and sanctioning of 

qualified entities. 

401.721 Terminating an agreement with a 

qualified entity. 

Subpart G—Availability of Medicare 

Data for Performance Measurement 

§ 401.701 Purpose and scope. 

The regulations in this subpart 

implement section 1874(e) of the Social 

Security Act as it applies to Medicare 

data made available to qualified entities 

for the evaluation of the performance of 

providers and suppliers. 

§ 401.703 Definitions. 

For purposes of this subpart: 

(a) Qualified entity means either a 

single public or private entity, or a lead 

entity and its contractors, that meets the 

following requirements: 

(1) Is qualified, as determined by the 

Secretary, to use claims data to evaluate 

the performance of providers and 

suppliers on measures of quality, 

efficiency, effectiveness, and resource 

use. 

(2) Agrees to meet the requirements 

described in this subpart at §§ 401.705 

through 401.721. 

(b) Provider of services (referred to as 

a provider) has the same meaning as the 

term ‘‘provider’’ in § 400.202 of this 

chapter. 

(c) Supplier has the same meaning as 

the term ‘‘supplier’’ at § 400.202 of this 

chapter. 

(d) Claim means an itemized billing 

statement from a provider or supplier 

that, except in the context of Part D 

prescription drug event data, requests 

payment for a list of services and 

supplies that were furnished to a 

Medicare beneficiary in the Medicare 

fee-for-service context, or to a 

participant in other insurance or 

entitlement program contexts. In the 

Medicare program, claims files are 

available for each institutional 

(inpatient, outpatient, skilled nursing 

facility, hospice, or home health agency) 

and non-institutional (physician and 

durable medical equipment providers 

and suppliers) claim type as well as 

Medicare Part D Prescription Drug Event 

(PDE) data. 

(e) Standardized data extract is a 

subset of Medicare claims data that the 

Secretary would make available to 

qualified entities under this subpart. 

(f) Beneficiary identifiable data is any 

data that contains the beneficiary’s 

name, Medicare Health Insurance Claim 

Number (HICN), or any other direct 

identifying factors, including, but not 

limited to postal address or telephone 

number. 

(g) Encrypted data is any data that 

does not contain the beneficiary’s name 

or any other direct identifying factors, 

but does include a unique CMSassigned beneficiary identifier that 

allows for the linking of claims without 

divulging any direct identifier of the 

beneficiary. 

(h) Claims data from other sources 

means provider- or supplier-identifiable 

claims data that an applicant or 

qualified entity has full data usage right 

to due to its own operations or 

disclosures from providers, suppliers, 

private payers, multi-payer databases, or 

other sources. 

(i) Clinical data is registry data, chartabstracted data, laboratory results, 

electronic health record information, or 

other information relating to the care or 

services furnished to patients that is not 

included in administrative claims data, 

but is available in electronic form. 

§ 401.705 Eligibility criteria for qualified 

entities. 

(a) Eligibility criteria: To be eligible to 

apply to receive data as a qualified 

entity under this subpart, an applicant 

generally must demonstrate expertise 

and sustained experience, defined as 3 

or more years, in the following three 

areas, as applicable and appropriate to 

the proposed use: 

(1) Organizational and governance 

criteria, including: 

(i) Expertise in the areas of 

measurement that they propose to use in 

accurately calculating quality, and 

efficiency, effectiveness, or resource use 

measures from claims data, including 

the following: 

(A) Identifying an appropriate method 

to attribute a particular patient’s 

services to specific providers and 

suppliers. 

(B) Ensuring the use of approaches to 

ensure statistical validity such as a 

minimum number of observations or 

minimum denominator for each 

measure. 

(C) Using methods for risk-adjustment 

to account for variations in both casemix and severity among providers and 

suppliers. 

(D) Identifying methods for handling 

outliers. 

(E) Correcting measurement errors 

and assessing measure reliability. 

(F) Identifying appropriate peer 

groups of providers and suppliers for 

meaningful comparisons. 

(ii) A plan for a business model that 

is projected to cover the costs of 

performing the required functions, 

including the fee for the data. 

(iii) Successfully combining claims 

data from different payers to calculate 

performance reports. 

(iv) Designing, and continuously 

improving the format of performance 

reports on providers and suppliers. 


emcdonald on DSK5VPTVN1PROD with RULES2
76568 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

(v) Preparing an understandable 

description of the measures used to 

evaluate the performance of providers 

and suppliers so that consumers, 

providers and suppliers, health plans, 

researchers, and other stakeholders can 

assess performance reports. 

(vi) Implementing and maintaining a 

process for providers and suppliers 

identified in a report to review the 

report prior to publication and 

providing a timely response to provider 

and supplier inquiries regarding 

requests for data, error correction, and 

appeals. 

(vii) Establishing, maintaining, and 

monitoring a rigorous data privacy and 

security program, including disclosing 

to CMS any inappropriate disclosures of 

beneficiary identifiable information, 

violations of applicable federal and 

State privacy and security laws and 

regulations for the preceding 10-year 

period (or, if the applicant has not been 

in existence for 10 years, the length of 

time the applicant has been an 

organization), and any corrective actions 

taken to address the issues. 

(viii) Accurately preparing 

performance reports on providers and 

suppliers and making performance 

report information available to the 

public in aggregate form, that is, at the 

provider or supplier level. 

(2) Expertise in combining Medicare 

claims data with claims data from other 

sources, including demonstrating to the 

Secretary’s satisfaction that the claims 

data from other sources that it intends 

to combine with the Medicare data 

received under this subpart address the 

methodological concerns regarding 

sample size and reliability that have 

been expressed by stakeholders 

regarding the calculation of performance 

measures from a single payer source. 

(3) Expertise in establishing, 

documenting and implementing 

rigorous data privacy and security 

policies including enforcement 

mechanisms. 

(b) Source of expertise and 

experience: An applicant may 

demonstrate expertise and experience in 

any or all of the areas described in 

paragraph (a) of this section through one 

of the following: 

(1) Activities it has conducted directly 

through its own staff. 

(2) Contracts with other entities if the 

applicant is the lead entity and includes 

documentation in its application of the 

contractual arrangements that exist 

between it and any other entity whose 

expertise and experience is relied upon 

in submitting the application. 

§ 401.707 Operating and governance 

requirements for qualified entities. 

A qualified entity must meet the 

following operating and governance 

requirements: 

(a) Submit to CMS a list of all 

measures it intends to calculate and 

report, the geographic areas it intends to 

serve, and the methods of creating and 

disseminating reports. This list must 

include the following information, as 

applicable and appropriate to the 

proposed use: 

(1) Name of the measure, and whether 

it is a standard or alternative measure. 

(2) Name of the measure developer/ 

owner. 

(3) If it is an alternative measure, 

measure specifications, including 

numerator and denominator. 

(4) The rationale for selecting each 

measure, including the relationship to 

existing measurement efforts and the 

relevancy to the population in the 

geographic area(s) the entity would 

serve, including the following: 

(i) A specific description of the 

geographic area or areas it intends to 

serve. 

(ii) A specific description of how each 

measure evaluates providers and 

suppliers on quality, efficiency, 

effectiveness, and/or resource use. 

(5) A description of the methodologies 

it intends to use in creating reports with 

respect to all of the following topics: 

(i) Attribution of beneficiaries to 

providers and/or suppliers. 

(ii) Benchmarking performance data, 

including the following: 

(A) Methods for creating peer groups. 

(B) Justification of any minimum 

sample size determinations made. 

(C) Methods for handling statistical 

outliers. 

(iii) Risk adjustment, where 

appropriate. 

(iv) Payment standardization, where 

appropriate. 

(b) Submit to CMS a description of the 

process it would establish to allow 

providers and suppliers to view reports 

confidentially, request data, and ask for 

the correction of errors before the 

reports are made public. 

(c) Submit to CMS a prototype report 

and a description of its plans for making 

the reports available to the public. 

(d) Submit to CMS information about 

the claims data it possesses from other 

sources, as defined at § 401.703(h), and 

documentation of adequate rights to use 

the other claims data for the purposes of 

this subpart. 

(e) If requesting a 5 percent national 

sample to calculate benchmarks for the 

specific measures it is using, submit to 

CMS a justification for needing the file 

to calculate benchmarks. 

§ 401.709 The application process and 

requirements. 

(a) Application deadline. CMS accepts 

qualified entity applications on a rolling 

basis after an application is made 

available on the CMS Web site. CMS 

reviews applications in the order in 

which they are received. 

(b) Selection criteria. To be approved 

as a qualified entity under this subpart, 

the applicant must meet one of the 

following: 

(1) Standard approval process: Meet 

the eligibility and operational and 

governance requirements, fulfill all of 

the application requirements to CMS’ 

satisfaction, and agree to pay a fee equal 

to the cost of CMS making the data 

available. The applicant and each of its 

contractors that are anticipated to have 

access to the Medicare data must also 

execute a Data Use Agreement with 

CMS, that among other things, reaffirms 

the statutory ban on the use of Medicare 

data provided to the qualified entity by 

CMS under this subpart for purposes 

other than those referenced in this 

subpart. 

(2) Conditional approval process: 

Meet the eligibility and operational and 

governance requirements, and fulfill all 

of the application requirements to CMS’ 

satisfaction, with the exception of 

possession of sufficient claims data from 

other sources. Meeting these 

requirements will result in a conditional 

approval as a qualified entity. Entities 

gaining a conditional approval as a 

qualified entity must meet the eligibility 

requirements related to claims data from 

other sources the entity intends to 

combine with the Medicare data, agree 

to pay a fee equal to the cost of CMS 

making the data available, and execute 

a Data Use Agreement with CMS, that 

among other things, reaffirms the 

statutory ban on the use of Medicare 

data provided to the qualified entity by 

CMS under this subpart for purposes 

other than those referenced in this 

subpart before receiving any Medicare 

data. If the qualified entity is composed 

of lead entity with contractors, any 

contractors that are anticipated to have 

access to the Medicare data must also 

execute a Data Use Agreement with 

CMS. 

(c) Duration of approval. CMS permits 

an entity to participate as a qualified 

entity for a period of 3 years from the 

date of notification of the application 

approval by CMS. The qualified entity 

must abide by all CMS regulations and 

instructions. If the qualified entity 

wishes to continue performing the tasks 

after the 3-year approval period, the 

entity may re-apply for qualified entity 

status following the procedures in 

paragraph (f) of this section. 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76569 

(d) Reporting period. A qualified 

entity must produce reports on the 

performance of providers and suppliers 

at least annually, beginning in the 

calendar year after they are approved by 

CMS. 

(e) The distribution of data.—(1) 

Initial data release. Once CMS fully 

approves a qualified entity under this 

subpart, the qualified entity must pay a 

fee equal to the cost of CMS making data 

available. After the qualified entity pays 

the fee, CMS will release the applicable 

encrypted claims data, as well as a file 

that crosswalks the encrypted 

beneficiary ID to the beneficiary name 

and the Medicare HICN. The data will 

be the most recent data available, and 

will be limited to the geographic spread 

of the qualified entity’s other claims 

data, as determined by CMS. 

(2) Subsequent data releases. After 

the first quarter of participation, CMS 

will provide a qualified entity with the 

most recent additional quarter of 

currently available data, as well as a 

table that crosswalks the encrypted 

beneficiary ID to the beneficiary’s name 

and the Medicare HICN. Qualified 

entities are required to pay CMS a fee 

equal to the cost of making data 

available before CMS will release the 

most recent quarter of additional data to 

the qualified entity. 

(f) Re-application. A qualified entity 

that is in good standing may re-apply for 

qualified entity status. A qualified entity 

is considered to be in good standing if 

it has had no violations of the 

requirements in this subpart or if the 

qualified entity is addressing any past 

deficiencies either on its own or through 

the implementation of a corrective 

action plan. To re-apply a qualified 

entity must submit to CMS 

documentation of any changes to what 

was included in its previously-approved 

application. A re-applicant must submit 

this documentation at least 6 months 

before the end of its 3-year approval 

period and will be able to continue to 

serve as a qualified entity until the reapplication is either approved or denied 

by CMS. If the re-application is denied, 

CMS will terminate its relationship with 

the qualified entity and the qualified 

entity will be subject to the 

requirements for return or destruction of 

data at § 401.721(b). 

§ 401.711 Updates to plans submitted as 

part of the application process. 

(a) If a qualified entity wishes to make 

changes to the following parts of its 

previously-approved application: 

(1) Its list of proposed measures—the 

qualified entity must send all the 

information referenced in § 401.707(a) 

for the new measures to CMS at least 30 

days before its intended confidential 

release to providers and suppliers. 

(2) Its proposed prototype report—the 

qualified entity must send the new 

prototype report to CMS at least 30 days 

before its intended confidential release 

to providers and suppliers. 

(3) Its plans for sharing the reports 

with the public—the qualified entity 

must send the new plans to CMS at least 

30 days before its intended confidential 

release to providers and suppliers. 

(b) CMS will notify the qualified 

entity when the entity’s proposed 

changes are approved or denied for use, 

generally within 30 days of the qualified 

entity submitting the changes to CMS. If 

a CMS decision on approval or 

disapproval for a change is not 

forthcoming within 30 days and CMS 

does not request an additional 30 days 

for review, the change or modification 

shall be deemed to be approved. 

(c) If the amount of claims data from 

other sources available to a qualified 

entity decreases, the qualified entity 

must immediately inform CMS and 

submit documentation that the 

remaining claims data from other 

sources is sufficient to address the 

methodological concerns regarding 

sample size and reliability. Under no 

circumstances may a qualified entity 

use Medicare data to create a report, use 

a measure, or share a report after the 

amount of claims data from other 

sources available to a qualified entity 

decreases until CMS determines either 

that the remaining claims data is 

sufficient or that the qualified entity has 

collected adequate additional data to 

address any deficiencies. 

(1) If the qualified entity cannot 

submit the documentation required in 

paragraph (c) of this section, or if CMS 

determines that the remaining claims 

data is not sufficient, CMS will afford 

the qualified entity up to 120 days to 

obtain additional claims to address any 

deficiencies. If the qualified entity does 

not have access to sufficient new data 

after that time, CMS will terminate its 

relationship with the qualified entity. 

(2) If CMS determines that the 

remaining claims data is sufficient, the 

qualified entity may continue issuing 

reports, using measures, and sharing 

reports. 

§ 401.713 Ensuring the privacy and 

security of data. 

(a) A qualified entity must comply 

with the data requirements in its data 

use agreement (DUA) with CMS. 

Contractors of qualified entities that are 

anticipated to have access to the 

Medicare claims data or beneficiary 

identifiable data in the context of this 

program are also required to execute 

and comply with the DUA. The DUA 

will require the qualified entity to 

maintain privacy and security protocols 

throughout the duration of the 

agreement with CMS and will ban the 

use of data for purposes other than those 

set out in this subpart. The DUA will 

also prohibit the use of unsecured 

telecommunications to transmit CMS 

data and will specify the circumstances 

under which CMS data must be stored 

and transmitted. 

(b) A qualified entity must inform 

each beneficiary whose beneficiary 

identifiable data has been (or is 

reasonably believed to have been) 

inappropriately accessed, acquired, or 

disclosed in accordance with the DUA. 

(c) Contractor(s) must report to the 

qualified entity whenever there is an 

incident where beneficiary identifiable 

data has been (or is reasonably believed 

to have been) inappropriately accessed, 

acquired, or disclosed. 

§ 401.715 Selection and use of 

performance measures. 

(a) Standard measures. A standard 

measure is a measure that can be 

calculated in full or in part from claims 

data from other sources and the 

standardized extracts of Medicare Parts 

A and B claims, and Part D prescription 

drug event data and meets the following 

requirements: 

(1) Meets one of the following criteria: 

(i) Is endorsed by the entity with a 

contract under section 1890(a) of the 

Social Security Act. 

(ii) Is time-limited endorsed by the 

entity with a contract under section 

1890(a) of the Social Security Act until 

such time as the full endorsement status 

is determined. 

(iii) Is developed under section 931 of 

the Public Health Service Act. 

(iv) Can be calculated from 

standardized extracts of Medicare Parts 

A or B claims or Part D prescription 

drug event data, was adopted through 

notice-and-comment rulemaking, and is 

currently being used in CMS programs 

that include quality measurement. 

(v) Is endorsed by a CMS-approved 

consensus-based entity. CMS will 

approve organizations as consensusbased entities based on review of 

documentation of the consensus-based 

entity’s measure approval process. To 

receive approval as a consensus-based 

entity, an organization must submit 

information to CMS documenting its 

processes for stakeholder consultation 

and measures approval; an organization 

will only receive approval as a 

consensus-based entity if all measure 

specifications are publically available. 

An organization will retain CMS 

acceptance as a consensus-based entity 


emcdonald on DSK5VPTVN1PROD with RULES2
76570 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 

for 3 years after the approval date, at 

which time CMS will review new 

documentation of the consensus-based 

entity’s measure approval process for a 

new 3-year approval. 

(2) Is used in a manner that follows 

the measure specifications as written (or 

as adopted through notice-and-comment 

rulemaking), including all numerator 

and denominator inclusions and 

exclusions, measured time periods, and 

specified data sources. 

(b) Alternative measure. (1) An 

alternative measure is a measure that is 

not a standard measure, but that can be 

calculated in full, or in part, from claims 

data from other sources and the 

standardized extracts of Medicare Parts 

A and B claims, and Part D prescription 

drug event data, and that meets one of 

the following criteria: 

(i) Rulemaking process: Has been 

found by the Secretary, through a 

notice-and comment-rulemaking 

process, to be more valid, reliable, 

responsive to consumer preferences, 

cost-effective, or relevant to dimensions 

of quality and resource use not 

addressed by standard measures, and is 

used by a qualified entity in a manner 

that follows the measure specifications 

as adopted through notice-and-comment 

rulemaking, including all numerator 

and denominator inclusions and 

exclusions, measured time periods, and 

specified data sources. 

(ii) Stakeholder consultation approval 

process: Has been found by the 

Secretary, using documentation 

submitted by a qualified entity that 

outlines its consultation and agreement 

with stakeholders in its community, to 

be more valid, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by standard measures, 

and is used by a qualified entity in a 

manner that follows the measure 

specifications as submitted, including 

all numerator and denominator 

inclusions and exclusions, measured 

time periods, and specified data 

sources. If a CMS decision on approval 

or disapproval of alternative measures 

submitted using the stakeholder 

consultation approval process is not 

forthcoming within 60 days of 

submission of the measure by the 

qualified entity, the measure will be 

deemed approved. However, CMS 

retains the right to disapprove a 

measure if, even after 60 days, we find 

it to not be ‘‘more valid, reliable, 

responsive to consumer preferences, 

cost-effective, or relevant to dimensions 

of quality and resource’’ than a standard 

measure. 

(2) An alternative measure approved 

under the process at paragraph (b)(1)(i) 

of this section may be used by any 

qualified entity. An alternative measure 

approved under the process at 

paragraph (b)(1)(ii) of this section may 

only be used by the qualified entity that 

submitted the measure for consideration 

by the Secretary. A qualified entity may 

use an alternative measure up until the 

point that an equivalent standard 

measure for the particular clinical area 

or condition becomes available at which 

point the qualified entity must switch to 

the standard measure within 6 months 

or submit additional scientific 

justification and receive approval, via 

either paragraphs (b)(1)(i) or (b)(1)(ii) of 

this section, from the Secretary to 

continue using the alternative measure. 

(3) To submit an alternative measure 

for consideration under the notice-andcomment-rulemaking process, for use in 

the calendar year following the 

submission, an entity must submit the 

following information by May 31st: 

(i) The name of the alternative 

measure. 

(ii) The name of the developer or 

owner of the alternative measure. 

(iii) Detailed specifications for the 

alternative measure. 

(iv) Evidence that use of the 

alternative measure would be more 

valid, reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by standard measures. 

(4) To submit an alternative measure 

for consideration under the 

documentation of stakeholder 

consultation approval process described 

in paragraph (b)(1)(ii) of this section, for 

use once the measure is approved by the 

Secretary, an entity must submit the 

following information to CMS: 

(i) The name of the alternative 

measure. 

(ii) The name of the developer or 

owner of the alternative measure. 

(iii) Detailed specifications for the 

alternative measure. 

(iv) A description of the process by 

which the qualified entity notified 

stakeholders in the geographic region it 

serves of its intent to seek approval of 

an alternative measure. Stakeholders 

must include a valid cross 

representation of providers, suppliers, 

payers, employers, and consumers. 

(v) A list of stakeholders from whom 

feedback was solicited, including the 

stakeholders’ names and roles in the 

community. 

(vi) A description of the discussion 

about the proposed alternative measure, 

including a summary of all pertinent 

arguments supporting and opposing the 

measure. 

(vii) Unless CMS has already 

approved the same measure for use by 

another qualified entity, no new 

scientific evidence on the measure is 

available, and the subsequent qualified 

entity wishes to rely upon the scientific 

evidence submitted by the previously 

approved applicant, an explanation 

backed by scientific evidence that 

demonstrates why the measure is more 

valid, reliable, responsive to consumer 

preferences, cost-effective, or relevant to 

dimensions of quality and resource use 

not addressed by a standard measure. 

§ 401.717 Provider and supplier requests 

for error correction. 

(a) A qualified entity must 

confidentially share measures, 

measurement methodologies, and 

measure results with providers and 

suppliers at least 60 calendar days 

before making reports public. The 60 

calendar days begin on the date on 

which qualified entities send the 

confidential reports to providers and 

suppliers. A qualified entity must 

inform providers and suppliers of the 

date the reports will be made public at 

least 60 calendar days before making the 

reports public. 

(b) Before making the reports public, 

a qualified entity must allow providers 

and suppliers the opportunity to make 

a request for the data, or to make a 

request for error correction, within 60 

calendar days after sending the 

confidential reports to providers or 

suppliers. 

(c) During the 60 calendar days 

between sending a confidential report 

on measure results and releasing the 

report to the public, the qualified entity 

must, at the request of a provider or 

supplier and with appropriate privacy 

and security protections, release the 

Medicare claims data and beneficiary 

names to the provider or supplier. 

Qualified entities may only provide the 

Medicare claims and/or beneficiary 

names relevant to the particular 

measure or measure result the provider 

or supplier is appealing. 

(d) A qualified entity must inform 

providers and suppliers that reports will 

be made public, including information 

related to the status of any data or error 

correction requests, after the date 

specified to the provider or supplier 

when the report is sent for review and, 

if necessary, error correction requests (at 

least 60 calendar days after the report 

was originally sent to the providers and 

suppliers), regardless of the status of 

any requests for error correction. 

(e) If a provider or supplier has a data 

or error correction request outstanding 

at the time the reports become public, 

the qualified entity must, if feasible, 

post publicly the name of the appealing 


emcdonald on DSK5VPTVN1PROD with RULES2
Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76571 

provider or supplier and the category of 

the appeal request. 

§ 401.719 Monitoring and sanctioning of 

qualified entities. 

(a) CMS will monitor and assess the 

performance of qualified entities and 

their contractors using the following 

methods: 

(1) Audits. 

(2) Submission of documentation of 

data sources and quantities of data upon 

the request of CMS and/or site visits. 

(3) Analysis of specific data reported 

to CMS by qualified entities through 

annual reports (as described in 

paragraph (b) of this section) and reports 

on inappropriate disclosures or uses of 

beneficiary identifiable data (as 

described in paragraph (c) of this 

section). 

(4) Analysis of complaints from 

beneficiaries and/or providers or 

suppliers. 

(b) A qualified entity must provide 

annual reports to CMS containing 

information related to the following: 

(1) General program adherence, 

including the following information: 

(i) The number of Medicare and 

private claims combined. 

(ii) The percent of the overall market 

share the number of claims represent in 

the qualified entity’s geographic area. 

(iii) The number of measures 

calculated. 

(iv) The number of providers and 

suppliers profiled by type of provider 

and supplier. 

(v) A measure of public use of the 

reports. 

(2) The provider and supplier data 

sharing, error correction, and appeals 

process, including the following 

information: 

(i) The number of providers and 

suppliers requesting claims data. 

(ii) The number of requests for claims 

data fulfilled. 

(iii) The number of error corrections. 

(iv) The type(s) of problem(s) leading 

to the request for error correction. 

(v) The amount of time to 

acknowledge the request for data or 

error correction. 

(vi) The amount of time to respond to 

the request for error correction. 

(vii) The number of requests for error 

correction resolved. 

(c) A qualified entity must inform 

CMS of inappropriate disclosures or 

uses of beneficiary identifiable data 

under the DUA. 

(d) CMS may take the following 

actions against a qualified entity if CMS 

determines that the qualified entity 

violated any of the requirements of this 

subpart, regardless of how CMS learns 

of a violation: 

(1) Provide a warning notice to the 

qualified entity of the specific concern, 

which indicates that future deficiencies 

could lead to termination. 

(2) Request a corrective action plan 

(CAP) from the qualified entity. 

(3) Place the qualified entity on a 

special monitoring plan. 

(4) Terminate the qualified entity. 

§ 401.721 Terminating an agreement with a 

qualified entity. 

(a) Grounds for terminating a 

qualified entity agreement. CMS may 

terminate an agreement with a qualified 

entity if CMS determines the qualified 

entity or its contractor meets any of the 

following: 

(1) Engages in one or more serious 

violations of the requirements of this 

subpart. 

(2) Fails to completely and accurately 

report information to CMS or fails to 

make appropriate corrections in 

response to confidential reviews by 

providers and suppliers in a timely 

manner. 

(3) Fails to submit an approvable 

corrective action plan (CAP) as 

prescribed by CMS, fails to implement 

an approved CAP, or fails to 

demonstrate improved performance 

after the implementation of a CAP. 

(4) Improperly uses or discloses 

claims information received from CMS 

in violation of the requirements in this 

subpart. 

(5) Based on its re-application, no 

longer meets the requirements in this 

subpart. 

(6) Fails to maintain adequate data 

from other sources in accordance with 

§ 401.711(c). 

(b) Return or destruction of CMS data 

upon voluntary or involuntary 

termination from the qualified entity 

program: 

(1) If CMS terminates a qualified 

entity’s agreement, the qualified entity 

and its contractors must immediately 

upon receipt of notification of the 

termination commence returning or 

destroying any and all CMS data (and 

any derivative files). In no instance can 

this process exceed 30 days. 

(2) If a qualified entity voluntarily 

terminates participation under this 

subpart, it and its contractors must 

return to CMS, or destroy, any and all 

CMS data in its possession within 30 

days of notifying CMS of its intent to 

end its participation. 

(Catalog of Federal Domestic Assistance 

Program No. 93.773, Medicare—Hospital 

Insurance; and Program No. 93.774, 

Medicare—Supplementary Medical 

Insurance Program) 

Dated: November 1, 2011. 

Donald M. Berwick, 

Administrator, Centers for Medicare & 

Medicaid Services. 

Approved: November 29, 2011. 

Kathleen Sebelius, 

Secretary, Department of Health and Human 

Services. 

[FR Doc. 2011–31232 Filed 12–5–11; 11:15 am] 

BILLING CODE 4120–01–P 


emcdonald on DSK5VPTVN1PROD with RULES2