30664 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

42 CFR Part 423 

[CMS–4119–F] 

RIN 0938–AO58 

Medicare Program; Medicare Part D 

Claims Data 

AGENCY: Centers for Medicare & 

Medicaid Services (CMS), HHS. 

ACTION: Final rule. 

SUMMARY: This final rule allows the 

Secretary to collect claims data that are 

presently being collected for Part D 

payment purposes for other research, 

analysis, reporting, and public health 

functions. The Secretary needs to use 

these data because other publicly 

available data are not, in and of 

themselves, sufficient for the studies 

and operations that the Secretary needs 

to undertake as part of the Department 

of Health and Human Service’s 

obligation to oversee the Medicare 

program, protect the public’s health, 

and respond to Congressional mandates. 

These data will also be used to better 

identify, evaluate and measure the 

effects of the Medicare Modernization 

Act of 2003, (MMA). 

DATES: Effective Date: This regulation is 

effective June 27, 2008. Date of 

Applicability: This regulation applies to 

Part D claims data collected on or after 

January 1, 2006. Following the effective 

date of this final rule, we will recollect 

under section 1860D–12(b)(3)(D) of the 

Act any data that were first submitted 

prior to the effective date of this final 

rule by extracting them from the Part D 

claims data already collected for 

payment purposes. 

FOR FURTHER INFORMATION CONTACT: 

Alissa DeBoy, (410) 786–6041; Nancy 

DeLew, (202) 690–7351. 

SUPPLEMENTARY INFORMATION: Copies: To 

order copies of the Federal Register 

containing this document, send your 

request to: New Orders, Superintendent 

of Documents, P.O. Box 371954, 

Pittsburgh, PA 15250–7954. Specify the 

date of the issue requested and enclose 

a check or money order payable to the 

Superintendent of Documents, or 

enclose your Visa or Master Card 

number and expiration date. Credit card 

orders can also be placed by calling the 

order desk at (202) 512–1800 (or toll free 

at 1–888–293–6498) or by faxing to 

(202) 512–2250. The cost for each copy 

is $10. As an alternative, you can view 

and photocopy the Federal Register 

document at most libraries designated 

as Federal Depository Libraries and at 

many other public and academic 

libraries throughout the country that 

receive the Federal Register. This 

Federal Register document is also 

available from the Federal Register 

online database through GPO Access, a 

service of the U.S. Government Printing 

Office. The Web site address is: http:// 

www.access.gpo.gov/fr/index.html. 

I. Background 

A. Requirements for Issuance of 

Regulations 

Section 902 of the Medicare 

Prescription Drug, Improvement, and 

Modernization Act of 2003 (MMA) (Pub. 

L. 108–173) amended section 1871(a)(3) 

of the Social Security Act (the Act) and 

requires the Secretary, in consultation 

with the Director of the Office of 

Management and Budget (OMB), to 

establish and publish timelines for the 

publication of Medicare final 

regulations based on the previous 

publication of a Medicare proposed or 

interim final regulation. Section 

1871(a)(3)(B) of the Act also states that 

the timelines for these regulations may 

vary, but shall not exceed 3 years after 

publication of the preceding proposed 

or interim final regulation, except under 

exceptional circumstances. This final 

rule finalizes provisions set forth in our 

October 18, 2006 proposed rule. In 

addition, this final rule is being 

published within the 3-year time limit 

imposed by section 1871(a)(3)(B) of the 

Act. Therefore, we believe that the final 

rule is in accordance with the 

Congress’s intent to ensure timely 

publication of final regulations. 

B. General Overview 

As stated in the October 18, 2006 

proposed rule, under the Act, the 

Secretary has the authority to include in 

Part D sponsor contracts any terms or 

conditions the Secretary deems 

necessary and appropriate, including 

requiring the organization to provide the 

Secretary with such information as the 

Secretary may find necessary and 

appropriate. (See section 1857(e)(1) of 

the Act as incorporated into Part D 

through section 1860D–12(b)(3)(D) of 

the Act.) 

We proposed to implement section 

1860D–12(b)(3)(D) of the Act to allow 

the Secretary to collect the same claims 

information now collected under the 

authority of section 1860D–15 of the Act 

for purposes including reporting to the 

Congress and the public, conducting 

evaluations of the overall Medicare 

program, making legislative proposals to 

Congress, and conducting 

demonstration projects. While the 

purposes underlying such collection are 

discussed in more detail in this final 

rule, they include, but are not limited 

to, evaluating the effectiveness of the 

new prescription drug benefit and its 

impact on health outcomes, performing 

Congressionally mandated or other 

demonstration and pilot projects and 

studies, reporting to Congress and the 

public regarding expenditures and other 

statistics involving the new Medicare 

prescription drug benefit, studying and 

reporting on the Medicare program as a 

whole, and creating a research resource 

for the evaluation of utilization and 

outcomes associated with the use of 

prescription drugs. 

We note that because this final rule 

applies to all Part D sponsors, it applies 

to any entity offering a Part D plan, 

including both prescription drug plan 

sponsors and Medicare Advantage 

organizations offering qualified 

prescription drug coverage. We further 

note that the Part D prescription drug 

event data (hereinafter also referred to 

as ‘‘Part D claims data’’) collected in 

accordance with section 1860D– 

12(b)(3)(D) of the Act will include 37 

drug claim elements submitted by drug 

plan sponsors to the Secretary, which in 

accordance with § 423.100, include not 

only data from claims for drugs, but also 

data from claims for insulin, biological 

products, certain medical supplies, and 

vaccines. 

II. Provisions of the Proposed Rule 

With an Analysis of and Response to 

Public Comments 

We received approximately 118 items 

of timely correspondence containing 

comments on the October 18, 2006 

proposed rule. Commenters included 

health policy organizations, pharmacies 

and pharmacy-related organizations, 

members of the Congress, researchers, 

insurance industry representatives, 

physicians and other health care 

professionals, beneficiary advocacy 

groups, representatives of hospitals, Part 

D beneficiaries, a pharmacy benefit 

managers’ trade association and others. 

In this final rule, we address all 

comments and concerns on the policies 

included in the proposed rule. The 

following lists the provisions of the 

proposed rule that received the most 

comments: 

• External access to the data 

• Uses for the data 

• Privacy protections for the data 

Generally, the vast majority of 

commenters expressed strong support 

for the proposed rule, declaring it 

essential for the success and accurate 

evaluation of the Medicare Part D 

program. There was also a significant 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30665 

1We note that there are other provisions outside 

of section 1860D–15 of the Act that also contain 

payment provisions. For example, section 1860D–

14 of the Act discusses how CMS pays the lowincome subsidy. 

amount of agreement among the 

commenters that external entities be 

allowed access to Part D claims data. 

Commenters pointed out that CMS 

could not possibly fund all the research 

needed, and because of that, allowing 

external entities access to these data is 

necessary in order to evaluate the many 

health care issues arising from the new 

prescription drug benefit. Commenters 

also noted that research by external 

entities is likely to result in lower 

government expenditures and better 

delivery of health care to beneficiaries. 

Many of the commenters supporting the 

rule cited multiple examples of the 

potential benefits to the public health 

that could result with the access to Part 

D claims data by qualified organizations 

and individuals, including assessing the 

impact prescription drugs have on the 

health outcomes of the elderly, cost 

efficiencies, quality of care measures, 

and the efficacy of prescription drugs. 

A number of comments addressed 

privacy protections, which impact the 

collection and release of claims data, 

and other commenters expressed 

concern about sensitive financial 

information being released. The 

majority of commenters acknowledged 

that a risk to protected information 

exists; however, they believed that the 

risk is no greater than the risk involved 

when allowing access to currently 

available Medicare data. 

Several commenters raised concerns 

about the inherent limitations 

associated with the use of claims data 

for research purposes and requested that 

we acknowledge these limitations. In 

the following sections, we address all of 

these comments. 

A. General Provisions 

1. Statutory Basis 

On December 8, 2003, the Congress 

enacted the Medicare Prescription Drug, 

Improvement, and Modernization Act of 

2003 (MMA) (Pub. L. 108–173). Title I 

of the MMA amended the Act to 

establish a new voluntary prescription 

drug benefit program, Medicare Part D. 

As we stated in the preamble to the 

January 28, 2005 final rule (70 FR 4197) 

implementing the new prescription drug 

benefit, we believe that the addition of 

outpatient prescription drug coverage to 

the Medicare program is the most 

significant change to the Medicare 

program since its inception in 1965. 

Unlike Parts A and B of the Medicare 

program, where Medicare acts as the 

payer and insurer and generally pays for 

items and services on a fee-for-service 

basis, the prescription drug benefit is 

based on a private market model. Under 

this model, CMS contracts with private 

entities—prescription drug plan (PDP) 

sponsors, Medicare Advantage (MA) 

organizations, as well as other types of 

Medicare health organizations—who 

then act as the payers and insurers for 

prescription drug benefits. These private 

entities are generally referred to as ‘‘Part 

D sponsors’’ in our rules. Section 

1860D–12 of the Act contains the 

majority of provisions governing the 

contracts CMS enters into with the Part 

D sponsors. That section, entitled, 

‘‘Requirements for and contracts with 

prescription drug plan (PDP) sponsors,’’

incorporates by reference many of the 

contract requirements that previously 

were applicable to Medicare Advantage 

organizations. 

One of the incorporated provisions at 

section 1860D–12(b)(3)(D) of the Act, is 

section 1857(e)(1) of the Act, which 

provides broad authority for the 

Secretary to add terms to the contracts 

with Part D sponsors, including terms 

that require the sponsor to provide the 

Secretary ‘‘with such information * * * 

as the Secretary may find necessary and 

appropriate.’’ We believe that the broad 

authority of section 1860D–12(b)(3)(D) 

of the Act authorizes us to collect most 

of the information we currently collect 

to properly pay sponsors under the 

statute. However, section 1860D–15 of 

the Act contains provisions that might 

be viewed as limiting such collection. 

Therefore, we engaged in this 

rulemaking in order to resolve the 

statutory ambiguity, as well as to 

implement the broad authority of 

section 1860D–12(b)(3)(D) of the Act. 

Most of the payment provisions with 

respect to Part D sponsors are found in 

section 1860D–15 of the Act.1

Subsections (d) and (f) of section 

1860D–15 of the Act authorize the 

Secretary to collect any information he 

needs to carry out that section. 

However, those subsections also state 

that ‘‘information disclosed or obtained 

under [section 1860D–15 of the Act] 

may be used by officers, employees, and 

contractors of the Department of Health 

and Human Services only for the 

purposes of, and to the extent necessary 

in, carrying out [section 1860D–15 of 

the Act].’’ (Sections 1860D–15(d)(2)(B) 

and (f)(2) of the Act). 

In the January 28, 2005 Medicare 

prescription drug benefit final rule (70 

FR 4399), we stated that the section 

1860D–15 of the Act restriction applies 

only in cases where section 1860D–15 of 

the Act is the authority for collecting the 

information. When information is 

collected under an independent 

authority (even if the collected 

information duplicates the data 

collected under section 1860D–15 of the 

Act) the restrictions under 1860D–15 of 

the Act would not apply. In the January 

28, 2005 final rule (70 FR 4399), we 

noted that because quality improvement 

organizations (QIOs) have independent 

authority to collect Part D claims data in 

order to evaluate the quality of services 

provided by Part D sponsors, QIOs 

would not be barred from collecting 

such data despite the restrictions of 

section 1860D–15 of the Act. We refer 

readers to the October 18, 2006 

proposed rule for the exact citation to 

the discussion in the January 28, 2005 

final rule (71 FR 61447). Similar to the 

statutory provisions authorizing QIOs to 

collect the information they need to 

perform their statutory duties, section 

1860D–12(b)(3)(D) of the Act recognizes 

that the Secretary will need to collect a 

broad array of data in order to properly 

carry out his responsibilities as head of 

the Department of Health and Human 

Services (DHHS). Thus, if the Secretary 

determines it is necessary and 

appropriate under section 1860D–12 of 

the Act for him to collect Part D claims 

data in order to carry out 

responsibilities outside section 1860D–

15 of the Act, then section 1860D–15 of 

the Act would not serve as an 

impediment to such collections. 

As stated in the October 18, 2006 

proposed rule, we also believe that 

language in sections 1860D–12(b)(3)(D) 

and 1857(e)(1) of the Act indicating that 

the authority to collect information 

exists only ‘‘except as otherwise 

provided,’’ and in a manner that is ‘‘not 

inconsistent with this Part,’’ would not 

serve as a hindrance to the independent 

collection of Part D claims data, since 

on its face, section 1860D–15 of the Act 

restricts use of information only when 

collected under that authority. 

As we stated in the proposed rule, the 

Congress most likely included the broad 

grant of authority in section 1860D–15 

of the Act in order to ensure that the 

Secretary, without engaging in any 

rulemaking, would have the legislative 

authority to collect any necessary data 

in order to pay Part D sponsors 

correctly. However, we do not believe 

that the Congress intended to restrict the 

Secretary when the Secretary otherwise 

has independent authority to collect 

identical information to that collected 

under section 1860D–15 of the Act. 

Rather, we noted that the Secretary will 

need to evaluate Part D claims 

information in order to determine how 

access to Part D drug benefits affects 

beneficiary utilization of services under 

Parts A and B of the Medicare program. 

mstockstill on PROD1PC66 with RULES2

30666 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

Specifically, when Congress enacted the 

MMA, one of the stated reasons was to 

ensure that ‘‘by lowering the cost of 

critical prescription drugs, seniors will 

better be able to manage their health 

care, and ultimately live longer, 

healthier lives.’’ (Press Release, House 

Ways and Means Committee, Seniors 

Wait for Affordable Rx Drugs Comes to 

an End. President Bush Signs Historic 

Medicare Bill into Law (December 8, 

2003) (available at http:// 

waysandmeans.house.gov/news.asp )). 

In order to determine whether lowering 

the costs of prescription drugs actually 

reduces health expenditures or 

improves health outcomes for 

beneficiaries, the Secretary will need to 

match individual level Parts A and B 

data with Part D claims data. In this 

way, the Secretary will be able to 

evaluate the effectiveness and efficiency 

of the Part D benefit and report to the 

Congress and others on the progress of 

the program. 

We are required to report to the 

Congress regarding whether mandated 

disease management demonstrations are 

budget neutral and whether 

beneficiaries in these demonstrations 

are on the appropriate medications. As 

we stated in the preamble of the 

proposed rule we may also need to 

make reports under the Part D program, 

for example, the publication of statistics 

detailing aggregate Medicare and 

beneficiary spending by class of drug, 

average number of drugs used by 

beneficiaries, total Medicare program 

spending, and other similar statistics. In 

order to derive such statistics, we would 

need to use Part D claims data. In the 

proposed rule, as well as in this final 

rule, we outlined a wide variety of 

situations in which it will be ‘‘necessary 

and appropriate’’ for CMS to evaluate 

the same information collected under 

section 1860D–15 of the Act, even 

though such information would not be 

used to implement section 1860D–15 of 

the Act. In these situations, we believe 

the clear language of section 1860D–

12(b)(3)(D) of the Act provides the 

authority to collect the necessary 

information, and nothing about such 

collection will be inconsistent or in 

conflict with any other part of the 

statute. 

In addition, as discussed in this 

preamble, we are adding section 1106 of 

the Act as a statutory basis for this final 

rule, as that section authorizes release of 

data by the agency through regulation. 

Comment: Some commenters stated 

that the proposed rule was inconsistent 

with the statute. Commenters also 

asserted that the collection is neither 

necessary nor appropriate, and some 

contended that the rule would 

improperly allow the release of 

proprietary data. 

Response: We refer readers to our 

discussion of the statutory basis in both 

the proposed rule (71 FR 61446) and in 

section II.A.1. of this final rule. As 

noted in the proposed rule, section 

1860D–12(b)(3)(D) of the Act (and its 

incorporation of section 1857(e)(1)) of 

the Act provide broad authority to the 

Secretary to require Part D sponsors to 

provide the Secretary with ‘‘such 

information as the Secretary may find 

necessary and appropriate.’’ In addition, 

sections 1860D–15(d)(2)(B) and (f)(2) of 

the Act, by their own terms, restrict 

information only when ‘‘disclosed or 

obtained under the provisions of 

[section 1860D–15 of the Act].’’ Thus, 

we continue to believe that when 

information is collected through a 

statutory authority independent of 

section 1860D–15 (such as in the case of 

QIOs, who have independent authority 

to collect data) the restrictions of section 

1860D–15 of the Act would not apply, 

and nothing about the collection or use 

of the claims data would create an 

inconsistency or conflict in the statute. 

We also believe the collection of 

claims data under section 1860D–12 of 

the Act is both necessary and 

appropriate for the reasons discussed in 

the proposed rule and in this final rule. 

For example, the collection of such 

claims data will permit the Secretary to 

conduct high level, internal analyses of 

the Part D benefit, such as which drugs 

are commonly used by the Medicare 

population, the utilization of generic 

drugs in the Part D benefit, the effect of 

benefit design on catastrophic costs 

(costs for which reinsurance is 

available), the number of individuals 

who entered the catastrophic phase of 

the benefit, and many more types of 

analysis. Similarly, the Secretary will 

have the opportunity to crosswalk Part 

D claims data to Parts A and B data in 

order to analyze the effect of access to 

prescription drugs on utilization under 

hospital and supplementary medical 

insurance. 

We know that one of the stated 

reasons for the drug benefit was to 

modernize Medicare and ensure that 

beneficiaries were not enduring 

unnecessary hospitalizations due to 

failure to access preventive prescription 

drug regimens. At the time the 

prescription drug benefit was being 

enacted into law, then-chairman of the 

Senate Finance Committee, Senator 

Charles Grassley, stated: 

[T]his bill is about enhancing quality of life 

* * *. Today, the practice of medicine—and 

a lot of the thanks can go to prescription 

drugs—is to keep people out of hospitals and 

out of operating rooms. So people who 

cannot afford drugs, who go to the doctor 

very sick, are going to not only end up in a 

place they do not want to go, because people 

would rather not go to hospitals, rather not 

go to operating rooms. It is going to save our 

programs a lot of money, both private and 

public payment programs, for doctors and 

hospitals, when we can have people go into 

programs where they can get prescription 

drugs and keep their health up so they do not 

go to the hospital. 

(Medicare Prescription Drug, Improvement, 

and Modernization Act of 2003—Conference 

Report, 149 Cong. Rec. S15882–03, *S15883 

and S15884 (November, 25, 2003)). 

Access to Parts A, B, and D claims 

data will allow the Secretary to analyze 

the prescription drug utilization of 

chronically ill patients over time, and 

determine whether increases in 

prescription drug utilization do, in fact, 

result in fewer hospitalizations. This is 

the type of analysis we believe the 

Congress expected the Secretary to 

engage in, and such analysis is both 

necessary and appropriate under the 

law. 

Finally, in response to concerns about 

releasing proprietary data to external 

entities as a result of this rulemaking, 

we note that data which could affect 

Medicare program spending, such as 

rebates, bids, reinsurance, and risksharing data, are not part of this 

rulemaking. In addition, as discussed 

later in this preamble, this rulemaking 

places certain limitations on data when 

released outside of CMS. We believe 

that it is in the interest of public health 

to share information collected under the 

regulations promulgated by this rule 

with entities outside of CMS for 

legitimate research, or in cases of other 

governmental agencies, for purposes 

consistent with their mission. Through 

the application of our ‘‘minimum data 

necessary policy’’, with some additional 

restrictions to protect beneficiary 

confidentiality and commercially 

sensitive data of Part D sponsors, and 

our data sharing procedures (which 

ensure the agency’s compliance with the 

Health Insurance Portability and 

Accountability Act of 1996 (HIPAA), the 

Privacy Act of 1974, and other 

applicable laws), we will limit the use 

and disclosure of Part D claims data to 

ensure that the data are only used or 

disclosed as permitted or required by 

applicable law, and not inappropriately 

disclosed in a manner which could 

undermine the competitive nature of the 

Part D program. 

Comment: One commenter requested 

that CMS postpone implementation of 

this regulation until the Congress 

clarifies CMS’s statutory authority and 

that CMS answer certain questions in a 

second posting for comment. 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30667 

Response: We believe we have the 

authority to collect Part D claims data 

under sections 1860D–12 and 1860D–15 

of the Act, and to disclose Part D claims 

data collected under section 1860D–12 

of the Act, in accordance with section 

1106 of the Act. This final rule is 

sufficiently related to the proposals in 

the proposed rule, which were the 

subject of vigorous review and comment 

by the public, and we are not posting 

the proposal for a second round of 

comments. 

Comment: One commenter questioned 

why we were equating collecting data 

with accessing data. 

Response: As stated in both the 

proposed rule and this final rule, in 

order to ensure that Part D sponsors are 

not required to submit a second set of 

the same data already collected under 

section 1860D–15, we would collect the 

data that are the subject of this final rule 

by extracting them from Part D claims 

data already collected for payment 

purposes. This is the same approach we 

used when we discussed QIO access to 

data in the January 28, 2005 Part D final 

rule (70 FR 4399), where we stated that 

‘‘to the extent QIOs need access to data 

from the transactions between 

pharmacies and Part D sponsors, these 

data could be extracted from the claims 

data submitted to us’’. Thus, in the 

preamble to this final rule, as in the 

preamble to the proposed rule (71 FR 

61447), we may refer to ‘‘accessing’’

rather than ‘‘collecting’’ Part D data. 

2. Information To Be Collected 

In the proposed rule, we proposed to 

independently collect the same claims 

information collected under section 

1860D–15 of the Act under the authority 

of section 1860D–12(b)(3)(D) of the Act. 

The Part D claims data for 2006 and 

2007 includes 37 data elements. We 

referred readers to the Prescription Drug 

Event data instructions which can be 

accessed at http://www.cms.hhs.gov/ 

DrugCoverageClaimsData/ 

01_PDEGuidance.asp#TopOfPage for a 

full description of this information. 

These instructions define each data 

element and its specific potential use for 

CMS’s payment process. Generally 

stated, these data elements include the 

following: 

• Identification of the Part D sponsor 

and Part D plan through contract 

number and plan benefit package 

identification number. 

• Health insurance claim number, 

which identifies the particular 

beneficiary receiving the prescription. 

• Patient date of birth and gender. 

• Date of service. 

• Date paid by the plan. 

• Identification of pharmacy where 

the prescription was filled. 

• Identification of prescribing health 

care professional. 

• Identification of dispensed product 

using national drug code (NDC) number. 

• Indication of whether drug was 

compounded or mixed. 

• Indication of prescriber’s 

instruction regarding substitution of 

generic equivalents or order to 

‘‘dispense as written.’’

• Quantity dispensed (for example, 

number of tablets, grams, milliliters, or 

other unit). 

• Days supply. 

• Fill number. 

• Dispensing status and whether the 

full quantity is dispensed at one time, 

or the quantity is partially filled. 

• Identification of coverage status, 

such as whether the product dispensed 

is covered under the plan benefit 

package or under Part D or both. This 

code also identifies whether the drug is 

being covered as part of a Part D 

supplemental benefit. 

• Indication of whether unique 

pricing rules apply, for example because 

of an out-of-network or Medicare as 

Secondary Payer services. 

• Indication of whether beneficiary 

has reached the annual out-of-pocket 

threshold, which triggers reduced 

beneficiary cost-sharing and reinsurance 

subsidy. 

• Ingredient cost of the product 

dispensed. 

• Dispensing fee paid to pharmacy. 

• Sales tax. 

• For covered Part D drugs, the 

amount of gross drug costs that are both 

below and above the annual out-ofpocket threshold. 

• Amount paid by patient and not 

reimbursed by a third party (such as 

copayments, coinsurance, or 

deductibles). 

• Amount of third party payment that 

would count toward a beneficiary’s true 

out-of-pocket (TrOOP) costs in meeting 

the annual out-of-pocket threshold, such 

as payments on behalf of a beneficiary 

by a qualifying State Pharmaceutical 

Assistance Program (SPAP). 

• Low income cost sharing subsidy 

amount (if any). 

• Reduction in patient liability due to 

non-TrOOP-eligible payers paying on 

behalf of the beneficiary. This would 

exclude payers whose payments count 

toward a beneficiary’s true out of pocket 

costs, such as SPAPs. 

• Amounts paid by the plan for basic 

prescription drug coverage and amounts 

paid by plan for benefits beyond basic 

prescription drug coverage. 

In 2008, the number of elements 

collected in the Part D claims data was 

expanded from 37 to 39. Specifically, 

we added additional elements to reflect 

the estimated rebate amount applied to 

the point-of-sale price and the vaccine 

administration fee. Because these 

elements were added for 2008, they 

were not addressed in the October 18, 

2006 proposed rule. Furthermore, in the 

October 2006 proposed rule (71 FR 

61447), we did not explicitly discuss 

how we would respond to future 

changes in the elements collected as 

part of the claim. Rather, the proposed 

rule included only a discussion of the 

37 elements that then comprised the 

Part D claim and proposed that we 

would collect these 37 elements under 

section 1860D–12(b)(3)(D) of the Act. As 

a result, interested parties had an 

opportunity to comment only upon our 

proposal to collect the original 37 

elements of the Part D claim under 

section 1860D–12(b)(3)(D) of the Act, 

and there has not been any similar 

opportunity for interested parties to 

submit comments on whether the two 

new elements should also be collected 

under section 1860D–12(b)(3)(D) of the 

Act, such that they may also be used for 

non-payment-related purposes. 

Accordingly, we will not be collecting 

these two data elements under section 

1860–12(b)(3)(D) of the Act at this time. 

We are finalizing a regulation 

establishing our authority to collect 

under section 1860D–12(b)(3)(D) of the 

Act only those 37 data elements that 

were part of the prescription drug event 

(PDE) record in 2006. Data regarding 

these 37 elements may be used for both 

payment-related and nonpaymentrelated purposes. As discussed later in 

this preamble, such use will be subject 

to our minimum necessary data policy, 

our data sharing procedures, and the 

encryption of certain identifiers and 

aggregation of cost data to protect 

beneficiary confidentiality and 

commercially sensitive data of Part D 

sponsors. Because data regarding the 

38th and 39th elements will continue to 

be collected only under section 1860D–

15(d)(2) and (f)(1) of the Act, consistent 

with § 423.322(b), these data may be 

used only for payment-related purposes. 

We note that this final rule does not 

extend to rebate or other price 

concession data, otherwise known as 

‘‘direct or indirect remuneration’’ or 

‘‘DIR’’, with the exception of DIR that 

may be reflected in the negotiated price 

paid for a drug at the point of sale. 

Again, the collection of Part D data 

under the authority of section 1860D–12 

of the Act in accordance with this final 

rule, is limited to the original 37 data 

elements collected as part of the Part D 

claims data. We have clarified this in 

mstockstill on PROD1PC66 with RULES2

30668 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

response to comments and in the 

regulatory text. 

Comment: Commenters were 

generally supportive of CMS’s proposal 

to access Part D claims data for research 

and non-research purposes, and agreed 

that the data will provide valuable 

information and be essential in the 

evaluation of the Part D benefit. Several 

commenters requested additional 

elements be added to the original 37 

PDE elements outlined in the proposed 

rule. 

Response: We agree that the PDE data 

elements we now collect will provide a 

valuable tool for evaluating the Part D 

program, and appreciate the suggestions 

to add other elements for collection. 

This final rule is first and foremost a 

clarification of the statutory authority 

that allows us to collect the original 37 

PDE elements outlined in the proposed 

rule and this final rule and to access 

them for purposes other than payment. 

Since these data are already being 

collected under the Part D program, we 

would access the already-collected data 

and make them available for research 

and non-research purposes, without 

undue burden to Part D sponsors or 

beneficiaries. 

As discussed above, in 2008, the 

number of PDE data elements was 

expanded to 39. In future years, we may 

revise our guidance on PDE Reporting to 

include additional elements on the 

claim beyond the elements presently 

collected. Through separate rulemaking, 

we will address whether we intend to 

collect any of these additional elements 

under our authority in section 1860D–

12(b)(3)(D) of the Act. 

Comment: Several commenters noted 

that the proposed rule relates to drug 

claims and related information and 

asked for clarification as to what is 

meant by this phrase. A few 

commenters noted that the presence of 

this phrase in the proposed regulatory 

text suggests that CMS may be 

contemplating using and sharing rebate 

and other discount and pricing 

concession data. 

Response: Rebate and other price 

concession data are not the subject of 

this final rule. This rulemaking applies 

to Part D claims data only, and is 

limited to the original 37 elements 

reported on the PDE. To further clarify 

this point we are amending proposed 

§ 423.505(f)(3) to delete the applicable 

reference to ‘‘related information.’’

Comment: Several commenters 

expressed concern about access to cost 

and pricing data. Several commenters 

noted that pricing data contained on the 

Part D claim are not an accurate 

reflection of the actual costs to plans. 

These commenters also requested 

clarification that the information we are 

proposing to collect and disclose relate 

only to Part D claims data, and not to 

competitively sensitive financial data 

regarding rebates, discounts or other 

negotiated price concessions. The 

commenters expressed a concern that 

release of competitively sensitive data 

could undermine the competitive bid 

process. They assert that plans will be 

able to adjust their bids on the basis of 

knowledge of each others’ data, 

resulting in higher drug costs for all. 

Response: We share the commenters 

concerns about the need to protect the 

sensitive data under the Part D program. 

Because the Medicare drug benefit is 

based on a competitive business model, 

to release commercially or financially 

sensitive data to the public could 

negatively impact Part D sponsors’

ability to negotiate for better prices, and 

ultimately affect the ability of sponsors 

to hold down prices for beneficiaries 

and taxpayers. Therefore, we have 

adopted a number of protections to 

mitigate these concerns. 

First, we have clarified that this final 

rule applies only to the 37 original 

elements of Part D claims data and not 

to rebate and other price concessions 

data. As discussed above, to the extent 

that the PDE record was amended in 

2008 to include data on estimated 

rebates applied at the point of sale, we 

have clarified it in the regulation that 

we will not be collecting this 

information under that authority. In 

addition, we note that plan-specific bid 

information is not included on the 

claim, and therefore, would not be the 

subject of this rulemaking. 

Second, with respect to our 

disclosures of information collected 

under this rulemaking to external 

entities, we have developed an 

approach to minimize the risk of 

unauthorized disclosure of beneficiary 

identifiable information, as well as the 

use of commercially sensitive data of 

Part D sponsors. Similar to the process 

used under Parts A and B program: 

• We will require research using 

beneficiary identifiable data to be 

conducted by an experienced entity at a 

reputable organization, with an 

appropriate research design, and with 

assurances to protect beneficiary 

confidentiality. Research is to be made 

available to the public and identifiable 

data is not released for commercial 

purposes. 

• We will only release beneficiary 

identifiable data for research purposes if 

the CMS privacy board approves the 

data release and then, will only release 

the minimum data necessary for the 

study. 

• Requesters who receive identifiers 

to link to another dataset will be 

required to re-encrypt beneficiary 

identifiers, after data linkage, to 

minimize the risk of accidental 

disclosure. 

• Requesters will sign a data use 

agreement which carries penalties for 

misuse or intentional release of 

beneficiary identifiable information. 

In addition to these protections of 

beneficiary identifiable information, we 

plan to impose additional restrictions to 

further protect beneficiary 

confidentiality and plan commercially 

sensitive information. When releasing 

data to external entities, we will restrict 

releases according to the following 

principles: 

• Only the minimum necessary 

elements from the PDE will be released 

for a project. In accordance with this 

principle, cost data will not be released 

unless necessary for the project. 

• Drug cost elements (that is, 

ingredient cost, dispensing fee, and 

sales tax) will be aggregated. 

• Beneficiary identifiers, pharmacy 

identifiers and prescriber identifiers 

will be encrypted where not needed to 

link to other datasets. Additionally, an 

element representing the internal 

prescription service reference number 

assigned by pharmacies will not be 

released so as to not indirectly reveal 

pharmacy identifiers. 

• Plan identifiers will always be 

encrypted for external entities. We note 

that the internal plan identification 

numbers on the claim would also not be 

available to external entities as these 

represent reference numbers assigned by 

the plan at the time a drug is dispensed 

and release of such numbers could lead 

to a de facto identification of the plan. 

We also note that when we state in this 

preamble that an identifier will be 

encrypted, this means that it will be 

replaced with a non-identifiable number 

or code such that there is a low 

probability of assigning any meaning to 

the replacement number or code. Unless 

otherwise noted, encryption will occur 

without any decryption, and we would 

not provide a key that allows for an 

encrypted identifier to be converted 

back into its original form. We believe 

these restrictions will protect both the 

commercially sensitive data of Part D 

plans, such as the plan identifiers, 

pharmacy identifiers, prescriber 

identifiers and cost elements, as well as 

the beneficiary identifiable data 

included on the claim. Similar 

protections for both beneficiary 

identifiable information as well as 

commercially sensitive data of Part D 

sponsors will be in place for releases to 

governmental entities as well including 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30669 

States, Congress and other executive 

branch agencies. For both States and 

non-HHS executive branch agencies, the 

drug cost elements on the claim 

(ingredient cost, dispensing fee, and 

sales tax) will be aggregated together, 

and will not be available in a 

disaggregated format, except that, upon 

request, CMS will exclude sales tax 

from the aggregation at the individual 

claim level if necessary for the project. 

We believe this aggregation will serve to 

ensure that some of the most 

confidential data on the claim—the 

separate costs paid by Part D sponsors 

for ingredient cost or dispensing fee—

will not be vulnerable to any 

unauthorized release. However, because 

these government agencies may need 

other data on the claim in order to 

coordinate treatment of beneficiaries or 

further study care received by 

individual beneficiaries, we will make 

the beneficiary, plan, pharmacy, and 

prescriber identifiers available to these 

entities where needed. For example, as 

discussed later in this preamble, States 

have specifically requested claims data 

for beneficiaries dually eligible for 

Medicaid and Medicare. By 

understanding the care received by 

these beneficiaries, the State Medicaid 

agencies may be able to better 

coordinate the medical costs they 

reimburse under Medicaid with the 

drug regimens being reimbursed under 

the Medicare Part D program. In 

coordinating care, these State agencies 

may need to understand which plan a 

beneficiary is enrolled in. Releases to 

Congressional oversight agencies are 

discussed in response to comment later 

in this preamble. We have included 

these restrictions in our amended 

regulations at § 423.505(m). 

The appendix to this rule also 

contains a CMS chart, explaining in 

more specific detail the restrictions 

relative to the available PDE elements 

for various parties. We will evaluate all 

requests for these data to ensure that 

any release is consistent with the 

restrictions contained in our 

regulations, and we will release only the 

minimum data that are necessary for the 

specific project. Additionally, as part of 

our data sharing procedures, we will 

ensure that any disclosure is for an 

appropriate purpose and does not 

undermine the competitive nature of the 

Part D program, such as a disclosure 

that would result in Part D sponsors 

being able to adjust their plan bids on 

the basis of knowledge of each others’

data. 

Finally, while we agree with 

commenters that cost data on the Part D 

claim may not reflect the actual costs to 

plans, such data does reflect costs 

incurred at point-of-sale, and may be of 

use to CMS, other governmental entities, 

and other external entities for projects 

unrelated to a plan’s total costs. 

Comment: One commenter asked that 

CMS appropriately use and differentiate 

between the terms ‘‘sex’’ and ‘‘gender’’

in its data collection process. 

Response: The Patient Gender Code 

field in the Part D claim is defined by 

the National Council of Prescription 

Drug Programs (NCPDP). We have found 

it helpful in working with the industry 

and other stakeholders to rely on the 

NCPDP industry standard whenever 

possible. The NCPDP data dictionary 

defines ‘‘Gender Code’’ under definition 

of field, ‘‘For eligibility, and identifying 

the gender of the member.’’ Values are: 

M=Male, F=Female, and U=Unknown. 

B. Purpose of CMS Collecting 

Information 

In the proposed rule, we outlined our 

intended use of Part D claims data for 

a wide variety of statutory and other 

purposes including—

• Reporting to the Congress and the 

public on the overall statistics 

associated with the operation of the 

Medicare prescription drug benefit; 

• Conducting evaluations of the 

Medicare program; 

• Making legislative proposals with 

respect to the programs we administer, 

including the Medicare, Medicaid, and 

the State Children’s Health Insurance 

Program; and 

• Conducting demonstration projects 

and making recommendations for 

improving the economy, efficiency, or 

effectiveness of the Medicare program. 

In the final rule, we continue to 

believe such uses are necessary and 

appropriate. In addition, as discussed 

below and later in this preamble, we 

also intend to use these data for ‘‘other 

studies addressing public health 

questions,’’ ‘‘pilot projects,’’

‘‘supporting quality improvement and 

performance measurement activities,’’

and ‘‘populating personal health 

records,’’ and have added these 

purposes to the list in § 423.505(f)(3). 

Comment: Many commenters believe 

analyses of Part D claims data are 

necessary for CMS to administer the 

Medicare program, and for planning, 

evaluation, and policy development. 

Examples of program research and 

evaluation uses suggested by 

commenters include—

• Assuring that Part D has not 

promoted adverse selection into certain 

health plans with less generous 

medication coverage; 

• Examining the effects of drug 

coverage and cost containment on 

Medicare spending and the health of 

vulnerable elderly and disabled persons; 

• Measuring the success of 

prescription drug plans in encouraging 

the use of generic medicines; 

• Examining the transition effects of 

moving dual eligibles from Medicaid 

programs to Part D; 

• Analyzing the effects of a coverage 

gap on drug utilization and spending; 

• Determining the impact of Part D 

coverage on non-pharmaceutical 

treatments and services use; 

• Evaluating the effect of changing 

copayments, copay structures, and 

coverage limits on beneficiary drug 

choices and compliance with drug 

regimens; 

• Assessing the extent to which risk 

adjustment methodology influences 

enrollment dynamics; 

• Assessing the impact of adding a 

prescription drug benefit on health 

outcomes of beneficiaries; 

• Researching the extent to which 

disparities in care (based on race, 

socioeconomic status, rural residence, 

etc.) might be affected by Part D; and 

• Understanding the impact of Part D 

on related public programs, such as the 

State Children’s Health Insurance 

Program (SCHIP), SPAPs, Medicaid, and 

the VA. 

Commenters also noted that being 

able to explore how Part D functions on 

its own and in relation to other parts of 

the Medicare program is essential to 

guiding future policy decisions. They 

further assert that use of Part D claims 

data is critical to CMS’s credibility and 

should be considered as part of the 

Secretary’s value-based health care 

purchasing initiative. Without access to 

Part D claims data for research and other 

purposes, CMS will limit its ability to 

monitor expenditures for the new 

program, to study the impact of the 

program on public health, and to 

respond to Congressional requests for 

information. 

Response: We agree with the many 

comments that Part D claims data will 

be essential to us for reporting, 

conducting program evaluations and 

demonstrations, research analyses, and 

other public health functions. We also 

agree that research uses of these data 

should help promote and protect the 

health and well-being of Medicare 

beneficiaries. While we believe these 

uses were implied in the regulatory text 

set forth in the proposed rule, we are 

expanding the list of necessary and 

appropriate purposes for which data 

will be collected in this final rule to 

address public health functions 

specifically. 

Comment: Commenters expressed 

widespread support for using Part D 

mstockstill on PROD1PC66 with RULES2

30670 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

claims data to improve our knowledge 

base on medication adherence and other 

aspects of pharmacotherapy among the 

elderly and disabled. Some specific 

suggested uses of Part D claims data for 

this purpose include the following: 

• Describing current medication use 

among the elderly and disabled and 

examining trends, specifically 

enhancing our awareness of polypharmacy, off-label uses, avoidance of 

contraindicated drugs and dangerous 

drug-drug interactions. 

• Examining the extent to which 

Medicare beneficiaries receive 

medicines according to evidence based 

guidelines. 

• Assessing whether beneficiaries are 

adhering to prescribed therapy, and if 

not, the clinical and economic impact of 

nonadherence. 

• Testing new interventions to 

improve medication prescribing and 

adherence. 

• Evaluating the impact of medication 

therapy management programs 

mandated under the new Medicare 

prescription drug benefit. 

Response: We consider examining 

medication use, inappropriate use, and 

factors influencing medication 

adherence in the Medicare population 

to be crucial aspects of Part D program 

monitoring and evaluation, and public 

health. As noted by commenters, the 

Congress mandated that we examine 

best practices of medication therapy 

management, and Part D claims data are 

critical for our being able to complete 

that study. 

Comment: A few commenters noted 

that sharing of research results is critical 

to CMS credibility and should be 

considered part of the transparency 

initiative. 

Response: We recognize Part D claims 

data research, and any subsequent 

results, are critical to evaluating 

multiple aspects of the Medicare 

Prescription Drug program. Many 

quality measures developed by the 

American Medical Association 

Physician Consortium and National 

Committee for Quality Assurance, and 

subsequently adopted by Ambulatory 

Care Quality Alliance, and the Hospital 

Quality Alliance require Part D claims 

data to run the measures. All of the 

following quality measures involve Part 

D claims data: Drug Therapy for 

Lowering Cholesterol, Beta-Blocker 

Therapy within 7 days post myocardial 

infarction, and Beta-Blocker therapy at 6 

months post myocardial infarction. 

These measures will be used by many 

of the Better Quality Information to 

Improve Care for Medicare Beneficiaries 

Project pilots, including the new local 

collaboratives being chartered under the 

Secretary’s value-based health care 

initiative to foster public reporting. All 

of this makes Part D claims data an 

integral part of our transparency efforts. 

Thus, in this final rule, we are clarifying 

our intent to use Part D data for these 

necessary and appropriate purposes by 

adding ‘‘supporting quality 

improvement and performance 

measurement activities’’ as an explicit 

use of these data under § 423.505(f)(3). 

Comment: A commenter asserts that 

we did not adequately justify the use of 

Part D claims data by the Secretary for 

public reporting purposes, apart from its 

use to develop reports to the Congress, 

which may become publicly available 

records. 

Response: As we stated in the 

proposed rule, we believe it is 

appropriate and necessary for the 

Secretary to use Part D claims data for 

the purposes of reporting to the 

Congress on the effectiveness and 

performance of the prescription drug 

benefit—including reporting that is not 

related to payment. In addition, we may 

need Part D claims data to report to the 

public on aggregate statistics associated 

with the Part D program. Finally, the 

Secretary has determined that it is 

necessary and appropriate, under 

section 1860D–12 of the Act, that the 

public should have access to certain 

data, so that the public may monitor the 

progress of the Part D program and, in 

fact, perform research that will improve 

the health of, not only Medicare 

beneficiaries, but all Americans. This is 

why we have created Part D-related 

public use files relating to plan benefits 

and formularies (for example, files such 

as geographic locator files, plan 

information files, formulary files, 

beneficiary cost files, pharmacy network 

files, and record layout files as 

described at http://www.cms.hhs.gov/

NonIdentifiableDataFiles/09_

PrescriptionDrugPlanFormularyand

PharmacyNetworkFiles.asp.). We may 

also create additional public use files 

subsequent to the publication of this 

final rule. 

Comment: Several commenters 

suggested that the reporting of overall 

statistics and development of 

evaluations and/or legislative proposals 

can be achieved without CMS having to 

use or disclose the Part D sponsors’ Part 

D claims data. The commenter 

suggested that CMS use information that 

is separately collected from the claim to 

develop statistics, noting however, that 

this information will not necessarily 

allow CMS to do every type of analysis 

described in the proposed rule. 

Additionally, CMS could partner with 

one or more sponsors to use their data, 

alone, or in combination, to do 

additional statistics and analysis. 

Response: Although we are willing to 

partner with plan sponsors as needed, 

we do not believe that voluntary 

cooperation by Part D sponsors would 

provide the kind of comprehensive data 

sets we need to perform the research, 

evaluations, reporting and other 

functions that are described this final 

rule. Voluntary agreements with plan 

sponsors would lead to an incomplete 

file of data. In addition, because we 

possess the authority under section 

1860D–12(b)(3)(D) of the Act to collect 

Part D claims data, we do not believe an 

exclusive reliance on such voluntary 

agreements is necessary. 

Comment: A commenter noted that a 

recent Report to Congress recommended 

that the Secretary should have a process 

in place for the timely delivery of Part 

D data to congressional support agencies 

to enable them to report to the Congress 

on the drug benefit’s impact on cost, 

quality, and access. 

Response: We agree that congressional 

support agencies should have timely 

access to appropriate Part D data. This 

final rule allows congressional oversight 

agencies access to all elements on the 

Part D claim in order to carry out their 

functions. Like other agencies outside of 

CMS, such congressional agencies 

would be subject to our minimum 

necessary policies and data sharing 

policies. Thus, we would release only 

the minimum amount of Part D claims 

information necessary to support given 

projects. In addition, as discussed later 

in this preamble, the Congressional 

Research Service has the authority to 

require data releases only when acting 

on behalf of a committee. Thus, that 

agency would be treated the same as a 

congressional oversight agency when 

acting on behalf of committee. 

Otherwise, it would be subject to the 

same restrictions that apply to external 

entities in our regulation. 

Comment: Several commenters 

requested that we establish specific, 

explicit procedures to ensure that if 

comparative effectiveness or safety 

research informs coverage or payment 

decisions for specific items and services 

(whether decisions are made by CMS or 

its agents under Parts A and B or by 

private plans under Part D), 

stakeholders have an opportunity to 

evaluate the evidentiary basis of 

proposed decisions and provide input. 

Response: Since our proposed rule 

did not address the development of 

national coverage or payment decisions, 

but rather our access to Part D claims 

data, we believe that our development 

of coverage or payment decisions is 

beyond the scope of this rulemaking. 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30671 

We do note that section 1860D–4(b)(3) 

of the Act requires pharmacy and 

therapeutic committees to base clinical 

formulary decisions on the strength of 

the scientific evidence and standards of 

practice. We have issued further 

formulary guidance available at http://

www.cms.hhs.gov/Pharmacy/07_

Formulary%20Guidance.asp#

TopOfPage. 

Comment: Some commenters noted 

potential uses for Part D claims data, 

linked with Parts A and B data, which 

extend beyond research into the actual 

provision of care, including disease 

management. 

Response: We believe the 

implementation of disease management 

programs and the evaluation of these 

programs could potentially be 

strengthened by the use of Part D claims 

data. However, we believe these data 

must be used with caution for these 

purposes since we collect Part D claims 

data only for Medicare Part D enrollees. 

We do not collect drug claims data for 

those beneficiaries who receive their 

drug insurance solely from other 

sources, such as employer or retiree 

sponsored health plans, the Veterans 

Health Administration, or TRICARE. 

Comment: Some commenters noted 

that Part D claims data can help 

improve Medicare’s current basis of risk 

adjustment for plan payments. 

Response: Section 1860D–15(d)(2)(B) 

of the Act provides us authority to use 

Part D claims data for determining 

Medicare payments to prescription drug 

plan sponsors. This includes their use 

for refining our drug plan payment 

system. Thus, when claims data are 

used for risk adjustment they are 

collected under section 1860D–15 of the 

Act, and not under section 1860D–12 of 

the Act. 

Comment: A commenter 

recommended adding the phrase ‘‘and 

pilot’’ into the text of the 

§ 423.505(f)(3)(iv), so that the regulation 

would read ‘‘The Part D plan sponsor 

agrees to submit to CMS * * * [d]ata 

included in drug claims submitted by 

Part D plan sponsors, as the Secretary 

deems necessary and appropriate for 

purposes including but not limited to 

* * * [(f)(3)(iv) c]onducting 

demonstration and pilot projects and 

making recommendations for improving 

the economy, efficiency, or effectiveness 

of the Medicare program.’’ The 

commenter wants to ensure that 

Medicare Health Support Organizations 

are able to access Part D claims 

utilization data. 

Response: We agree that pilot 

projects, as appropriate, should have 

access to these data, as appropriate, and 

have added the phrase ‘‘and pilot’’ to 

§ 423.505(f)(3)(iv). 

Comment: Several commenters 

requested that the list of purposes for 

which the data would be used be 

expanded to include program integrity. 

Response: We agree that it is 

important that our program integrity 

components have access to necessary 

data in order to protect the program. 

The existing regulation at § 423.322(b) 

already allows information collected 

under section 1860D–15 of the Act to be 

used in determinations of payments and 

payment-related oversight and program 

integrity activities. To the extent that 

program integrity activities may include 

investigations of issues that are not 

directly payment-related, this rule will 

provide access to Part D claims data for 

these purposes. 

Comment: One commenter requested 

we clarify in the final rule that Part D 

claims data can be used by CMS to 

oversee and protect the program. Other 

commenters stated that we should 

clarify that Medicare Drug Integrity 

Contractors (MEDICs) can obtain Part D 

claims data where necessary to fully 

investigate complaints and fraudulent 

claims. 

Response: Our regulations already 

address use of payment data for 

payment-related oversight. We are 

constantly working with our MEDICs to 

determine the types of data to which 

they will have access. However, we 

believe our interactions with our 

contractors involve internal agency 

procedures, and are not the subject of 

this final rule. 

C. Sharing Data With Entities Outside of 

CMS (Final § 423.505(f)(3) and (l) 

Through (o)) 

As stated in the October 18, 2006 

proposed rule, in addition to collecting 

Part D claims data for use in 

administering the Medicare Part D 

program under the authority of section 

1860D–12(b)(3)(D) of the Act, we also 

believe that it is in the interest of public 

health to share the information collected 

under that authority with entities 

outside of CMS. When information is 

collected under the authority of section 

1860D–12(b)(3)(D) of the Act, we do not 

believe that the statutory language in 

section 1860D–15(d) and (f) of the Act 

(requiring the information collected 

under the authority of that section to be 

used only in implementing such 

section) would apply, since any 

collection would be effectuated outside 

of section 1860D–15 of the Act. 

Therefore, as we stated in the October 

18, 2006 proposed rule, we proposed to 

add a new § 423.505(f)(5) to the 

regulations (now § 423.505(l) and (m)) 

that would specify that we could use 

and share the Part D claims information 

we collect under § 423.505(f)(3), without 

regard to any restriction included in 

§ 423.322(b). In response to comments, 

we clarify in this final rule that our 

regulation permitting release of Part D 

claims data to other government 

agencies and outside entities is 

authorized by section 1106 of the Act. 

1. Other Government Agencies 

We stated in the proposed rule that 

the Department of Health and Human 

Services’ (DHHS’) public health 

agencies such as the National Institutes 

of Health (NIH), the Food and Drug 

Administration (FDA), and the Agency 

for Healthcare Research and Quality 

(AHRQ) have, or support, researchers 

that would need to use Medicare Part D 

prescription drug event data for studies, 

and other projects, to improve public 

health consistent with the missions of 

these agencies. We also stated that 

oversight agencies may need access to 

both aggregated and non-aggregated 

claims data in order to conduct 

evaluations of the Part D program that 

are unrelated to payment and therefore 

not authorized under section 1860D–15 

of the Act. In addition, agencies in the 

legislative branch, such as the GAO, 

MedPAC, and CBO, may need access to 

data in order to evaluate the program. 

We continue to believe this. 

We also continue to believe that other 

agencies within DHHS, such as the 

Centers for Disease Control and 

Prevention, the Health Resources and 

Services Administration, or the Office of 

the Assistant Secretary for Planning and 

Evaluation, may also need Part D claims 

data to perform evaluations or assess 

policies. However, we note specifically 

that OIG has independent authority to 

collect Part D claims data from Part D 

sponsors to perform its statutory duties 

in accordance with the Inspector 

General Act of 1978, as amended, 5 

U.S.C. App. This final rule provides OIG 

an additional avenue for access to these 

data for both payment and nonpayment 

purposes. 

Given these necessities, we proposed 

to allow broad access for other Federal 

government executive branch agencies 

to our Part D claims data, linked to our 

other claims data files. As stated in the 

preamble of the proposed rule, other 

agencies generally would enter into a 

data sharing agreement, similar to what 

is used today. This would allow the 

sharing of event level cost data, protect 

the confidentiality of beneficiary 

information, and ensure that the use of 

Part D claims data serves a legitimate 

purpose. We also stated in the proposed 

rule that we would also ensure that any 

mstockstill on PROD1PC66 with RULES2

30672 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

system of records with respect to Part D 

claims data is updated to reflect the 

most current uses of such data. 

In the proposed rule, we requested 

comments that would help us in our 

efforts to improve knowledge relevant to 

the public health. Specifically, we 

requested guidance on how we can best 

serve the needs of other agencies 

through the sharing of information we 

collect under section 1860D–12(b)(3)(D) 

of the Act, while at the same time 

addressing the legitimate concerns of 

the public and of Part D plan sponsors 

that we appropriately guard against the 

potential misuse of data in ways that 

would undermine protections put in 

place to ensure confidentiality of 

beneficiary information, and the 

nondisclosure of proprietary data 

submitted by Part D plans. 

After considering the comments 

received, we will make Part D claims 

data available under a process that 

builds upon the practice that is 

currently in place today with respect to 

the release of Medicare Parts A and B 

data. Thus, we specify in this final rule 

that, of the data we collect under the 

authority of section 1860D–12 of the 

Act, only the minimum information 

necessary, subject, in certain cases, to 

encryption and aggregation of certain 

elements, will be shared with other 

Federal executive branch agencies, 

which would include contractors acting 

on their behalf, in accordance with 

section 1106 of the Act, based on data 

sharing procedures established by CMS 

and agreed to by the Federal executive 

branch agency requesting the data. The 

attached appendix, as well as our 

amended rules at § 423.505(m), explain 

how in this final rule we would group 

the governmental entities outside of 

CMS that request access to the data 

collected under 1860D–12 of the Act. 

Agencies within HHS, as well as the 

Congressional oversight agencies 

(including CRS when acting on behalf of 

a committee) would receive only the 

elements of the PDEs on the claim that 

are minimally necessary for the 

applicable project. Plan, pharmacy, and 

prescriber identifiers would be 

encrypted unless necessary for the 

project. In addition, for States and nonHHS executive branches, the dispensing 

fee, ingredient cost and sales tax 

elements on the claim would be 

aggregated together prior to any release, 

except that, upon request, we will 

exclude sales tax from the aggregation at 

the individual claim level if necessary. 

Comment: One commenter objected to 

the use of the word ‘‘necessities,’’

stating that it is not necessary to allow 

broad access to Part D claims data. 

Response: We continue to believe that 

it is both necessary and appropriate for 

the Secretary to collect the Part D claims 

data under section 1860D–12(b)(3)(D) of 

the Act in order to carry out his broad 

range of duties under the Act, including 

the duties that are listed at 

§ 423.505(f)(3). Once the Secretary 

collects the information for his own 

necessary and appropriate purposes, we 

do not believe that the external release 

of such information must be categorized 

as necessary in order for it to occur, as 

section 1860D–12(b)(3)(D) of the Act 

refers to the collection of, not the release 

of, data. Release of data will be 

authorized under section 1106 of the 

Act. In addition, any release will be 

intended for the benefit of the public 

health and welfare. 

Comment: Several commenters 

requested that the FDA play a central 

role in any use of Part D claims data for 

safety evaluations. Others requested that 

CMS issue a separate proposal to 

present CMS and FDA combined views 

on sharing of data for public comment. 

One commenter also contended that the 

FDA may not want to use Part D claims 

data because of alleged reliability 

problems and the fact that the FDA may 

have problems integrating the Part D 

claims data with its own databases. 

Finally, commenters requested that both 

agencies allow manufacturers to review 

the data and methods used for postmarketing surveillance. 

Response: We do not believe that the 

FDA’s use of Part D claims data or how 

the claims data are used in safety 

evaluations is the subject of this 

proposed rule. However, we note that 

we plan to exchange Part D claims data 

with the FDA in accordance with 

applicable laws and our data sharing 

procedures, by entering into appropriate 

interagency agreements and data use 

agreements. Thus, our procedures for 

sharing data with the FDA will be the 

same as those developed for other 

government agencies. 

Comment: A commenter requested 

that the Congressional Research Service 

(CRS) be able to access the same level 

of data as oversight agencies, such as the 

Office of the Inspector General (OIG), 

the Government Accountability Office 

(GAO), the Congressional Budget Office 

(CBO), and the Medicare Payment 

Advisory Commission (MedPAC). 

Response: In the proposed rule we 

stated that the Congressional oversight 

agencies (GAO, MedPAC, and CBO) may 

require access to data in order to 

evaluate the Part D program (71 FR 

61452). Although we did not define CRS 

as a Congressional Oversight entity, like 

GAO, it does have statutory authority to 

request data (see 2 U.S.C. 166(d)(1)), but 

only when it is doing so on behalf of a 

committee. Accordingly, we are 

specifying that CRS will be considered 

a congressional oversight agency when 

the CRS is acting on behalf of committee 

under 2 U.S.C. 166(d)(1). Our 

regulations at § 423.505(m), as well as 

the attached appendix outline the data 

policies that would apply to 

congressional oversight agencies, 

including being subject to our minimum 

data necessary policy, our data sharing 

procedures, and applicable laws. For 

individually identifiable information or 

certain commercially or financially 

sensitive information, such as plan 

identifiers and cost information, these 

Congressional oversight agencies will be 

required to sign a Data Use Agreement 

(or provide assurances acceptable to 

CMS) to protect against disclosure of 

such data. When CRS is not acting as 

the agent of a committee, however, it 

does not have the same authority to 

request data from departments or 

agencies of the United States. Thus, we 

have specified that in these cases, CRS 

would be treated as an external entity, 

because the agency would essentially be 

performing research or analysis on 

behalf of an individual member of the 

congress. In addition, unlike States or 

other executive branch departments, the 

CRS should not need access to plan 

identifiers or other data on the claim in 

order to coordinate care on behalf of 

beneficiaries. Thus, we have specified 

that CRS will be restricted in the same 

manner as external researchers, and will 

not be treated similar to other executive 

branch agencies or States. 

Comment: A commenter asked CMS 

to allow for a process that permits 

access to Part D claims data in a highly 

organized way and enables external 

entities to replicate any results Federal 

agencies obtain using the data. 

Response: We believe that our 

approach to providing access to Part D 

claims data, which would follow a 

review of each request under our 

minimum necessary data policy with 

some additional encryption and 

aggregation restrictions based on type of 

requestor, balances the need for Part D 

data in order to conduct legitimate 

research with the needs to protect 

patient information and to preserve the 

competitive nature of the Part D 

program. Therefore, we will review 

legitimate research requests and decide 

whether to release Part D claims 

information, consistent with our 

regulation at § 423.505(m), as well as the 

guidance provided in the appendix to 

this final rule. We expect that external 

entities may be able to replicate the 

results of Federal analyses for many 

research questions, such as those 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30673 

relating to the utilization of specific 

drugs or classes of medications, 

comparative effectiveness or safety 

research. 

Comment: A few commenters asked 

that all applicable government agencies 

have broad access to the data in a timely 

fashion without having to enter into 

numerous data use agreements (DUA). 

Response: As illustrated in our 

regulation § 423.505(m), as well as in 

the appendix to this final rule, non 

DHHS entities will have access to the 

minimum Part D claims data necessary 

for a given project, except that certain 

elements may be encrypted or 

aggregated. In the event of a backlog of 

requests for Part D data under these 

rules, we plan to give government 

agencies first preference in the review 

process, and to require such agencies to 

abide by our data sharing policies, 

which generally require a data use 

agreement. We have modified or 

streamlined the data sharing process in 

the case of certain Federal law 

enforcement or oversight entities. For 

example, we have streamlined the DUA 

process for the Department of Justice 

(DOJ). DOJ provides a letter for each 

request for data, which CMS tracks and 

monitors. 

2. External Entities 

As stated in the preamble of the 

proposed rule, external entities, such as 

researchers based in universities, 

regularly request and analyze Medicare 

data for their research studies, many of 

which are designed to address questions 

of clinical importance and policy 

relevance. We continue to believe 

researchers studying a broad range of 

topics need access to Part D claims 

linked to Parts A and B claims data. As 

stated in the preamble of the proposed 

rule, analyses of Parts A and B claims 

have contributed to significant 

improvements in the public health, have 

been critical in assessing the quality and 

costs of care for patients in the Medicare 

program, and have, in many cases, 

spurred other types of research. As 

such, we continue to believe that a data 

source that includes Parts A and B 

claims as well as their attendant Part D 

claims could be used in a similarly 

constructive manner, such that greater 

knowledge on a range of topics, both 

clinical and economic, would be 

generated. This knowledge is expected 

to contribute positively to the 

evaluation and functioning of the 

Medicare program, and to improve the 

clinical care of beneficiaries. 

Also, as stated in the preamble of the 

proposed rule, we will specifically 

address the needs of a segment of 

external entities as part of our 

implementation of section 723 of the 

MMA, which requires the Secretary to 

develop a plan to ‘‘improve the quality 

of care and reduce the cost of care for 

chronically ill Medicare beneficiaries.’’

The Congress specifically stated that the 

plan should provide for the collection of 

data in a data warehouse (under section 

723(b)(3) of the MMA). Within the 

parameters of this regulation, we will 

implement section 723 of the MMA by 

populating a chronic care condition data 

warehouse (CCW) which will be 

accessible by private researchers in 

order for such researchers to conduct 

studies related to improving quality and 

reducing costs of care for chronically ill 

Medicare beneficiaries. 

In addition to the section 723 of the 

MMA data warehouse, we stated in the 

proposed rule that we are planning to 

make Medicare Part D claims data 

linked to other Medicare claims files 

available to external entities on the 

same terms as other Medicare Parts A 

and B data are released today, with 

appropriate protections for beneficiary 

confidentiality. We requested comments 

on the proposed use of the data for 

research purposes that would help us in 

our efforts to improve knowledge 

relevant to the public’s health, as well 

as comments on whether we should 

consider additional regulatory 

limitations for external entities beyond 

our existing data use agreement 

protocols in order to further guard 

against the potential misuse of data for 

non-research purposes, commercial 

purposes, or to ensure that proprietary 

plan data or confidential beneficiary 

data are not released. 

As explained in response to 

comments, we continue to maintain the 

discretion to release the 37 collected 

PDE elements for legitimate research 

purposes, subject to encryption of 

certain identifiers and aggregation of 

cost data to protect beneficiary 

confidentiality and commercially 

sensitive data of Part D sponsors. (These 

restrictions are outlined in our 

regulations at § 423.505(m) as well as in 

the appendix attached to this rule.) 

Furthermore, we also believe Part D 

claims data are necessary for use in 

personal health records and to ensure 

the public will be able to access the 

results of quality measurement and 

performance initiatives as discussed in 

the ‘‘Purpose of CMS Collecting 

Information’’ section of this preamble. 

We will release only the minimum 

information necessary for a given 

project. In addition, data will be 

disseminated in accordance with 

applicable laws via our established data 

sharing procedures. Thus, the requestor 

of data must agree to abide by the 

restrictions established by our data 

sharing procedures in order to receive 

access to Part D claims data. We will 

ensure that our system of records for 

Part D claims data would permit the 

uses of the data described in this final 

rule. 

Comment: In general, the importance 

of Part D claims data for improving 

aspects of public health was a recurring 

theme among many of the comments we 

received. Commenters noted the lack of 

a comprehensive source of prescription 

medication data as one of the greatest 

challenges to conducting meaningful 

research in the elderly. They noted that 

Part D claims data will be vital for 

enhancing disease surveillance, 

identifying rare complications of drug 

therapy, and improving knowledge 

about the effectiveness and safety of 

drugs. Several commenters underscored 

that knowledge based on selected 

aspects of pharmacotherapy in the 

elderly or disabled population is 

limited. They point out that the very 

old, patients with multiple chronic 

conditions, and those taking multiple 

medications are routinely excluded 

from clinical trials, and assert that 

research based on Part D claims data 

would provide a valuable supplement to 

the FDA’s current post-marketing 

surveillance system. 

Other themes raised by commenters 

centered on the current fragmentation of 

our health care information and the lack 

of information on drug treatment in the 

elderly. These commenters suggested 

that analyses of Part D claims data 

linked with Parts A and B data could 

provide a comprehensive picture of 

disease treatment, help guard against 

siloed policy analyses, and support a 

broad, disease-centered research agenda 

that would advance the essential quality 

improvement goals highlighted by the 

Institute of Medicine in its report, 

Crossing the Quality Chasm: A New 

Health System for the 20th Century. 

Commenters also said analyses of Part D 

claims data would be beneficial for 

developing comprehensive estimates of 

the costs of care, revealing the most cost 

effective disease therapies, and 

understanding beneficiaries’ sensitivity 

to changes in cost sharing for drugs. 

Response: We agree with the many 

comments that Part D claims data will 

be essential for research analyses 

involving the elderly and disabled, and 

for other public health functions. 

Comment: Two commenters suggested 

that CMS implement a tiered system of 

access to Part D claims data. 

Specifically, they suggested we establish 

separate tiers for accessing the data, 

taking into account the need for data 

and the opportunity for abuse, which 

mstockstill on PROD1PC66 with RULES2

30674 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

would correlate to the following groups: 

(1) Government agencies; (2) contractors 

and researchers under contract with 

CMS or another government agency; and 

(3) outside researchers. They suggest 

that Part D claims data be available to 

the above-listed entities within 

appropriate parameters, but not be 

available to entities, such as 

pharmaceutical manufacturers and 

others with strong proprietary interests. 

Response: We considered several 

alternatives to the Medicare A/B data 

release process including restricting: 

• Access to HHS agencies only, 

• Access to Federal Government 

agencies only, 

• Access to financial elements for 

outside researchers. 

We rejected these alternatives as too 

restrictive in light of the significant 

benefits to the Medicare program and 

the public’s health in making Medicare 

Parts A, B, and D linked data available, 

with protections, to Federal and State 

government agencies, and external 

entities. We believe that our approach, 

which incorporates the Medicare A/B 

minimum necessary data policy with 

additional restrictions to protect privacy 

and plan commercially sensitive 

information, strikes an appropriate 

balance between these significant health 

benefits and the concerns regarding the 

release of proprietary data and 

preserving beneficiary confidentiality. 

Moreover, we believe this process has 

sufficient protections to ensure 

compliance with the applicable laws 

and guard against the potential misuse 

of data. External entities requesting 

access to Part D claims data will have 

to enter into an agreement with us that 

includes provisions protecting the data 

from improper release. 

Our regulation at § 423.505(m), as 

well as the attached appendix provides 

additional guidance on the additional 

limitations that would apply to external 

entities (which would include CRS 

when not acting on behalf of a 

committee as an agent, but would not 

include States or other executive-branch 

Federal agencies) requesting Part D data. 

Cost data (consisting of ingredient cost, 

dispensing fee, and sales tax) could be 

released only in aggregated form. In 

addition, plan and other identifiers 

generally would be encrypted. 

We also intend to only release the 

minimum data necessary for a given 

project. Additionally, we also note that 

if an entity involved in a data release of 

electronic protected health information 

(EPHI) is a HIPAA-covered entity, the 

covered entity will have to comply with 

our HIPAA privacy and security 

standards. In addition, the covered 

entity should also follow the security 

guidance which was released in 

December 2006. The guidance reinforces 

our existing security standards to 

specifically address remote access and 

use of EPHI. This reinforcement of the 

HIPAA security standards, particularly 

related to data in transit, will further 

protect Part D claims data from 

inappropriate release, and therefore 

inappropriate use. For more information 

on this guidance, please log on to http:// 

www.cms.hhs.gov/SecurityStandard/. 

Comment: We requested comments on 

whether we should consider additional 

regulatory limitations for external 

researchers beyond our existing data use 

agreement protocols in order to further 

guard against the potential misuse of 

data for non-research purposes, 

commercial purposes, or to ensure that 

proprietary plan data or confidential 

beneficiary data are not released. In 

response, a number of commenters 

requested that CMS define the term 

‘‘commercial purposes’’ clearly and 

narrowly so that a broader range of 

entities would have access to the data, 

including pharmaceutical 

manufacturers, insurance companies, 

and pharmacy benefit managers. These 

commenters argue that instead of 

precluding certain types of entities from 

accessing Part D claims data, it would 

be better to focus on assuring researcher 

quality and integrity, and on ensuring 

that researchers adopt sound 

methodologies in conducting analyses. 

Therefore, the commenters request that 

the ‘‘clear bias’’ against pharmaceutical 

company supported research be 

removed from the CMS review criteria. 

As noted previously, other 

commenters suggested that the final 

regulation should deny access to data to 

organizations with strong proprietary 

interests, such as drug plan sponsors, 

pharmaceutical manufacturers, and 

other industry data collection entities 

that sell market research and sales data. 

Response: Under our current policies 

for Parts A and B data, we do not 

provide protected health information 

(PHI), as defined for purposes of HIPAA 

at 45 CFR 160.103, for commercial 

purposes, as we believe PHI should only 

be provided to entities conducting 

research that will result in generalizable 

knowledge in the public domain. We are 

concerned about the potential for 

conflicts of interest where commercial 

entities, whose primary purpose is not 

the creation of generalizable knowledge, 

might not publish results contrary to the 

firm’s financial interest. However, we 

do allow external researchers to be 

funded by commercial firms, including 

pharmaceutical manufacturers, 

insurance companies, and pharmacy 

benefit managers when the research will 

contribute to general knowledge in the 

public domain and the researchers are 

free to publish the results of the 

research regardless of the findings. We 

continue to believe that any findings 

based on beneficiary identifiable data 

released by us should be unbiased by 

commercial incentives and should be in 

the public domain. The criteria 

governing releases of protected health 

information (PHI) for research are 

designed to ensure that the HIPAA 

Privacy Rule’s requirements, as defined 

at 45 CFR 164.512(i), as well as our own 

policies are met. In this final rule, we 

use the definition of research contained 

in the HIPAA Privacy Rule, which 

defines the term as ‘‘a systematic 

investigation, including research 

development, testing and evaluation, 

designed to develop or contribute to 

generalizable knowledge’’ (45 CFR 

164.501). Thus, we do not release PHI 

to external entities when their research 

is not designed to develop or contribute 

to the generalizable knowledge. Nor do 

we release PHI to external entities for 

their commercial purposes or if they fail 

to demonstrate that they have a sound 

research methodology and that their 

research will produce findings relevant 

to the Medicare program and its 

beneficiaries. 

Therefore, we will continue to apply 

the same criteria in distinguishing 

between who may have access to data 

(researchers versus commercial 

interests), as we have been using for 

Parts A and B data. Because we intend 

to examine whether each proposed use 

of data meets the definition of research 

used under the HIPAA Privacy Rule, we 

will not be defining the term 

‘‘commercial purposes’’ in this 

regulation. 

Comment: We received several 

comments relating to the Freedom of 

Information Act (FOIA), noting that 

releases under FOIA should not include 

information that would be considered 

proprietary in nature. 

Response: If a FOIA request is 

received, we will follow our ordinary 

FOIA procedures and not release under 

FOIA data the agency determines are 

trade secrets, or commercial or financial 

information protected by FOIA 

Exemption 4 (5 U.S.C. 552(b)(4)). These 

procedures were explained more fully 

in the preamble to the Part D final rule, 

where, in response to a question about 

protecting bid information under FOIA 

we stated: 

[B]idders can always seek to protect their 

information under the Freedom of 

Information Act and label truly proprietary 

information ‘‘confidential’’ or ‘‘proprietary’’. 

When information is so labeled, the bidder is 

required to explain the applicability of the 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30675 

FOIA exemption they are claiming. When 

there is a request for information that is 

designated by the submitter as confidential or 

that could reasonably be considered exempt 

under Exemption 4, the Department is 

required by its FOIA regulation at 45 CFR 

§ 5.65(d) and by Executive Order 12,600 to 

give the submitter notice before the 

information is disclosed. To determine 

whether the submitter’s information is 

protected by Exemption 4, the submitter 

must show that (1) disclosure of the 

information is likely to impair the 

government’s ability to obtain necessary 

information in the future; (2) disclosure of 

the information is likely to cause substantial 

harm to the competitive position of the 

submitter; or (3) the records are considered 

valuable commodities in the marketplace 

which, once released through the FOIA, 

would result in a substantial loss of their 

market value. Consistent with our approach 

under the Part C program, we would not 

release information under the Part D program 

that would be considered proprietary in 

nature or that would tend to stifle the 

availability of discounts or rebates from 

pharmaceutical manufacturers negotiated by 

Part D plans. 

Bidders may identify trade secrets and 

confidential business information (CBI) with 

their submission. However, if they have not 

we will give them another chance when a 

FOIA request has been made on their records. 

In this case we will notify the business 

submitters that we are in receipt of FOIA 

requests for their records. We will then 

provide the business submitters with 

instructions and ask them to identify any 

trade secret or CBI in order to justify our 

application of Exemption 4. We will then 

review their justifications and highlighted 

information against FOIA case law to see if 

we can support their requested redactions. 

Under Executive Order 12600, if the business 

submitters disagree with our Exemption 4 

analysis (which includes their justification) 

of their identified trade secret or CBI, they 

are provided the opportunity to seek a 

restraining order or injunction in Federal 

court prohibiting us from releasing their 

records under FOIA. (70 FR 4294 through 

4295) 

Thus, for example, we do not expect 

that any pricing data included on the 

claim that fits within FOIA Exemption 

4 would be required to be released 

under FOIA. 

We also note that we do not view data 

releases made under the authority of the 

new § 423.505(m) as FOIA releases. 

Unlike FOIA releases, these releases are 

not required by law. Section 423.505(m) 

permits the release of data, but does not 

require it. 

Comment: A number of commenters 

underscored the importance of CMS 

making patient identifiers available in 

order to achieve the full potential of Part 

D data. One commenter stated 

prescription drug claims files by 

themselves lack the diagnostic, 

outcomes and other information to 

support the needed studies. However, 

when merged with other data, they can 

become a powerful tool for improving 

the public health. Reflecting the views 

of several other commenters, the 

commenter noted that Part D claims 

data could be linked to several other 

data sets such as: death and birth 

certificate files; nursing homes 

Minimum Data Set; home health care 

Outcome and Assessment Information 

Set files; disease registries such as the 

Surveillance, Epidemiology, and End 

Results-Medicare dataset developed by 

the National Cancer Institute to study 

outcomes of cancer therapies; 

geographical data on characteristics and 

health care resources of communities; 

information on characteristics of 

providers (for example, use of primary 

medical care versus specialty care); and 

Medicaid data on health care encounters 

and services not covered by Medicare. 

The commenter emphasized that linking 

Part D data to the above information is 

essential in order to provide accurate 

accounting for outcomes and to best 

address the many scientific pitfalls and 

potential threats to validity that emerge 

when one moves from experimental to 

observational studies, such as 

unobserved variable bias and 

confounding by indication or counterindication. 

Another commenter stated that 

linkage of the Part D data to populationbased surveys would provide invaluable 

sources for epidemiologic, health 

services and policy analyses and enable 

investigations into prevalence of 

diseases, their risk factors, progression, 

and trends in treatment and drug use. 

Response: We agree these data are 

more powerful when linked with other 

data sets. Linkage to Medicare Parts A 

and B data is essential for 

understanding the impact of the Part D 

benefit on use of other Medicare 

services. There are a host of other types 

of research studies that could not be 

completed without linked data. These 

include: studies examining the impact 

of changes in benefit structure on 

patient outcomes, research into the 

relative effectiveness of pharmacologic 

therapies or medication therapy 

management interventions, and 

pharmacovigilence studies. In many 

cases, Part A/B linked data provided 

through our chronic condition 

warehouse with encrypted identifiers 

will be sufficient to accomplish the 

research. In cases where beneficiary 

identifiers are essential for linkage with 

non-Medicare data bases, such as the 

National Center for Health Statistics 

Surveys, beneficiary-identifiable data 

may be released, but will be subject to 

the Privacy Act and HIPAA data 

security and privacy requirements 

consistent with those we require in our 

data release policies for identifiable Part 

A/B data. These requirements include a 

CMS Privacy Board review/approval, 

submission of a Data Use Agreement, 

and the justification of minimum data 

necessary to carry out the project. If the 

data is going to be linked to data 

collected under another federally 

funded study, the requestor must also 

secure the Federal project officer’s 

concurrence and an Institutional Review 

Board (IRB) approval. 

Comment: A few commenters were 

concerned that CMS had not adequately 

addressed the implications of expanding 

access to physician and patient 

information. They recommended that 

we specify more clearly the conditions 

under which physician data can be 

collected and used in performance 

programs, research studies, and 

demonstration projects, noting that 

revealing physician identification 

information will enable pharmaceutical 

companies and others to influence 

physicians’ prescribing patterns and 

interfere with a physician’s professional 

judgment. 

Response: We believe that an 

encrypted version of the physician 

identifier, which will allow for the 

linkage of all of a physician’s claims 

without divulging the physician’s 

identity, will meet the needs of most 

researchers. Accordingly, we will 

evaluate research requests for physician 

identifiers (for example, that could be 

used to link Medicare data at the 

physician level to other datasets) on a 

case-by-case basis and will only 

consider providing them if necessary for 

the study under our minimum data 

necessary policy and permitted under 

applicable law. In addition, we will 

continue our current practice of not 

providing identifiable data for 

commercial purposes. This limitation 

should address the concern regarding 

pharmaceutical company interference 

with medical practice. 

In addition to releasing physician 

identifiers in response to certain 

research requests, we anticipate 

releasing physician identifiers to States, 

and pilot and demonstration projects, as 

the ability to link all of a physician’s 

claims may be necessary for care 

coordination and disease management 

purposes. Physician identifiers may also 

be used by or released to other 

government agencies or contractors, as 

part of populating personal health 

records, so that beneficiaries will have 

a record of who prescribed their drugs. 

Finally, we anticipate that they may be 

used in connection with or released to 

support the Secretary’s Value-driven 

Health Care initiative which seeks to 

mstockstill on PROD1PC66 with RULES2

30676 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

improve the quality and efficiency of 

health care delivery by making 

performance measurement information 

available to better support provider and 

consumer health care decision-making. 

One of the goals of the Secretary’s 

Value-driven Health Care Initiative is to 

promote public reporting of 

performance measurement results at the 

provider and physician level that may 

be based on public sector claims, private 

sector claims, and other data in order to 

enable providers, including physicians, 

and consumers to make informed health 

care decisions. We envision using the 

claims data to develop provider and 

physician-level performance 

measurement results. 

Comment: A commenter supported 

CMS’s use of Part D data to manage cost 

and clinical quality and argued that 

providing external parties access to 

linked physician identifiable claims in 

order to pool them with employer data 

would allow analysis to reduce the cost 

of care delivery and improve the quality 

of care. The commenter stated that 

increasing transparency of care in the 

outpatient sector is critical and that 

protecting physicians from oversight 

cannot continue. 

Response: We are undertaking a 

variety of pay for performance and 

value-based health care initiatives in an 

effort to encourage health care providers 

to furnish high quality health care and 

in order to provide cost and quality 

information to consumers. We intend to 

use the Part D claims data in these 

activities. Similarly, other Federal 

executive branch agencies (and their 

contractors) will have access to 

physician identifiers, if appropriate. We 

are working with external stakeholders, 

including multi-stakeholder coalitions 

that represent providers, consumers, 

employers, and health plans, regarding 

how to pool Medicare data with private 

data for analysis and how to make the 

results available to the public. As these 

plans mature, more information will be 

shared with the public. 

Comment: While many commenters 

supported the use of Part D claims data 

for detecting and analyzing unintended 

risks and benefits of medications, they 

also noted the limitations of claimsbased research for answering questions 

about the comparative efficacy and 

safety of drugs. The commenters 

asserted that claims-based outcomes 

research, such as with Part D claims 

data, can reveal correlations between 

variables or events, but is often not 

sufficient to establish causation. They 

offered specific suggestions such as 

holding researchers to high 

methodological and ethical standards, 

creating study panels of qualified 

external stakeholder experts to review 

research protocols, and encouraging 

CMS to conduct an open and 

transparent process that will allow for 

external verification and replication of 

CMS’s sponsored analyses. 

Response: We are well aware of the 

limitations involving retrospective, 

claims-based research. Our current data 

release policies for Parts A and B data 

for externally-funded research require 

that a requestor submit a detailed 

proposed research protocol. We review 

these proposals for the legitimacy and 

feasibility of the research, the strength 

of the proposed methods for guarding 

the privacy of the data, and the 

appropriateness of the research 

methods. Research requests for Part D 

claims data would be subject to the 

same type of review. 

Comment: Some commenters suggest 

that CMS make available the number of 

external requests it receives for claims 

data, the manner in which the agency 

responds to those requests, the 

timeliness of the approval process, and 

any fees charged for various types of 

data. They also believe that CMS should 

describe the Federal priorities for 

government-sponsored research using 

Medicare Part D claims data, and 

provide for public notice and comment 

on proposals based on processes already 

established by Agency for Health 

Research and Quality (AHRQ). 

Response: We already maintain data 

on the number of external research 

requests for our claims data, whether 

the request was approved, the 

timeliness of the approval process, and 

any fees charged for various types of 

data. We can make this information 

available to the public, upon request, 

and will explore posting it on our Web 

site. 

We do not believe we should establish 

Federal priorities for research using Part 

D claims data, just as we do not 

establish priorities for research using 

Medicare Parts A and B data. Much of 

our research agenda is determined by 

directives from the Congress for 

research studies, demonstrations and 

their evaluation. Accordingly, a public 

comment process on CMS-sponsored 

research is not necessarily feasible. 

However, other Federal government 

executive branch agencies that are likely 

to sponsor comparative effectiveness or 

safety research using Part D claims data, 

such as AHRQ, do have such prioritysetting processes in place. We believe 

these processes are adequate to address 

the commenters’ concerns. 

Comment: A few commenters 

suggested that we make available Part D 

claims data to State Medicaid directors 

for the purpose of monitoring and 

researching the dual eligible population. 

The commenters suggested we provide 

States with access to the drug utilization 

and spending data collected by the 

Medicare Part D prescription drug 

plans, as well as other data necessary for 

states to effectively coordinate the care 

of dual eligibles. 

Response: We believe that States may 

improve their disease management and 

other care coordination programs by 

examining utilization data of dual 

eligibles extracted from Part D claims. In 

this final rule, we have clarified that we 

will be permitted to use collected Part 

D claims data for care coordination and 

disease management purposes. Under 

§ 423.505(m), we may release collected 

Part D claims data to States, consistent 

with our minimum data necessary 

policy, our data sharing procedures, 

applicable laws, and subject to 

encryption of certain identifiers and 

aggregation of cost data. We plan to 

explore the operational issues 

associated with such an exchange. As a 

result, we believe States will have 

appropriate access to Part D claims data 

for purposes of coordinating the care of 

dual eligible beneficiaries. Please see 

§ 423.505(m), as well as the appendix to 

this final rule for additional explanation 

of how we would determine the data 

that would be released to States. 

Comment: Commenters requested 

further discussion on the types of 

entities to which collected Part D claims 

data will be released. A commenter also 

contends that the recipients of data 

could share the data with third parties 

of their choice. 

Response: Identifiable data are not 

released to all external requesters. 

Currently, for Parts A and B data, 

external researchers must request the 

identifiable data from us. Our privacy 

board reviews the request for 

beneficiary identifiable data to 

determine if the request is for an 

appropriate research purpose, whether 

the Privacy Rule’s criteria are met, and 

that the request is consistent with our 

data release policies. Our data release 

policies do not allow us to release 

identifiable data for marketing or 

commercial purposes. Further, we do 

not approve requests from for-profit 

organizations or organizations that 

could profit from a study, although we 

do produce databases with identifiers 

stripped, as well as public use files, for 

any organization to use. We also have 

requirements for release of Parts A and 

B data to other Federal governmental 

entities and contractors for purposes not 

related to research. Generally, we use 

DUAs to track the disclosure of 

personally identifiable data to such 

entities. Under our data sharing 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30677 

policies, we generally require the 

requester not to disclose the data to 

third parties without specific written 

authorization from us. The release of 

data must also be permissible under the 

Privacy Act, the HIPAA Privacy Rule, 

the Trade Secrets Act, and any other 

applicable laws. 

Comment: A commenter 

recommended that CMS include a 

requirement that the recipient obtain a 

certification of confidentiality for all 

identifiable CMS data covered by the 

agreement or other data within the 

scope of the research project to protect 

researchers when compelled to release 

protected data. 

Response: Under section 301(d) of the 

Public Health Service Act (42 U.S.C. 

241(d)) the Secretary of Health and 

Human Services may authorize persons 

engaged in biomedical, behavioral, 

clinical, or other research to protect the 

privacy of individuals who are the 

subjects of that research. This authority 

has been delegated to the National 

Institutes of Health (NIH). Certificates of 

confidentiality are issued to protect 

identifiable research information from 

forced disclosure. Certificates of 

confidentiality may be appropriate for 

research that combines the direct study 

of human subjects with the use of 

identifiable Part D data. They allow the 

investigator and others who have access 

to research records to refuse to disclose 

identifying information on research 

participants in any civil, criminal, 

administrative, legislative, or other 

proceeding, whether at the Federal, 

State, or local level. Certificates of 

confidentiality may be granted for 

studies collecting information that, if 

disclosed, could have adverse 

consequences for subjects or damage 

their financial standing, employability, 

insurability, or reputation. By protecting 

researchers and institutions from being 

compelled to disclose information that 

would identify research subjects, 

certificates of confidentiality help 

achieve the research objectives and 

promote participation in studies by 

assuring confidentiality and privacy to 

participants. The Department would 

encourage researchers to explore with 

their institutional review boards or 

other knowledgeable experts the use of 

certificates of confidentiality where 

appropriate. If a researcher has obtained 

a certificate of confidentiality for a 

human subjects study, its protection 

would extend to all individually 

identifiable data on the research 

subjects in that study (including Part D 

data.) maintained in the research 

records. Additional information about 

certificates of confidentiality is available 

on our Web site at http:// 

grants2.nih.gov/grants/policy/coc/. 

Comment: Several commenters stated 

their concern that the proposal would 

run afoul of Federal confidentiality 

protections for substance abuse laws 

such as 42 CFR Part 2. 

Response: As the commenter notes, 

regulations at 42 CFR Part 2 

‘‘Confidentiality of Alcohol and Drug 

Abuse Patient Records,’’ establish 

restrictions on the disclosure and use of 

alcohol and drug abuse patient records 

that are maintained in connection with 

the performance of any Federallyassisted alcohol and drug abuse 

program. These regulations limit 

disclosures of any patient-identifying 

information acquired by a Federallyassisted facility that provides alcohol or 

drug abuse diagnosis, treatment, or 

referral for treatment. We will work 

with Part D sponsors to ensure that 

these specifically protected claims are 

not redisclosed for purposes other than 

payment. One option that we plan to 

explore to comply with these 

regulations is to identify a set of drugs 

which are used for the treatment of 

alcohol and substance abuse (that is, 

Anatabuse and Vivtrol) and exclude 

associated PDEs for these drugs from 

any sample of PDEs used for purposes 

other than carrying out section 1860D–

15 of the Act (that is, for nonpayment 

purposes). 

Comment: We received a number of 

comments on how the rule will be 

implemented. Commenters requested 

that CMS ensure that: Part D claims data 

file formats are consistent with other 

CMS data files; limited data sets (LDS) 

be available linking Medicare Parts A, B 

and D data; and files be in a clean 

format that is sufficiently detailed and 

secure. Other commenters requested 

that Part D claims data be made 

available in a linkable format that 

includes details of prescriptions by 

patient, time, and location, in order to 

address the shortcomings in the current 

management of chronic diseases. 

Response: We do not believe that the 

detailed formatting standards requested 

by the commenters are an appropriate 

subject of this final rule. However, we 

recognize the need to ensure 

appropriate security of data, and will 

apply the processes and procedures 

regarding the transmission and storage 

of data currently in place to protect 

Parts A and B data to Part D claims data. 

We also note that linked data files will 

contain both a patient’s chronic 

conditions and detailed information 

regarding prescriptions. 

Comment: Several commenters 

recommended that CMS consider 

developing and releasing a summary file 

that parallels the current Physician 

Supplier Procedure Summary Master 

file along with a 5 percent sample 

standard analytical file. One commenter 

asked that both LDS files and Research 

Identifiable files be available and asked 

for clarification of the file types 

available from the CCW. 

Response: As stated, we do not 

believe that detailed formatting 

standards are the subject of this final 

rule. We also note that both LDS files 

and research identifiable files are 

available from the CCW. We anticipate 

filling most research requests for Part D 

claims data using LDS files available 

from the CCW or from other places. 

Comment: One commenter questioned 

how plan sponsors are to comply with 

applicable State privacy laws that may 

preclude disclosure of medical 

information for one or more of the 

purposes listed in the proposed 

regulatory text. The commenter 

requested that CMS explain whether 

any such conflicting state law 

prohibitions would be preempted by the 

proposed regulation, notwithstanding 

that § 423.136 of the regulations states 

that state confidentiality and disclosure 

laws are not preempted. 

Response: Part D sponsors should 

comply with all applicable Federal and 

state confidentiality and disclosure laws 

when not directly conflicting. Part D 

regulations specifically require 

prescription drug plans to comply with 

these laws. If there is a belief that a 

particular State law is in direct conflict 

with our Federal requirements, plan 

sponsors should bring those specific 

cases to our attention for individual 

review. 

Comment: One commenter contended 

that CMS can share Part D claims data 

freely with its contractors, who may also 

be researchers, under section 1860D–15 

of the Act. 

Response: Section 1860D–15 of the 

Act only relates to disclosures necessary 

to carry out that section, which would 

permit sharing of Part D data with 

contractors only for payment purposes. 

This regulation, which is established 

under the authority of section 1860D–12 

of the Act, would permit us to collect 

the original 37 PDE elements 

comprising the Part D claims data for 

nonpayment-related purposes, and 

allow the agency and its contractors to 

use them for nonpayment-related 

purposes (section 1874 of the Act 

permits the Secretary to perform his 

functions by contract). 

Comment: A commenter contends 

that it is impossible to assess the intent 

of CMS without the ability to review the 

system of record notice for data 

collected under Part D. The commenter 

mstockstill on PROD1PC66 with RULES2

30678 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

wants CMS to republish the proposed 

rule along with the applicable system of 

records notice. 

Response: We believe the proposed 

rule contained enough information for 

interested parties to assess our intent. 

We plan to publish a revised system of 

records notice shortly to ensure that the 

regulation and its system of records are 

effective as close to the same time as 

possible. 

Comment: One commenter stated 

CMS should complete a Privacy Impact 

Assessment (‘‘PIA’’). 

Response: We annually update all 

appropriate PIAs. Accordingly, we will 

be updating the Drug Data Processing 

System PIA every year. 

Comment: A commenter 

recommended that the subjects of any 

data disclosed to a third party be parties 

to CMS’s data use agreement, so that 

they may seek relief for a breach of the 

agreement. 

Response: The format and procedures 

for our data sharing agreements are not 

strictly within the scope of this final 

rule. Moreover, we do not believe the 

commenter’s recommendation would be 

advisable because it may significantly 

hamper the ability of researchers to 

perform the activities that benefit the 

public’s health under this rule. 

Researchers may ultimately expend an 

enormous amount of resources 

responding to third party claims. 

However, we do note that signatories of 

our data use agreements can be 

sanctioned if they violate the agreement 

or Federal law. 

Comment: We received several 

comments suggesting that we establish a 

process for reviewing research requests 

based on a ‘first in, first reviewed’

process. 

Response: The internal procedures we 

use in reviewing requests for data are 

not strictly within the scope of this final 

rule, as the proposed rule did not make 

recommendations related to our datasharing process. However, we do plan to 

continue the practice of giving 

government agencies first preference in 

the review process, and to require that 

such agencies abide by our data sharing 

procedures, which generally require a 

data sharing agreement. 

External research requests are usually 

reviewed in the month they are received 

with the exception of time sensitive 

research requests, which may be 

considered in an expedited manner, at 

our discretion. Because we expect a 

large volume of requests, there may be 

a delay between when a request is 

received, reviewed, and approved or 

denied. As we do currently with Parts 

A and B data requests, we will continue 

to carefully consider each research 

request with a review process that 

emphasizes compliance with applicable 

laws, including those governing the 

protection of privacy, first, followed by 

legitimacy of the requested study, and 

the requestor’s expertise. 

D. Beneficiary Access to Part D Claims 

Data 

The proposed rule stated that we were 

considering the use of Part D claims 

data for projects involving the 

development or population of 

personalized health records, which 

include beneficiary medication history, 

which would be accessible by Medicare 

beneficiaries or their providers after the 

beneficiary consents to such a release. 

We requested comments on this 

proposed use of Part D claims data 

collected under the authority of section 

1860D–12(b)(3)(D) of the Act. 

In this final rule, after considering the 

comments received, we are expanding 

the use of the collected Part D claims 

data so that we may authorize the use 

and release of these data to government 

contractors or external entities for the 

population of personal health records. 

Comment: Generally, commenters 

encouraged CMS to pursue projects of 

this nature, with one commenter in 

particular noting that the personalized 

medication history record could be 

linked to the MyMedicare.gov Web site 

and could include links to a 

beneficiary’s Part D plan, its formulary, 

and the plan’s instructions for prior 

authorization requests. 

A few commenters requested more 

detail regarding the development of 

PHRs, the protection of beneficiary 

health information, and the Web-based 

standards (that is, record security, 

record retrieval, browser compatibility, 

etc.) underlying the display of PHRs. 

They suggested that we use a 

transparent, public process for 

developing these ideas and allowing for 

public comments. One commenter 

referenced the URAC (the organization 

formerly known as the Utilization 

Review Accreditation Commission) 

standards for Web-based clinical 

content and another, the Medicare pilot 

demonstration project conducted by the 

United Mine Workers Health and 

Retirement Fund as a model of a project. 

Response: Currently, we are 

conducting pilot projects and studies on 

personal health records that include the 

disclosure of hospital and provider 

claims data (Part A and Part B) to 

populate beneficiaries’ PHRs. However, 

until this rule is effective, we cannot 

include Part D claims data in these 

projects. When we have authority to 

disclose Part D claims data, we will 

provide the Part D claims data to 

populate PHRs only upon the 

authorization of the beneficiary. We 

require our partners in PHR pilots and 

studies to agree to strict privacy and 

security safeguards whenever receiving, 

using or disclosing beneficiary data. The 

pilots and studies are intended, in part, 

to help inform us in developing privacy 

rules and security arrangements that 

would be appropriate for a program of 

ongoing disclosures to populate and 

update the PHRs, as authorized by 

beneficiaries. 

In the area of health information 

technology, the Department has a 

history of developing policy in a 

collaborative, open, and transparent 

manner. In addition to obtaining public 

comment through notice in the Federal 

Register, such as this, the Department 

relies on its public advisory committees, 

relationships with industry, and 

participation in professional 

associations in developing policies and 

procedures with respect to the emerging 

health information environment. With 

regard to PHRs, the information we 

gather through this process will also 

help us determine future steps. 

Comment: Several commenters stated 

that beneficiary participation in such 

projects should not be mandatory, but 

voluntary. 

Response: We expect that any 

program we plan to undertake to make 

collected Part D claims data available to 

beneficiaries would be voluntary on the 

part of beneficiaries. 

Comment: A commenter noted that 

beneficiaries already have the right to 

request access to, inspect, and copy 

their medication histories and other 

PHI. 

Response: We appreciate the 

commenter’s statements that 

beneficiaries already have access to 

their medical records, but believe that a 

centralized PHR that is easily accessible 

from a Web site, and that includes a 

more comprehensive set of data from 

multiple providers and prescribers, 

would be of use to beneficiaries. 

Comment: A commenter urged CMS 

to establish procedures where the data 

will be automatically available to other 

health care practitioners and 

institutions. The commenter stated that 

a beneficiary may be unable to release 

the record due to being unconscious or 

confused. Finally, the commenter noted 

reasons why, under Parts A and B, the 

personalized EHR is necessary, 

including the value of having a 

complete record in an emergency room 

situation and in instances when a 

physician administers medications 

incident to a physician visit. 

Response: Any PHI that CMS releases 

to providers or institutions would be 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30679 

authorized by the beneficiary or the 

beneficiary’s authorized representative 

or would be otherwise permitted or 

required under the applicable laws and 

our policies. Moreover, we note that 

health care providers are not necessarily 

the intended users of PHR; rather, they 

are intended for use by the patient. We 

believe it more likely that emergency 

room and other health care providers 

would have access to patient’s 

medication history from another source. 

Comment: One commenter noted that 

Part D claims data may be of limited 

value in creating a PHR. 

Response: We believe that access to 

medication history information, even of 

limited scope, is deemed one of the top 

priorities by emergency responders, 

emergency room personnel and 

physicians, in discussions regarding 

electronic PHRs. 

Comment: A commenter noted that 

PHR information shared with entities 

other than the beneficiary should only 

be released in an aggregated format 

without any physician identifiers. 

Response: We requested comments on 

the usefulness of creating a personalized 

beneficiary medication history record 

from the Part D claims data. We are 

uncertain as to why the commenter 

believes it would only be appropriate 

for physician information to be released 

at the aggregate level since the purpose 

of PHRs is to allow individuals and 

their providers to have access to 

information to improve the quality and 

delivery of care to the individual. Any 

sharing of this data with organizations 

that assist beneficiaries in developing 

their own PHR would need to be 

authorized by the individual to whom 

the record pertains, just as the 

individual would provide authorization 

for release of any other of his or her 

personal data held by Medicare. 

E. Applicability 

We stated in the proposed rule that 

the proposed revision does not affect the 

applicability of HIPAA to the DHHS or 

any other appropriate parties, nor does 

it affect the applicability of the Privacy 

Act (5 U.S.C. 552a) or the Trade Secrets 

Act (18 U.S.C. 1905). Thus, Part D 

claims data, like any personally 

identifiable information or PHI collected 

by the agency, are subject to protection 

under the HIPAA Privacy Rule, the 

Privacy Act and the Trade Secrets Act, 

and other laws, as applicable. In this 

final rule, we continue to take this 

position. 

Comment: One commenter stated that 

the proposed rule does not explain why 

HIPAA does not apply to Part D 

activities when HIPAA does apply to 

CMS activities for Parts A and B of 

Medicare. 

Response: The HIPAA Privacy Rule 

applies to covered entities and defines 

the term ‘‘covered entity’’ as (1) a health 

plan, (2) a health care clearinghouse, or 

(3) a health care provider who transmits 

any health information in electronic 

form in connection with a covered 

transaction. (See 45 CFR 160.103.) 

HIPAA defines ‘‘health plan’’ as an 

individual or group plan that provides, 

or pays the cost of medical care, and 

specifically includes Part A and Part B 

of the Medicare program under title 

XVIII. (See section 1171(5) of the Act 

and 45 CFR 160.103 (definition of 

health plan).) With respect to Part D, 

because Part D sponsors meet the 

definition of health plan, they are 

covered entities subject to HIPAA. 

HIPAA does not apply to the component 

of CMS that administers the Part D 

program because it is does not pay 

claims directly. However, although Part 

D claims information held by this 

component is not directly subject to 

HIPAA, the Part D data are protected 

under the Privacy Act of 1974, which 

applies to all federal agencies’ data 

collections of individually identifiable 

information in systems of records. The 

Privacy Act requires that CMS maintain 

Part D data in a protected system of 

records and may only use or disclose 

the data in accordance with the specific 

purposes which have been published in 

the Federal Register and with other uses 

and disclosures allowed by the Privacy 

Act, itself. See 5 U.S.C. 552a(b) and 

(e)(4). 

This rule will allow the Secretary to 

use the original 37 PDE elements that 

are being collected for Part D payment 

purposes for reporting to the Congress 

and the public, conducting evaluations 

of the overall Medicare program, making 

legislative proposals to Congress, and 

conducting demonstration projects. To 

the extent that such information 

becomes part of our administration of 

the Medicare Part A and Part B 

programs, HIPAA will apply to such 

information. Moreover, although Part D 

claims information held by the 

component of CMS that administers the 

Part D program are not directly subject 

to HIPAA, we are choosing to comply 

with HIPAA’s limitations on the use and 

disclosure of PHI to ensure that 

beneficiaries’ privacy interests are fully 

protected. In addition, we are choosing 

to impose standards similar to those 

applied when we release beneficiary 

identifiable information with respect to 

non-beneficiary identifiable Part D data, 

on the PDE, such as plan, prescriber, 

and pharmacy identifiable data. 

Comment: One commenter noted that 

many plan sponsors already share data 

with agencies such as the FDA, NIH, 

and AHRQ, and external entities subject 

to HIPAA, therefore there is no need for 

this rulemaking. 

Response: While plan sponsors may 

already share data with agencies such as 

FDA, NIH, and AHRQ, only CMS can 

share Part D claims data linked to 

Medicare Parts A and B data. Therefore, 

we maintain that this rulemaking is 

necessary. 

Comment: Some commenters 

expressed concern with CMS’ use of 

data use agreements. They asked that 

CMS explain the steps we will 

undertake to ensure the confidentiality 

of individually identifiable beneficiary 

data. 

Response: In response to the 

commenter’s concerns about CMS’

reliance on data use agreements (DUAs), 

we administer DUAs for any data 

disclosures to external entities, 

including limited data sets that exclude 

certain personal identifiers. The DUA is 

a way to ensure that the data provided 

are only used for the purposes for which 

the data were disclosed. All external 

requests for personally identifiable data 

for research are subject to CMS’ Privacy 

Board review and approval. 

Currently, for Parts A and B data, 

CMS restricts data releases to the 

minimum amount of information 

necessary for the requestor’s specific 

research project. We intend to operate 

on the same basis, with some additional 

restrictions to protect privacy and 

commercially sensitive information as 

described our regulations at 

§ 423.505(m) as well as in the appendix 

to this final rule, with respect to the 

release of collected Part D claims data. 

We anticipate that we will be able to 

satisfy many requests for Part D claims 

data using limited data sets, which 

exclude certain personal identifiers. 

Comment: A commenter was 

concerned with the release of prescriber 

identifiers, believing that the release of 

such data could be used to target 

marketing efforts and otherwise 

improperly affect a prescriber’s 

judgment. 

Response: As explained previously in 

section II.B. of this final rule, we expect 

that the results of the Secretary’s quality 

improvement and performance 

measurement initiatives may be made 

public in an effort to financially reward 

health care providers who provide high 

quality health care and to provide cost 

and quality information to consumers. 

Beyond that, we will encrypt prescriber 

identifiers as a general matter with 

limited exceptions (see 42 CFR 

423.505(m), as well as the appendix to 

mstockstill on PROD1PC66 with RULES2

30680 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

this final rule). Additionally, we will 

not release Part D claims information for 

commercial purposes. 

Comment: A commenter contended 

that for a HIPAA-covered entity the 

proposed rule will impose a substantial 

compliance burden and monetary costs 

to transform each prescription drug 

claim that a plan sponsor submits for 

payment purposes into an accountable 

disclosure that the plan sponsor would 

need to track in order to fulfill its 

accounting of disclosures obligations 

under the HIPAA Privacy Rule. The 

commenter also stated that the proposal 

may burden plan sponsors by possibly 

requiring many to distribute revised 

notices of privacy practices, which may 

cause beneficiary confusion. The 

commenter states that CMS should be 

precluded from implementing the 

proposed rule except at the beginning of 

a calendar year. 

Response: Regularly, laws and 

regulations intersect or overlap, and 

individuals and entities are required to 

dissect the application of such laws and 

regulations, as appropriate. This rule 

does not regulate how covered entities, 

subject to HIPAA compliance, must 

comply with the HIPAA Privacy Rule, 

nor was it intended to do so. As a 

general matter, Part D plan sponsors are 

subject to a wide range of Federal laws 

and regulations, including HIPAA, and 

in this instance there may be an 

intersection between such laws and 

regulations that requires analysis and 

consideration. As we noted in the 

preamble to the proposed rule, nothing 

in this final rule affects the applicability 

of HIPAA (or the Privacy Act) to the 

DHHS or any other appropriate parties. 

Since the proposed rule did state that 

it did not affect the applicability of 

HIPAA, we believe a brief discussion of 

the intersection between this rule and 

existing HIPAA rules is warranted. 

However, it is important to note that the 

Office for Civil Rights (OCR) is the only 

agency within DHHS that can provide 

advice on and enforce the HIPAA 

Privacy Rule. Affected entities can 

obtain comprehensive information 

regarding the HIPAA Privacy Rule, 

including answers to frequently asked 

questions and information on the 

enforcement program, at http:// 

www.hhs.gov/ocr/hipaa/. 

With this in mind, we believe that 

private plans are permitted by the 

HIPAA Privacy Rule to make the 

disclosures provided for in this Rule. 

The HIPAA Privacy rule permits 

disclosures for health oversight and as 

required by law. See 45 CFR 164.512(a) 

and 164.512(d). We are not suggesting 

that the HIPAA definition of ‘‘required 

by law’’ at 45 CFR 164.103 encompasses 

contractual requirements. Rather, we 

believe those disclosures required by 

contract, which are also mandated by 

statute or regulation or both, would be 

‘‘required by law’’ under the HIPAA 

Privacy Rule. 

As noted previously above, plans 

disclosing data under this rule may face 

HIPAA compliance issues regarding 

accounting and Notice of Privacy 

Practices. We believe that most Part D 

plans very likely have a statement in 

their existing Notices of Privacy 

Practices that notifies enrollees of 

permitted disclosures for purposes of 

health oversight and as required by law, 

and therefore, are unlikely to have to 

modify their notices of privacy 

practices. 

An individual also has the right under 

the HIPAA Privacy Rule to receive an 

accounting of certain disclosures, 

including disclosures for health 

oversight purposes or disclosures 

required by law. It is each plan’s 

responsibility to comply with the 

HIPAA Privacy Rule as it deems 

appropriate. 

Finally, we do not believe that any 

further delay in the effective date for 

this regulation is required. We believe 

the commenters are referencing the 

prohibition on mid-year significant 

regulatory requirements at 42 CFR 

423.516. However, that regulation does 

not apply to already-existing 

regulations, such as HIPAA regulations, 

or the impact already-existing 

regulations will have on a new Part D 

regulation. Because we already collect 

Part D claims data, this regulation does 

not impose additional Part D 

requirements on Part D sponsors, and 

therefore, we do not view this regulation 

as constituting a significant midyear 

change for Part D sponsors. 

Comment: The commenter also 

questioned how CMS would notify 

beneficiaries that their data may be 

released for research purposes. 

Response: As a general matter, how 

we comply with our own HIPAA 

obligations is outside the scope of the 

proposed rule. To the extent HIPAA 

requires us to take any additional steps 

(including additional notification 

responsibilities) to ensure full 

compliance with HIPAA, we intend to 

do so. For instance, a covered entity is 

required to include in its notice of 

privacy practices a statement that PHI 

may be used for research purposes. 

CMS, as a covered entity for Medicare 

Parts A and B, currently provides such 

notice to beneficiaries annually. 

Comment: Several commenters 

requested that CMS discuss the 

regulation in light of the Trade Secrets 

Act, specifically with respect to pricing 

data. 

Response: Because our regulations at 

42 CFR 423.505(f), (l), and (m) are 

issued under the authority of section 

1106 of the Act, any release of 

potentially proprietary data under these 

regulations would also be authorized by 

law under the Trade Secrets Act. As we 

have stated elsewhere in this preamble, 

we believe that our minimum data 

necessary policy with some additional 

restrictions to protect privacy and plan 

commercially sensitive information and 

our data sharing procedures will guard 

against any potential misuse or 

inappropriate disclosure of Part D 

claims data. 

F. Limitations 

This final rule in no way affects or 

limits our existing ability to collect nonpayment data such as enrollment, 

formulary, price comparison, quality 

assurance and utilization review data. In 

such cases, even where the data 

collection is not specifically mandated 

by statute, we do not believe it is 

necessary to resolve any statutory 

ambiguity, because section 1860D–15 of 

the Act would not apply. 

In addition, it is important to note 

that this rule applies when collections 

of data occur under section 1860D–12 of 

the Act. The rule does not address 

collections that occur under other 

provisions of law. Thus, this rule also 

does not address uses or disclosures 

already permitted under section 1860D–

15 of the Act, to carry out audits and 

evaluations necessary to ensure accurate 

and correct payment and to otherwise 

oversee Medicare reimbursement under 

Part D. These uses are already 

contemplated under both the statute and 

the regulations at § 423.322(b). 

Furthermore, section 1860D–15 of the 

Act and § 423.322(b) of our regulations 

do not limit the ability of OIG to access, 

use, or disclose Part D claims data as 

part of the Inspector General’s statutory 

responsibilities to oversee the Medicare 

program. 

III. Provisions of the Final Regulations 

This final rule finalizes most of the 

provisions of the proposed rule. Those 

provisions of this final rule that differ 

from the proposed rule are as follows: 

• In part 423, adding section 1106 of 

the Act to the authority citation. 

• In § 423.1, adding section 1106 of 

the Act. 

• In § 423.505, making the following 

changes: 

++ Revising paragraph (f)(3) to clarify 

that the regulatory provision is only 

applicable to Part D claims data and is 

limited to the original 37 elements 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30681 

reported on the PDE record; to add a 

reference to pilot projects, and to add 

care coordination and disease 

management activities, quality 

improvement and performance 

measurement activities, and the 

populating of personal health records to 

the list of necessary and appropriate 

purposes for the collection of this 

information. This list is not intended to 

be exclusive, and Part D claims data 

may be collected for other purposes that 

the Secretary deems necessary and 

appropriate. 

++ Removing paragraph (f)(5) and 

incorporating the provisions of this 

paragraph in paragraphs (l) and (m). 

++ Adding a new paragraph (l) to 

specify that CMS may use the data 

collected under § 423.505(f)(3). 

++ Adding a new paragraph (m) to 

specify that CMS may release the 

minimum data collected under 

§ 423.505(f)(3) in accordance with 

applicable Federal laws, our established 

data sharing procedures, and subject to 

encryption of certain identifiers and 

aggregation of cost data to protect 

beneficiary confidentiality and 

commercially sensitive data of Part D 

sponsors. 

IV. Collection of Information 

Requirements 

Under the Paperwork Reduction Act 

of 1995, we are required to provide 30- 

day notice in the Federal Register and 

solicit public comment before a 

collection of information requirement is 

submitted to the Office of Management 

and Budget (OMB) for review and 

approval. In order to fairly evaluate 

whether an information collection 

should be approved by OMB, section 

3506(c)(2)(A) of the Paperwork 

Reduction Act of 1995 requires that we 

solicit comment on the following issues: 

• The need for the information 

collection and its usefulness in carrying 

out the proper functions of our agency. 

• The accuracy of our estimate of the 

information collection burden. 

• The quality, utility, and clarity of 

the information to be collected. 

• Recommendations to minimize the 

information collection burden on the 

affected public, including automated 

collection techniques. 

This document does not impose new 

information collection requirements on 

Medicare Part D plans. Medicare Part D 

plan sponsors already submit the 

information required to conduct the 

studies discussed earlier in the 

preamble of this document. Medicare 

Advantage prescription drug plan (MA–

PD) sponsors, prescription drug plan 

(PDP) sponsors, and Fallback plan 

sponsors, as required by the MMA, are 

required to submit payment-related data 

to CMS that include, but are not limited 

to, Part D claims data. The information 

collection requirements associated with 

the collection of prescription drug data 

from MA–PD, PDP and Fallback plan 

sponsors for Medicare Part D payments 

are currently approved under the Office 

of Management and Budget (OMB) 

Control No. 0938–0982, with an 

expiration date of November 30, 2009. 

Additionally, we have included a 

discussion of the currently approved 

information collection requirements 

associated with the Medicare Part D 

reporting requirements and the plan 

benefit package (PBP) and formulary 

submission for Medicare Advantage 

prescription drug plans (MA–PD) and 

prescription drug plans (PDPs). The 

information collection requirements 

(ICRs) for the Part D reporting 

requirements and the plan benefit 

package are approved under OMB 

Control Nos. 0938–0992 and 0938–0763, 

respectively. 

A. ICRs Regarding Contract Provisions 

(§ 423.505) 

Section 423.505 discusses provisions 

that must be contained in contracts 

between Part D plan sponsors and CMS. 

Specifically, § 423.505(b)(8) requires 

that a Part D plan sponsor comply with 

the disclosure and reporting 

requirements in § 423.505(f), § 423.514, 

and § 423.329(b), respectively. Section 

423.505(f) lists the information that Part 

D plan sponsors are required to disclose 

to CMS. This information includes but 

is not limited to the disclosure of 

certified financial information, the 

disclosure of all information necessary 

for us to administer and evaluate the 

program and to simultaneously establish 

and facilitate a process for current and 

prospective beneficiaries to exercise 

choice in obtaining prescription drug 

coverage, and the disclosure to its 

enrollees of all informational 

requirements under § 423.128 and, upon 

an enrollee’s request, the financial 

disclosure information required under 

§ 423.128(c)(4). 

B. ICRs Regarding Reporting 

Requirements (§ 423.514) 

Section 423.514 outlines the reporting 

requirements for Part D plan sponsors. 

Section 423.514(a) requires each Part D 

plan sponsor to have an effective 

procedure to develop, compile, 

evaluate, and report to CMS, to its 

enrollees, and to the general public, at 

the times and in the manner that CMS 

requires. Section 423.514(b) requires 

Part D plan sponsors to report to CMS 

annually, within 120 days of the end of 

its fiscal year, significant business 

transactions. In addition, § 423.514(c) 

sets forth the requirements for 

submitting combined financial 

statements. For any employees’ health 

benefits plan that includes a Part D plan 

sponsor in its offerings, § 423.514(d) 

addresses the reporting and disclosure 

obligations under the Employee 

Retirement Income Security Act of 1974 

(ERISA). Section 423.514(e) states that 

each Part D plan sponsor must notify 

CMS of any loans or other special 

financial arrangements it makes with 

contractors, subcontractors and related 

entities. Section 423.514(f) requires each 

Part D plan sponsor to make the 

information reported to CMS under this 

section available to its enrollees upon 

reasonable request. 

C. ICRs Regarding Determination of 

Payments (§ 423.329) 

Section 423.329(b) contains the 

reporting requirements for PDPs and 

MA–PDs for the purposes of 

determining health status risk 

adjustment. As stated in 

§ 423.329(b)(3)(i), PDPs are required to 

submit data regarding drug claims that 

can be linked at the individual level to 

Part A and Part B data in a form and 

manner similar to the process provided 

under § 422.310 of this chapter and 

other information as we determine 

necessary. In addition, 

§ 423.329(b)(3)(ii) requires MA 

organizations that offer MA–PD plans to 

submit data regarding drug claims that 

can be linked at the individual level to 

other data that the organizations are 

required to submit to CMS in a form and 

manner similar to the process provided 

under § 422.310 and other information 

as we determine necessary. 

D. ICRs Regarding Contract Provisions 

(§ 423.505(b)(8)) 

The burden associated with the 

requirements in § 423.505(b)(8) of this 

regulation is the time and effort 

associated with meeting the 

aforementioned requirements in 

§ 423.505(f), § 423.514, and § 423.329(b). 

As stated earlier, these requirements are 

subject to the PRA; however, they are 

approved under existing OMB control 

numbers. The requirements in 

§ 423.505(f) and § 423.514 are currently 

approved under OMB control number 

0938–0992 with an expiration date of 

June 30, 2008. The information 

collection requirements contained in 

§ 423.329(b) are currently approved 

under OMB control number 0938–0763, 

with an expiration date of November 30, 

2009. 

mstockstill on PROD1PC66 with RULES2

30682 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

TABLE 1.—ESTIMATED ANNUAL REPORTING AND RECORDKEEPING BURDEN

Regulation section OMB Control 

number 

Number of 

respondents 

Number of 

responses 

Burden per 

response 

(hours) 

Total annual 

burden 

(hours) 

§ 423.505 ** and § 423.514 ** ............................................... 0938–0992 3,203 179,368 .69 123,764 

§ 423.329 ** .......................................................................... 0938–0763 430 4,515 2.29 **10,319 

Total .............................................................................. ........................ ........................ ........................ ........................ 138,469 

** As specified by § 426.505(b)(8) 

As required by section 3504(h) of the 

Paperwork Reduction Act of 1995, we 

have submitted a copy of this document 

to the Office of Management and Budget 

(OMB) for its review of these 

information collection requirements. 

V. Regulatory Impact Statement 

We have examined the impact of this 

rule as required by Executive Order 

12866 (September 1993, Regulatory 

Planning and Review), the Regulatory 

Flexibility Act (RFA) (September 19, 

1980, Pub. L. 96–354), section 1102(b) of 

the Social Security Act, the Unfunded 

Mandates Reform Act of 1995 (Pub. L. 

104–4), Executive Order 13132 on 

Federalism and the Congressional 

Review Act (5 U.S.C. 804 (2)). 

Executive Order 12866, as amended, 

directs agencies to assess all costs and 

benefits of available regulatory 

alternatives and, if regulation is 

necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety 

effects, distributive impacts, and 

equity). A regulatory impact analysis 

(RIA) must be prepared for major rules 

with economically significant effects 

($100 million or more in any 1 year). 

This final rule does not have 

economically significant effects of $100 

million or more in any one year and 

therefore is not a major rule. 

We assessed alternatives, including, 

not releasing data to any entity meeting 

the applicable criteria. We determined 

that the approach that maximizes public 

health benefits is the approach taken in 

the final regulation, which would use a 

case-by-case evaluation approach 

similar to the process in use today for 

Medicare Parts A and B data, with some 

additional restrictions to protect privacy 

and commercially sensitive data of Part 

D sponsors. Weighing all factors, this 

approach limits the risk that sensitive 

Part D claims data will be released to 

inappropriate entities leading to the 

inappropriate use of this sensitive data, 

but maximizes the benefit that this data 

can provide in supporting research 

studies and other actions that will 

benefit the public. 

We do not believe that new costs 

associated with compliance under this 

regulation, if any, will be significant. As 

stated in section II. E. of this final rule, 

we expect risk and compliance burdens 

to be limited; therefore any costs 

associated with compliance or 

inappropriate use of data are expected 

to be limited, and because the use of 

these data according to applicable laws 

and CMS data release policies is 

expected to improve the public’s health, 

this rule does not reach the economic 

threshold and thus is not considered a 

major rule requiring a RIA. 

The RFA requires agencies to analyze 

options for regulatory relief of small 

businesses. For purposes of the RFA, 

small entities include small businesses, 

nonprofit organizations, and small 

governmental jurisdictions. Most 

hospitals and most other providers and 

suppliers are small entities, either by 

nonprofit status or by having revenues 

of $6 million to $29 million in any 1 

year. Individuals and states are not 

included in the definition of a small 

entity. While a number of Part D plan 

sponsors are small entities due to their 

nonprofit status, few, if any, of the Part 

D plan sponsors meet the size standard 

for a small insurance firm by having 

revenues of $6 million or less in any 1 

year. Therefore, an analysis for the RFA 

will not be prepared because the 

Secretary has determined that this final 

rule will not have a significant 

economic impact on a substantial 

number of small entities. Furthermore, 

we believe, the rule does not create a 

significant economic impact on Part D 

plan sponsors. 

In addition, section 1102(b) of the Act 

requires us to prepare a regulatory 

impact analysis if a rule may have a 

significant impact on the operations of 

a substantial number of small rural 

hospitals. This analysis must conform to 

the provisions of section 604 of the 

RFA. An analysis for section 1102(b) of 

the Act will not be prepared because the 

Secretary has determined that this final 

rule will not have a significant impact 

on the operations of a substantial 

number of small rural hospitals. In fact, 

we do not expect that it will have any 

impact on small rural hospitals because 

the rule relates to Part D plan sponsors, 

not small rural hospitals. 

Section 202 of the Unfunded 

Mandates Reform Act of 1995 also 

requires that agencies assess anticipated 

costs and benefits before issuing any 

rule whose mandates require spending 

in any 1 year of $100 million in 1995 

dollars, updated annually for inflation. 

That threshold level is currently 

approximately $130 million. This final 

rule will not contain mandates having a 

negative effect on state, local, or tribal 

governments in the aggregate, or by the 

private sector, of $130 million. 

Executive Order 13132 establishes 

certain requirements that an agency 

must meet when it promulgates a final 

rule that imposes substantial direct 

requirement costs on state and local 

governments, preempts State law, or 

otherwise has Federalism implications. 

Even though states may incur costs 

associated with exchanging data, this 

regulation does not require states to 

request Part D claims data, but makes it 

an option, provided we can resolve any 

operational issues. In fact, even if States 

do request data, they may already have 

systems in place to receive data from 

CMS. Furthermore, we are not aware of 

any conflict between this final 

regulation and State privacy laws (with 

which Part D sponsors must comply per 

our regulations). Therefore, we do not 

believe this final regulation will 

implicate a Federalism issue through an 

impact on State privacy laws. Since this 

regulation does not impose any costs on 

state or local governments, the 

requirements of Executive Order 13132 

are not applicable. 

We received the following comments 

regarding the impact analysis of the 

proposal rule: 

Comment: One commenter stated that 

because of the monetary cost and other 

compliance burdens associated with the 

implementation of this regulation due to 

HIPAA, this rule, if implemented, must 

be implemented at the beginning of a 

calendar year per § 423.516. 

Response: We address this comment 

in section II. E. of this final rule. 

Comment: A commenter stated that in 

determining whether the rulemaking 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30683 

met the $100 million threshold the 

value of the information to beneficiaries 

should have been considered. The 

commenter states that the value would 

surpass $100 million, since brokers rent 

lists potentially for $5 million per 

rental, often several times a year. 

Response: Under our data release 

policies, we would not allow the release 

of Part D claims data for commercial 

purposes. Thus, we do not believe the 

$100 million threshold would be met 

based on the example cited by the 

commenter. It is unlikely that list 

brokers will receive any nonpublic data 

from CMS. 

In accordance with the provisions of 

Executive Order 12866, this regulation 

was reviewed by the Office of 

Management and Budget. 

List of Subjects in 42 CFR Part 423 

Administrative practice and 

procedure, Medicare, Prescription 

Drugs, Reporting and recordkeeping. 

■ For the reasons set forth in the 

preamble, the Centers for Medicare & 

Medicaid Services amends 42 CFR 

chapter IV as set forth below: 

PART 423—VOLUNTARY MEDICARE 

PRESCRIPTION DRUG BENEFIT 

■ 1. The authority citation for part 423 

is amended to read as follows: 

Authority: Sections 1102, 1106, 1860D–1 

through 1860D–42, and 1871 of the Social 

Security Act (42 U.S.C. 1302, 1306, 1395w–

101 through 1395w–152, and 1395hh). 

Subpart A—General Provisions 

■ 2. Section 423.1 is amended by adding 

a new reference to paragraph (a)(1) in 

numerical order to read as follows: 

§ 423.1 Basis and scope 

(a) * * *. 

(1) * * *. 

1106. Disclosure of Information in 

Possession of Agency. 

* * * * * 

Subpart K—Application Procedures 

and Contracts With Part D Plan 

Sponsors 

■ 3. Section 423.505 is amended by—

■ A. Revising paragraph (b)(8). 

■ B. Redesignating paragraph (f)(3) as 

(f)(4). 

■ C. Adding new paragraph (f)(3). 

■ D. Adding new paragraphs (l) and (m). 

The revisions and additions read as 

follows: 

§ 423.505 Contract provisions. 

* * * * * 

(b) * * * 

(8) Comply with the disclosure and 

reporting requirements in § 423.505(f), 

§ 423.514, and the requirements in 

§ 423.329(b) of this part for submitting 

current and prior drug claims and 

related information to CMS for its use in 

risk adjustment calculations and for the 

purposes of implementing § 423.505(f), 

(l), and (m) and § 423.329(b) of this part. 

* * * * * 

(f) * * * 

(3) The 37 original data elements 

included in all of its drug claims for 

purposes deemed necessary and 

appropriate by the Secretary, including, 

but not limited to, the following: 

(i) Reporting to Congress and the 

public on overall statistics associated 

with the operation of the Medicare 

prescription drug program. 

(ii) Conducting evaluations of the 

overall Medicare program, including the 

interaction between prescription drug 

coverage under Part D of Title XVIII of 

the Social Security Act and the services 

and utilization under Parts A, B, and C 

of title XVIII of the Act and under titles 

XIX and XXI of the Act, as well as other 

studies addressing public health 

questions. 

(iii) Making legislative proposals to 

the Congress regarding Federal health 

care programs and related programs. 

(iv) Conducting demonstration and 

pilot projects and making 

recommendations for improving the 

economy, efficiency, or effectiveness of 

the Medicare program. 

(v) Supporting care coordination and 

disease management programs, 

(vi) Supporting quality improvement 

and performance measurement 

activities, and; 

(vii) Populating personal health care 

records. 

* * * * * 

(l) CMS may use the information 

collected under paragraph (f)(3) of this 

section. Any restriction set forth by 

§ 423.322(b) of this part must not be 

construed to limit the Secretary’s 

authority to use the information 

collected under paragraph (f)(3). 

(m)(1) CMS may release the minimum 

data necessary for a given purpose from 

the data collected under paragraph (f)(3) 

of this section to Federal executive 

branch agencies, congressional oversight 

agencies, States, and external entities in 

accordance with the following: 

(i) Applicable Federal laws. 

(ii) CMS data sharing procedures. 

(iii) Subject, in certain cases, to 

encryption of certain identifiers and 

aggregation of cost data to protect 

beneficiary confidentiality and 

commercially sensitive data of Part D 

sponsors, in accordance with all of the 

following principles: 

(A) Subject to the restrictions in this 

paragraph, all elements on the claim are 

available to congressional oversight 

agencies (as defined in paragraph 

(m)(1)(iv) of this section) and HHS. 

(B) Cost data elements on the claim 

generally are aggregated for releases to 

other executive branch agencies, States, 

and external entities. 

(C) Plan identifier elements on the 

claim are encrypted or unavailable for 

releases to external entities. 

(D) Beneficiary, pharmacy, and 

prescriber identifier elements on the 

claim generally are encrypted for 

releases to external entities, except in 

limited circumstances, such as to link to 

another data set. 

(iv) For purposes of paragraph 

(m)(1)(iii) of this section, congressional 

oversight agencies (the Congressional 

Budget Office, the Government 

Accountability Office, the Medicare 

Payment Advisory Commission, and the 

Congressional Research Service when 

acting on behalf of a congressional 

committee in accordance with 2 U.S.C. 

166(d)(1)), States, and executive-branch 

Federal agencies are not considered to 

be external entities. 

(2) Any restriction set forth by 

§ 423.322(b) of this part must not be 

construed to limit the Secretary’s 

authority to release the information 

collected under paragraph (f)(3) of this 

section. 

(Catalog of Federal Domestic Assistance 

Program No. 93.773, Medicare—Hospital 

Insurance; and Program No. 93.774, 

Medicare—Supplementary Medical 

Insurance Program) 

Dated: February 25, 2008. 

Kerry Weems, 

Acting Administrator, Centers for Medicare 

& Medicaid Services. 

Approved: March 17, 2008. 

Michael O. Leavitt, 

Secretary. 

The following appendix will not 

appear in the Code of Federal 

Regulations. 

Appendix—Data Element Availability 

Under Section 1860D–12 of the Social 

Security Act by Type of Requestor 

CMS and its contractors have access 

to all PDE elements. This chart shows 

the data elements that are available for 

release to other federal and state 

agencies and external entities in the 

final rule under our minimum necessary 

data policy subject, in certain cases, to 

encryption of certain identifiers and 

aggregation of cost data to protect 

beneficiary confidentiality and 

commercially sensitive data of Part D 

sponsors. Thus, a requestor would not 

automatically receive all of the available 

elements, but would only receive those 

necessary for their study. (Note: As 

mstockstill on PROD1PC66 with RULES2

30684 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 

stated in the preamble to the final rule, 

this chart applies only when data is 

collected under section 1860D–12 of the 

Act, and does not apply to any uses or 

disclosures already permitted under 

section 1860D–15 of the Act, including 

to carry out audits and evaluations 

necessary to ensure accurate and correct 

payment and to otherwise oversee 

Medicare reimbursement under Part D. 

These uses are already contemplated 

under both the statute and the 

regulations at § 423.322(b) and are not 

the subjects of this final rule.) 

Data elements 

Other (i.e., non-CMS) 

DHHS entities, and Congressional Oversight 

Agencies* See Note 1 

Non-HHS Executive 

Branch Agencies and 

States 

External entities 

Identifiers 

Encryption permits analysis on a beneficiary, plan, prescriber, or pharmacy level without disclosure of the actual identifying information. CMS 

will link our data to other data files, to the extent feasible, to minimize the extent to which other parties need identifiers for data linkage purposes. CMS has the sole authority to determine whether a particular data element is needed for a request. 

Beneficiary ID (HIC Number, Cardholder ID, Patient 

date of birth) See Note 2.

Encrypted, but available if 

needed.

Encrypted, but available if 

needed.

Encrypted, but available if 

needed to link to another 

dataset. 

Plan ID (PBP identifier, Contract identifier) See Note 3 Encrypted, but available if 

needed.

Encrypted, but available if 

needed.

Encrypted. 

Additionally, nonencrypted 

data will be available for 

purposes of performance 

measures.

Prescriber ID (Prescriber Identifier) See Note 4 ............. Encrypted, but available if 

needed.

Encrypted, but available if 

needed.

Encrypted, but available if 

needed to link to another 

dataset. 

Additionally, nonencrypted 

data will be available for 

purposes of performance 

measures.

Pharmacy ID (Service provider identifier) See Note 5 .... Encrypted, but available if 

needed.

Encrypted, but available if 

needed.

Encrypted, but available if 

needed to link to another 

dataset. 

Qualifying Identifiers (Service & Prescriber Identifier 

Qualifiers—codes that denote whether NPI, NCPDP, 

UPIN, state license number, DEA, or non-standard 

code is used).

Available ............................ Available ............................ Available. 

Internal plan/pharmacy prescription identification numbers (Claim Control Number—a code intended for the 

plan to identify unique events & Prescription Service 

Reference Number—a code assigned by the pharmacy at the time the prescription is filled).

Available ............................ Unavailable ........................ Unavailable. 

Drug Utilization Information 

Date of Service ................................................................ Available ............................ Available ............................ Available. 

Drug information (Product/Service Identifier, Quantity 

Dispensed, Days Supply, Compound Code, Fill Number, Dispensing Status.).

Available ............................ Available ............................ Available. 

Other utilization information (Dispense as Written/Product Selection Code, Drug Coverage Status Code).Available ............................ Available ............................ Available. 

Drug Cost Information 

Total Drug Costs (Ingredient Cost, Dispensing Fee, 

Total Amount Attributable to Sales Tax) See Note 6.

Available, Disaggregated .. Available, Aggregated ....... Available, Aggregated. 

Coverage Information 

Date Paid ......................................................................... Available ............................ Available ............................ Available. 

Plan Paid Amounts (Covered D Plan Paid Amount, 

Non-covered Plan Paid Amounts).

Available ............................ Available ............................ Available. 

Beneficiary cost sharing (Patient Pay Amount,) ............. Available ............................ Available ............................ Available. 

Other Payer Amounts (Other True Out of Pocket 

Amount, Patient Liability due to Other Payer Amount).

Available ............................ Available ............................ Available. 

Low-Income Subsidy Amount .......................................... Available ............................ Available ............................ Available. 

Other Financial Information (Gross Drug Cost below 

Out-of-pocket Threshold, Gross Drug Cost above 

Out-of-pocket Threshold).

Available ............................ Available ............................ Available. 

Other Descriptive Data 

Patient gender ................................................................. Available ............................ Available ............................ Available. 

mstockstill on PROD1PC66 with RULES2

Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30685 

Data elements 

Other (i.e., non-CMS) 

DHHS entities, and Congressional Oversight 

Agencies* See Note 1 

Non-HHS Executive 

Branch Agencies and 

States 

External entities 

Catastrophic Coverage Indicator (Catastrophic Coverage Code).Available ............................ Available ............................ Available. 

In-network versus OON or MSP claim (Pricing Exception code).Available ............................ Available ............................ Available. 

Electronic versus Paper Claim (Non-Standard format 

Code).

Available ............................ Available ............................ Available. 

Original versus Adjusted PDE (Adjustment/Deletion 

code).

Available ............................ Final Action claims would 

be provided, so this element should not be 

needed.

Final Action claims would 

be provided, so this element should not be 

needed. 

Generally, the notes apply to all columns across the row. 

Note 1—Congressional oversight agencies include GAO, MedPAC, and CBO. CRS is considered a Congressional oversight agency, but only 

when acting on behalf of a committee pursuant to its authority in 2 U.S.C. § 166(d)(1). Otherwise, CRS is considered to be an external entity. 

Note also that OIG has authority independent of both sections 1860D–12 and 1860D–15 of the Social Security Act to collect data. 

Note 2—CMS will encrypt all beneficiary identifiers unless they are needed. An example of where they might be needed is linkage to another 

dataset. When CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a 

link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers. Public disclosure of research results will 

not include beneficiary identifying information. 

Note 3—In general, CMS will link the Part D claims to plan level benefits and formulary data if needed by the requestor, and then encrypt the 

plan ID. However, CMS will not link certain information if it will lead to a de facto identification of the plan. CMS may develop plan specific performance measures which are publicly reported. 

Note 4—CMS will link to physician characteristics from CMS files if needed by the requestor. Generally, when CMS sends real identifiers in 

order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers. 

Note 5—To the extent available, CMS will provide pharmacy characteristics from CMS files. However, CMS will not release pharmacy ID, together with drug cost information, in order to guard against the disclosure of negotiated price information. 

Note 6—Generally, CMS will aggregate ingredient cost, dispensing fee, and sales tax at the individual claim level. Upon request, CMS will exclude sales tax from the aggregation at the individual claim level if necessary for the project. 

[FR Doc. 08–1298 Filed 5–22–08; 1:30 pm] 

BILLING CODE 4120–01–P 

mstockstill on PROD1PC66 with RULES2