Source: https://www.federalregister.gov/documents/2016/02/02/2016-01790/medicare-program-expanding-uses-of-medicare-data-by-qualified-entities
Timestamp: 2020-06-05 18:16:57
Document Index: 512267448

Matched Legal Cases: ['art 401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', 'art 402', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401', '§\u2009401']

Federal Register :: Medicare Program: Expanding Uses of Medicare Data by Qualified Entities
A Proposed Rule by the Centers for Medicare & Medicaid Services on 02/02/2016
5397-5417 (21 pages)
0938-AS66
CMS-2016-0008
Expansion of the CMS Qualified Entity Program CMS-5061-P
https://www.federalregister.gov/d/2016-01790 https://www.federalregister.gov/d/2016-01790
The Qualified Entity program was established by Section 10332 of the Patient Protection and Affordable Care Act (Affordable Care Act) (Pub. L. 111-148). The implementing regulations, which became effective January 6, 2012, are found in subpart G of 42 CFR part 401 (76 FR 76542). Under those provisions, CMS provides standardized extracts of Medicare Part A and B claims data and Part D drug event data Start Printed Page 5398(hereinafter collectively referred to as Medicare claims data) covering one or more geographic regions to qualified entities at a fee equal to the cost of producing the data. Under the original statutory provisions, such Medicare claims data must be combined with other non-Medicare claims data and may only be used to evaluate the performance of providers and suppliers. The measures, methodologies and results that comprise such evaluations are subject to review and correction by the subject providers and suppliers, after which the results are to be disseminated in public reports.
MACRA imposes a number of limitations on qualified entities with Start Printed Page 5399respect to the sale and provision of non-public analyses. It mandates that a qualified entity may not provide or sell non-public analyses to a health insurance issuer unless the issuer is providing the qualified entity with claims data under section 1874(e)(4)(B)(iii) of the Act. In doing so, the statute does not specify the minimum amount of data that the issuer must be providing to the qualified entity. We considered not imposing a threshold on the amount of data being provided by the issuer, but decided that specifying a threshold would encourage issuers to submit data to the qualified entity to be included in the public performance reports, increasing the reports' reliability and sample size. As a result, we propose at § 401.716(b)(1) to limit qualified entities to only providing or selling non-public analyses to issuers after they provide the qualified entity with claims data that represents a majority of the issuers' covered lives in the geographic region and during the time frame of the non-public analyses requested by the issuer. For example, if an issuer requested non-public analyses using the combined data for the first 6 months of 2015 in Minnesota, it would need to provide the qualified entity with data that represents over 50 percent of the issuer's covered lives during those 6 months in Minnesota. We believe this threshold will ensure that issuers submit a large portion of their data to the qualified entity without requiring them to share data for their entire population in order to be eligible to receive non-public analyses. We seek comment on whether the threshold of a majority of the issuer's covered lives in the desired geographic area during the time frame covered by the non-public analyses requested by the issuer is too high or low, as well as other alternatives to specify the amount of data the issuer must provide to a qualified entity to be eligible to receive or purchase non-public analyses.
Except when patient-identifiable non-public analyses are shared with the patient's provider or supplier as described above, we propose at § 401.716(b)(3) to require that all non-public analyses must be beneficiary de-identified using the de-identification standards in the HIPAA Privacy Rule at 45 CFR 164.514(b). De-identification under this standard requires the removal of specified data elements or reliance on a statistical analysis that concludes that the information is unlikely to be able to be used alone or in combination with other available information to identify/re-identify the patient subjects of the data. The statistical de-identification approach may be more difficult because an entity may not have access to an expert capable of performing the analysis in accordance with HIPAA Rules, but we believe that the protections afforded by HIPAA-like standards of de-identification are appropriate, as HIPAA has, in many ways, established a reasoned and appropriate privacy and security floor for the health care industry. That said, the framework for de-identification that is laid out in the HIPAA Privacy Rule represents a widely accepted industry standard for de-identification, so we think its concepts are appropriate for adoption into this program. Additional information on the HIPAA de-identification standards can be found on the HHS Office for Civil Rights Web site at http://www.hhs.gov/​ocr/​privacy/​hipaa/​understanding/​coveredentities/​De-identification/​guidance.html.
In addition, section 105(a)(6) of MACRA preserves providers' and suppliers' opportunity to review analyses (now including non-public analyses) that individually identify the provider or supplier. As such, we propose at § 401.716(b)(4) to bar qualified entities' disclosure of non-public analyses that individually identify a provider or supplier unless: (a) The analysis only individually Start Printed Page 5400identifies the singular recipient of the analysis or (b) each provider or supplier who is individually identified in a non-public analysis that identifies multiple providers/suppliers has been afforded an opportunity to review the aspects of the analysis about them, and, if applicable, request error correction. We describe the proposed appeal and error correction process in more detail in section II.A.4 below.
The statute also contains limitations on the re-disclosure of non-public analyses provided or sold to authorized users at section 105(a)(5) of MACRA. Under that provision, re-disclosure is limited to authorized users who are a provider or supplier. Furthermore, these Start Printed Page 5401providers and suppliers are to limit any re-disclosures to instances in which the recipient would use the non-public analyses for provider/supplier “performance improvement.” As many if not most providers and suppliers that receive non-public analyses from the qualified entity will be HIPAA-covered entities, we propose to limit performance improvement re-disclosures to those that would support quality assessment and improvement, and care coordination activities by or on behalf of the eligible downstream provider or supplier. For example, providers may need to share the non-public analyses or derivative data with someone working on their behalf to carry out such quality assessment and improvement or care coordination activities. That is, if they are a HIPAA-covered entity, they may wish to share the non-public analyses or derivative data with their business associate. Such a scenario could arise when a consultant is hired to assist the provider/supplier in interpreting the non-public analyses, or in determining what changes in the delivery of care are needed to assess or improve the quality of care, or to better coordinate care. Another example is if the provider or supplier wants to share the non-public analyses with other treating providers/suppliers for quality assessment and improvement or care coordination purposes.
Specifically, we propose at § 401.717(f) that a qualified entity generally must comply with the same error corrections process and timelines as are required for public performance reporting before disclosing non-public analyses. This process includes confidentially sharing the measures, measure methodologies and measure results that comprise such evaluations with providers and suppliers at least 60 calendar days before providing or selling the analyses to one or more authorized users. During these 60 calendar days, the provider or supplier may make a request for the Medicare claims data and beneficiary names that may be needed to confirm statements about the care that they delivered to their patients. If the provider or supplier requests such data, the qualified entity must release the Medicare claims and beneficiary names relevant to what is said about the requesting provider/supplier in the draft non-public analyses. We believe that for many providers and suppliers, a beneficiary's name will be of more practical use in determining the accuracy of analyses than the underlying claims used in the analyses. The sharing of such data must be done via a secure mechanism that is suitable for transmitting or providing access to individually identifiable Start Printed Page 5402health information. The qualified entity also must ensure that the provider or supplier has been notified of the date on which the analyses will be shared with the authorized user. If any requests for error correction are not resolved by the date on which the analyses are to be shared, the qualified entity may release the analyses, but must inform the authorized user that the analyses are still under appeal, and the reason for the appeal.
Furthermore, in § 401.713(d), we propose a number of provisions that address the privacy and security of the combined data and/or the Medicare Start Printed Page 5403claims data and/or non-public analyses that contain patient identifiable data. These provisions require the qualified entity to condition the disclosure of data on the imposition of contractually binding limits on the permissible uses and re-disclosures that can be made of the combined data and/or the Medicare claims data and/or non-public analyses that contain patient identifiable data and/or any derivative data. Such contractually binding provisions would be included in the QE DUA.
The statute also prohibits the authorized user from using the combined data and/or Medicare claims data for marketing purposes. We therefore propose at § 401.713(d)(2) to require qualified entities to use the QE DUA to contractually prohibit the authorized users from using the combined data and/or Medicare claims data and/or non-public analyses that contain patient identifiable data and/or any derivative data for marketing purposes. As noted above, we propose to define “marketing” as it is defined in the HIPAA Privacy Rule, but, given the statutory bar, we do not propose to adopt an exception to the bar for “consent”-based marketing. As noted above, HIPAA provides well-recognized standards for the appropriate use and disclosure of certain individually identifiable health information, and we believe that the HIPAA definition for “marketing” is appropriate for the qualified entity program as well. For additional information and guidance on the HIPAA Privacy Rule, including guidance on what constitutes marketing, please visit the HHS Office for Civil Rights Web site at http://www.hhs.gov/​ocr/​privacy/​.
Furthermore, we propose to require qualified entities' use of the QE DUA to address minimum privacy and security standards. CMS is committed to protecting the privacy and security of beneficiary-identifiable data when it is disseminated, including when it is in the hands of authorized users. This is especially important as there are no guarantees that authorized users will be subject to the HIPAA Privacy and Security Rules. Therefore, we propose at § 401.713(d)(3) to require qualified entities to contractually bind authorized users using the QE DUA to protect patient identifiable combined data and/or Medicare data, any patient identifiable derivative data, and/or non-public analyses that contain patient identifiable data, with at least the privacy and security protections that would be required of covered entities and their business associates under HIPAA Privacy and Security Rules. Additional guidance on the Security rule can be found on the Office for Civil Rights Web site at http://www.hhs.gov/​ocr/​privacy/​hipaa/​. Such protections would apply when using, disclosing, or maintaining patient identifiable data, regardless of whether the authorized user is a HIPAA Covered Entity or business associate. In addition, we propose to require that the QE DUA contain provisions that require that the authorized user maintain written privacy and security policies and procedures that ensure compliance with these HIPAA-based privacy and security standards and the other standards required under this subpart for the duration of the QE DUA, or for so long as they hold combined data and/or Medicare claims data and/or non-public analyses that contain patient identifiable data and/or any derivative data that was subject to the QE DUA, should return/destruction of the combined data and/or Medicare claims data and/or non-public analyses that contain patient identifiable data and/or any derivative data not be feasible as of the expiration of the QE DUA.
MACRA section 105(a)(5) directs that any combined data, Medicare claims data, and/or non-public analyses that contain patient identifiable data and/or any derivative data provided or sold under this program to authorized users is to be non-public, and it requires the imposition of re-disclosure limitations on authorized users. Under those provisions, qualified entities may only permit providers and suppliers to re-disclose combined data and/or Medicare claims data and/or non-public analyses that contain patient identifiable data and/or any derivative data for the Start Printed Page 5404purposes of performance improvement and care coordination. We propose to require qualified entities to include provisions in their QE DUA that contractually limit the re-disclosure and/or linking of combined data, Medicare claims data, and/or non-public analyses that contain patient identifiable data and/or any derivative data provided or sold under this program.
We propose to define medical society as comprised of a majority of physicians, based on state law definitions around the practice of medicine. Although medical societies may also include non-physician members, due to the strong emphasis on physicians as practitioners of medicine, we propose that a medical society's Start Printed Page 5405membership must be comprised of a majority of physicians. Medical societies often serve as the consensus voice of their members in matters related to their profession, the patient-physician relationship, and other issues pertaining to the practice of medicine. Therefore, we propose that medical societies be at the national or state level as we believe these larger groups will have the capacity to act on the data and analyses available through this program, and to do so in accordance with the statute and the implementing regulations.
Section 105(a)(8) of MACRA expands the information that a qualified entity must report annually to the Secretary if Start Printed Page 5406a qualified entity provides or sells non-public analyses. Specifically, it requires the qualified entity to provide a summary of the analyses provided or sold, including information on the number of such analyses, the number of purchasers of such analyses, and the total amount of fees received for such analyses. It also requires the qualified entity to provide a description of the topics and purposes of such analyses. Furthermore, the Secretary may impose other reporting requirements, as appropriate.
MACRA allows an assessment in the amount of up to $100 per potentially affected individual. We therefore propose to draw on factors established in 42 CFR part 402 to specify the factors and circumstances that will be considered in determining the assessment amount per potentially affected individual.Start Printed Page 5407
Section 105(c) of MACRA expands, at the discretion of the Secretary, the data that the Secretary may make available to qualified entities, including standardized extracts of claims data under titles XIX (Medicaid) and XXI (the Children's Health Insurance Program, CHIP) for one or more specified geographic areas and time periods as may be requested by the Start Printed Page 5408qualified entity. Currently, CMS is only required to provide qualified entities with standardized extracts of claims data from Medicare Parts A, B, and D. While CMS has data for Medicare and Medicaid/CHIP, the timeliness and quality of data differs significantly between the programs.
If finalized, these regulations would also require a qualified entity to submit additional information as part of its annual report to CMS. A qualified entity is currently required to submit an annual report to CMS under § 401.719(b). Proposed § 401.719(b)(3) and (4) provide for additional reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. The burden associated with this requirement is the time and effort necessary to gather, process, and submit the required information to CMS. There are currently 13 qualified entities; however we estimate that number will increase to 20 if these proposals are finalized. Some qualified entities may not want to bear the risk of the potential assessments and Start Printed Page 5409have been able to accomplish their program goals under other CMS data sharing programs, therefore some qualified entities may not elect to provide or sell analyses and/or data to authorized users. As a result, we estimate that 15 qualified entities will choose to provide or sell analyses and/or data to authorized users, and therefore, would be required to comply with these additional reporting requirements within the first three years of the program. We further estimate that it would take each qualified entity 50 hours to gather, process, and submit the required information. We estimate that it will take each qualified entity 34 hours to gather the required information, 15 hours to process the information, and 1 hour to submit the information to CMS. We believe a professional or technical services employee of the qualified entity with an hourly labor cost of $75.08 will fulfill these additional annual report requirements. We estimate that 15 qualified entities will need to comply with this requirement and that the total estimated burden associated with this requirement is $56,310. We request comment on the type of employee and the number of hours that will be needed to fulfill these additional annual reporting requirements.
We based the hourly labor costs on those reported by the Bureau of Labor Statistics (BLS) at http://data.bls.gov/​pdq/​querytool.jsp?​survey=​ce for this labor category. We used the annual rate for 2014 and added 100 percent for overhead and fringe benefit costs.
The RFA requires agencies to analyze options for regulatory relief of small businesses, if a rule has a significant impact on a substantial number of small entities. For purposes of the RFA, we estimate that most hospitals and most other providers are small entities as that term is used in the RFA (including small businesses, nonprofit organizations, and small governmental jurisdictions). However, since the total estimated impact of this rule is less than $100 million, and the total estimated impact would be spread over 82,500 providers and suppliers (who are the subject of reports), no one entity would face significant impact. Of the 82,500 providers, we estimate that 78,605 Start Printed Page 5410would be physician offices that have average annual receipts of $11 million and 4,125 would be hospitals that have average annual receipts of $38.5 million. As discussed below, the estimated cost per provider is $8,426 (see table 5 below) and the estimated cost per hospital is $6,523 (see table 5 below). For both types of entities, these costs would be a very small percentage of overall receipts. Thus, we are not preparing an analysis of options for regulatory relief of small businesses because we have determined that this rule would not have a significant economic impact on a substantial number of small entities.
We anticipate that most providers and suppliers that may be identified in qualified entities' non-public analyses would be hospitals and physicians. Many hospitals and most other health care providers and suppliers are small entities, either by being nonprofit organizations or by meeting the Small Business Administration definition of a small business (having revenues of less than $38.5 million in any 1 year) (for details see the Small Business Administration's Web site at https://www.sba.gov/​sites/​default/​files/​files/​Size_​Standards_​Table.pdf (refer to the 620000 series). For purposes of the RFA, physicians are considered small businesses if they generate revenues of $11 million or less based on Small Business Administration size standards. Approximately 95 percent of physicians are considered to be small entities.
There are currently 13 qualified entities and these qualified entities all are in different stages of the qualified entity program. For example, some qualified entities have released public reports and some qualified entities are still completing the security requirements in order to receive CMS data. Given the requirements in the different phases and the current status of the qualified entities, we estimate that 11 qualified entities will be able to provide or sell analyses and/or data to authorized users within the first year of the program, and therefore, would be incurring extra costs. As discussed above, we believe the total number of qualified entities will ultimately grow to 20 in subsequent years, with 15 entities providing or selling analyses and/or data to authorized users. In estimating qualified entity impacts, we used hourly labor costs in several labor categories reported by the Bureau of Labor Statistics (BLS) at http://data.bls.gov/​pdq/​querytool.jsp?​survey=​ce. We used the annual rates for 2014 and added 100 percent for overhead and fringe benefit costs. These rates are displayed in Table 2.
We anticipate that the impacts on providers and suppliers consist of costs to review the performance reports generated by qualified entities and, if they choose, appeal the performance calculations. We believe, on average, each qualified entity would produce non-public analyses that in total include information on 7,500 health providers and suppliers. This is based on estimates in the qualified entity final rule, but also include an increase of 50 percent because we believe that more providers and suppliers will be included in the non-public analyses. We anticipate that the largest proportion of providers and suppliers would be physicians because they comprise the largest group of providers and suppliers, and are a primary focus of many recent performance evaluation efforts. We also believe that many providers and suppliers will be the recipients of the non-public analyses in order to support their own performance improvement activities, and therefore, there would be no requirement for a correction or appeals process. As discussed above, there is no requirement for a corrections or appeals process where the analysis only individually identifies the (singular) provider or supplier who is being provided or sold the analysis. Start Printed Page 5413Based on our review of information from existing programs, we assume that 95 percent of the recipients of performance reports (that is, an average of 7,125 per qualified entity) would be physicians, and 5 percent (that is, an average of 375 per qualified entity) would be hospitals and other suppliers. Providers and suppliers receive these reports with no obligation to review them, but we assume that most would do so to verify that their calculated performance measures reflect their actual patients and health events. Because these non-public analyses will be based on the same underlying data as the public performance reports, we estimate that it would take less time for providers or suppliers to review theses analyses and generate an appeal. We estimate that, on average, each provider or supplier would devote three hours to reviewing these analyses. We also estimate that 25 percent of the providers and suppliers would decide to appeal their performance calculations, and that preparing the appeal would involve an average of seven hours of effort on the part of a provider or supplier. As with our assumptions regarding the level of effort required by qualified entities in operating the appeals process, we believe that this average covers a range of provider efforts from providers who would need just one or two hours to clarify any questions or concerns regarding their performance reports to providers who would devote significant time and resources to the appeals process.
Authority: Secs. 1102, 1871, and 1874(e) of the Social Security Act (42 U.S.C. 1302, Start Printed Page 54141395hh, and 1395w-5) and section 105 of the Medicare Access and CHIP Reauthorization Act of 2015 (Pub. L. 114-10).
2. Section 401.703 is amended by adding paragraphs (j) through (u) to read as follows:
3. Section 401.713 is amended by revising paragraph (a) and adding paragraph (d) to read as follows:
§ 401.713
(6) Authorized users who/that receive the beneficiary de-identified combined data or Medicare data as contemplated Start Printed Page 5415under § 401.718 are contractually prohibited from linking the beneficiary de-identified data to any other identifiable source of information, and must be contractually barred from attempting any other means of re-identifying any individual whose data is included in such data.
4. Section 401.716 is added to read as follows:
§ 401.716
Non-public analyses.
5. Section 401.717 is amended by adding paragraph (f) to read as follows:
§ 401.717
Provider and supplier requests for error correction.
6. Section 401.718 is added to read as follows:
§ 401.718
7. Section 401.719 is amended by adding paragraphs (b)(3) and (4) and (d)(5) to read as follows:
§ 401.719
(A) The General Counsel may compromise an assessment imposed under this part, after consulting with CMS or OIG, and the Federal government may recover the assessment in a civil action brought in the United Start Printed Page 5417States district court for the district where the claim was presented or where the qualified entity resides.
8. Section 401.721 is amended by adding paragraph (a)(7) to read as follows:
§ 401.721