Medicare Advantage: Limited Progress Made to Validate Encounter Data Used to Ensure Proper Payments
Published: 2017-01-17T00:00:00

Fast Facts:
Medicare Advantage organizations—which offer a private health plan alternative to traditional Medicare—were paid about $170 billion by the federal government and served nearly one-third of all Medicare beneficiaries in 2015. To help ensure appropriate payments, the Centers for Medicare & Medicaid Services collects data on the care and health status of Medicare Advantage enrollees.
We previously reported that CMS had not fully validated these data for completeness and accuracy. In this review, we found that CMS has conducted some, but not all, remaining validation steps. We maintain that complete validation is key to ensuring data quality.

Highlights:
section_title: Why GAO Did This Study
paragraphs: CMS collects MA encounter data to help ensure the proper use of federal funds by improving risk adjustment in the MA program—the private health plan alternative to traditional Medicare—and for other potential purposes. CMS's ability to make proper payments depends on the completeness and accuracy of MA encounter data. In July 2014, GAO reported that CMS had taken some, but not all, appropriate actions to validate the completeness and accuracy of encounter data and had not fully developed plans for using them.
GAO was asked to provide an update on its July 2014 findings. In this report, GAO identifies (1) steps CMS has taken to validate MA encounter data, and (2) CMS's plans and time frames for using MA encounter data—as well as stakeholder perspectives on these steps and plans.
To do this work, GAO compared CMS activities with the agency's protocol for validating Medicaid encounter data—comparable data collected and submitted by entities similar to MAOs—and federal internal control standards. In addition, GAO reviewed relevant agency documents and interviewed CMS officials on MA encounter data collection and reporting. GAO also reviewed comments in response to CMS's 2014 proposed rule and reports from stakeholder organizations. GAO also interviewed a non-generalizable selection of 11 stakeholders including health insurance and provider trade associations and research organizations. HHS provided technical comments on this report that were incorporated as appropriate.
section_title: What GAO Found
paragraphs: Since GAO issued its July 2014 report, the Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) has made limited progress to validate the completeness and accuracy of Medicare Advantage (MA) encounter data. CMS collects encounter data—detailed information about the care and health status of MA enrollees—to determine payments to MA organizations (MAO). These entities received approximately $170 billion to provide coverage to nearly one-third of all Medicare beneficiaries in 2015. The agency uses a risk adjustment process to account for differences in enrollees' expected health care costs relative to an average beneficiary. Without complete and accurate encounter data, CMS cannot appropriately risk adjust MAO payments. CMS has begun compiling basic statistics on the volume and consistency of data submissions and preparing automated summary reports for MAOs indicating diagnosis information used for risk adjustment. However, CMS has yet to undertake activities that fully address encounter data accuracy, such as reviewing medical records. (See figure.) Furthermore, some health insurance and provider trade associations GAO interviewed voiced concerns about CMS's ability to properly identify diagnoses used for risk adjustment. CMS officials noted that they are working with MAOs to refine how the methodology used to obtain diagnoses data is applied. To the extent that CMS is making payments based on data that have not been fully validated for completeness and accuracy, the soundness of billions of dollars in Medicare expenditures remains unsubstantiated. Given the agency's limited progress, GAO continues to believe that CMS should implement GAO's July 2014 recommendation that CMS fully assess data quality before use.
Since the July 2014 report, CMS has made progress in developing plans to use MA encounter data for risk adjustment, but has not specified plans and time frames for most other purposes, such as conducting program evaluations and supporting public health initiatives. CMS began phasing in patient diagnosis information from encounter data in its risk adjustment process in 2015 and intends to rely completely on those data by 2020. Because it has primarily focused on collecting comprehensive encounter information for risk adjustment purposes—which is key to ensuring proper payments—CMS officials told GAO that the agency has largely deferred planning for additional uses of the data. Some stakeholder organizations have objected to the risk adjustment transition time frame, asserting that it does not allow sufficient time for a successful transition. According to CMS, the multiyear transition time frame is reasonable. Some stakeholders also were concerned that releasing data to external entities could compromise the confidentiality of proprietary information, such as payments to providers. CMS officials said that they intend to use data protections similar to those used with other Medicare data. In the absence of planning for all of the authorized uses, the agency cannot be assured that the amount and types of data being collected are necessary and sufficient for specific purposes. Given the agency's limited progress, GAO continues to believe that CMS should implement GAO's July 2014 recommendation that CMS fully develop plans for the additional uses of encounter data.

section_title: Letter
paragraphs: In the Medicare program, paying for care in a way that contains costs and  maintains quality requires that the Centers for Medicare & Medicaid  Services (CMS)—the agency that administers Medicare—develop sound  data and payment methods. Whereas Medicare pays fee-for-service  (FFS) providers who submit claims for reimbursement after services have  been rendered, Medicare pays Medicare Advantage (MA) organizations  (MAO) a predetermined, fixed monthly amount per enrollee. This  payment does not vary on the basis of the number or cost of health care  services an enrollee uses. Instead, CMS uses a process known as risk  adjustment to pay MAOs more for enrollees who are predicted to have  higher medical costs and less for those predicted to have lower costs.  The purpose of risk adjustment is to pay MAOs fairly and accurately,  thereby decreasing incentives for MAOs to avoid enrolling sicker  beneficiaries. MAOs can incur losses if aggregate costs exceed payments  but can retain savings if aggregate costs are less than payments.
CMS adjusts payments for the health status of an enrollee using a risk  score, which indicates how costly the enrollee is expected to be relative to  the national average beneficiary. CMS calculates the risk score on the  basis of an enrollee’s demographic characteristics (such as age and sex)  and health status (diagnoses). For example, an MAO receives a higher  risk-adjusted payment for an enrollee with diabetes or heart disease than  for an otherwise identical enrollee without those conditions. CMS cannot  accurately risk adjust MAO payments if they are based on diagnosis data  that are incomplete and inaccurate.
Since 2004, CMS has used an abbreviated set of MAO diagnostic data  collected through the Risk Adjustment Processing System (RAPS) to  calculate MA enrollee risk scores. The agency relies on diagnosis  information in RAPS data along with FFS claims data to determine the  relative cost for treating beneficiaries with various diagnoses. In 2012,  CMS began collecting MA encounter data—data roughly equivalent to  FFS claims data. Replacing RAPS with encounter data requires MAOs to  submit more information about enrollees, providers, dates of service,  diagnoses, treatments, and payments. CMS does not expect the  diagnoses in MA encounter data to differ from those in RAPS.
In July 2014, we reported that CMS had taken some, but not all,  appropriate actions to ensure the completeness and accuracy of MA  encounter data. We compared CMS’s activities to the principal activities  identified in its protocol for validating—ensuring the completeness and  accuracy of—Medicaid encounter data that states receive from managed  care organizations, which are entities that provide Medicaid benefits in  exchange for a fixed monthly payment. The protocol outlines a series of  steps for validating encounter data from Medicaid managed care  organizations. Because of the similarities in the type of data and the  entities gathering the data—managed care entities—we referred to this protocol in assessing CMS’s actions to validate MA encounter data. We  found that CMS had established timeliness and frequency requirements for data  certified nearly all MAOs to transmit encounter data, and performed automated checks to determine whether key data elements  were completed and values were reasonable.
However, we also found that CMS had not developed requirements for data completeness and accuracy, performed statistical analyses to detect certain data validity issues,  reviewed medical records to verify diagnoses and services listed in  encounter data, or  reported what it had learned about data quality to MAOs.
In addition, we found that CMS had not fully developed plans for using  MA encounter data. While the agency had announced plans to use  diagnoses from both RAPS and encounter data to risk adjust payments  beginning in 2015, it had not established time frames or specific plans to  use encounter data for other intended purposes as of July 2014. In light  of these findings, in July 2014, we recommended that, to ensure that MA  encounter data are of sufficient quality for their intended purposes, CMS  complete all the steps necessary to validate the data before using  them to risk adjust payments or for other intended purposes and establish specific plans and time frames for using MA encounter data  for all intended purposes in addition to risk adjusting payments to  MAOs.
Since our July 2014 report, CMS finalized its proposal to expand the  allowable uses of encounter data from five to nine purposes, including  risk adjustment, quality review and improvement activities, public health  initiatives, and program integrity activities. CMS also finalized its  proposal to allow external entities, such as other federal agencies and  private research organizations, to use MA encounter data under specified  conditions and consistent with the nine purposes. In the preamble to the  final rule, CMS also summarized and responded to comments from  numerous stakeholder organizations surrounding the agency’s use and  the release of MA encounter data.
You asked us to provide an update on CMS’s efforts to validate MA  encounter data and its plans and time frames for using these data. In this  report, we identify  1.  CMS steps, if any, to validate MA encounter data taken since our July  2014 report, and describe related stakeholder perspectives, and  2.  CMS plans and time frames, if any, for using MA encounter data  developed since our July 2014 report, and describe related  stakeholder perspectives.
To identify any CMS steps to validate MA encounter data taken since our  July 2014 report, and describe related stakeholder perspectives, we  compared the agency’s activities to the principal activities identified in its  Medicaid encounter data validation protocol, the same criteria we used for  our July 2014 report. We reviewed relevant agency documents and interviewed CMS officials regarding actions taken to ensure the  completeness and accuracy of MA encounter data. Additionally, we  interviewed 11 stakeholder organizations, including health insurance and  provider trade associations, private research and consulting firms, and  federal agencies. We selected stakeholder organizations on the basis of  their prominence in the MA program and the specificity of their written  comments on a 2014 proposed rule that addressed MA encounter data.  Our findings cannot be generalized to all stakeholder organizations.  However, our approach allowed us to obtain the perspectives of a diverse  group of stakeholder organizations with direct experience collecting and  using MA encounter data or with interest in using the data in the future.
To identify any CMS plans and time frames for using MA encounter data  developed since our July 2014 report, and describe related stakeholder  perspectives, we reviewed relevant regulations, agency guidance to  MAOs, and documents available on CMS’s website, and interviewed  agency officials. We assessed agency planning activities in light of  relevant standards for internal control in the federal government. Finally,  we interviewed stakeholder organizations, as described above, and  reviewed stakeholder comments on CMS’s 2014 proposed rule, public  presentations, and reports related to MA encounter data.
We conducted this performance audit from June 2016 to January 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Compared with RAPS data, MA encounter data contain more data  elements, including data on diagnoses not used for risk adjustment.  Specifically, MAOs may enter more diagnoses on each encounter data  submission than on each RAPS data submission and may transmit  encounter data more frequently than RAPS data. (See table 1.) Although  there are a number of differences between RAPS data and encounter  data, an important distinction is a shift in who is responsible for identifying  diagnoses used for risk adjustment. Under RAPS data submissions,  MAOs individually analyze all their claims data and only submit data with  diagnoses that are relevant for risk adjustment. In contrast, for encounter  data submissions, MAOs transmit data to CMS on all enrollee  encounters, regardless of whether the encounter contains diagnoses  used for risk adjustment.
In addition, the encounter data submission process involves a number of  steps and exchanges of information between providers, MAOs, and CMS.  First, MAOs collect encounter data—originating from an enrollee’s  medical record—from providers to manage and process reimbursement  for health care services and supplies for enrollees. After collecting and  reviewing these data, MAOs submit the data to CMS through the  Encounter Data System. CMS then processes and checks the data for  problems. CMS designed the system to reject and return problematic data  to MAOs for corrections. MAOs are expected to work with providers to  correct the encounter files and resubmit the data to CMS. (See fig. 1.)
section_title: CMS Has Made Limited Progress since July 2014 to Validate MA Encounter Data; Stakeholder Organizations Questioned the Effectiveness of CMS Efforts
paragraphs: Since our July 2014 report, CMS has taken additional steps across  several activities to ensure that MA encounter data are complete but has  yet to fully address data accuracy. (See fig. 2)
The agency has taken the following steps, which address primarily the  completeness of encounter data and provide feedback to MAOs on data  submission:
Creating a report card with basic statistics on the completeness  of encounter data for MAOs. This step partially fulfills CMS’s  Medicaid data validation protocol activity to conduct statistical  analyses to assess completeness and accuracy. Analyzing values in  specific data elements and generating basic statistics on the volume  and consistency of data elements can help detect data validity issues.  Agency officials told us they are using the report cards to encourage  MAOs to submit data more frequently and completely. The report  cards contain the following information: quarterly performance indicators. These indicators relate to  submission frequency (such as the percentage of biweekly  periods with submitted data), data volume (such as the numbers  of submitted encounters per 1,000 enrollees), and data quality  (such as rejection rates of data submissions). comparisons with other MAOs. These MAO-specific  comparisons display an MAO’s volume of encounters—overall  and by service type (professional, inpatient, outpatient, and  durable medical equipment)—alongside the regional and national  averages for both MA encounter data submissions and Medicare  FFS claims for each of the past 3 years.
Developing an automated report for MAOs on diagnoses used for  risk adjustment. This step partially fulfills the data validation protocol  activity to summarize findings on encounter data completeness and  accuracy to provide recommendations to MAOs. The automated  report identifies diagnoses from MAO encounter data submissions  that CMS will use to calculate risk scores for the next payment year.  The report is primarily intended to help MAOs ascertain the basis of  enrollee risk scores, though representatives from health insurance  trade associations told us that they have also used the automated  reports to prepare internal financial projections and compare patient  diagnoses between encounter data and RAPS data submissions.  MAOs first received these reports in December 2015, and since then,  CMS has modified the report layout in response to MAO feedback.  According to agency officials, CMS has finalized the initial version of  the automated report and is distributing the automated reports to  MAOs on a monthly basis. Further, the agency intends to make  technical changes as necessary in the future.
According to agency officials, they finalized the protocol for validating MA  encounter data in November 2016 and have begun implementing several  parts of it. In September 2016, CMS awarded a contract to update the  protocol and report annually on the implementation and outcomes of  protocol activities.
The stakeholder organizations we interviewed raised several issues with  CMS’s recent actions to ensure the completeness of MA encounter data.
The main issues mentioned by several stakeholder organizations  included the following:
Errors in identifying diagnoses used for risk adjustment.  Representatives from health insurance trade associations we  interviewed criticized CMS’s process for identifying diagnoses that are  relevant for risk adjustment. First, they stated that MAOs question the  integrity of CMS’s data processing. They noted, for example, that the  automated reports MAOs receive had missing procedure codes for  some encounters where the original data submissions had included  them. CMS told us that they are working with MAOs to make needed  corrections to these reports. Second, representatives said that MAOs  have been unable to replicate CMS’s analyses because CMS has  made adjustments to how it identifies diagnoses eligible for risk  adjustment using encounter data. As a result, they say, MAOs are  unsure whether CMS is properly distinguishing diagnoses that are  used for risk adjustment from those that are not used. When asked  about this concern, CMS officials noted that they publicly announced  how the agency intends to implement the risk adjustment transition in  December 2015, and the methodology has not changed.
Inclusion of encounter data elements considered irrelevant.  Representatives we interviewed from some health insurance and  provider trade associations questioned CMS’s inclusion and checks of  data elements the agency does not use for risk adjustment and which  they contend are irrelevant for the purposes enumerated in the August  2014 final rulemaking. CMS’s Encounter Data System is designed to reject erroneous information by applying a subset of the edits used to  process FFS claims, which are not all relevant to MA encounter data,  according to CMS officials. CMS requires MAOs to make corrections  and resubmit the data for all rejected encounters. Representatives  stated that both MAOs and providers must dedicate significant  resources to meet CMS requirements. In particular, they said MAOs  must alter their data systems and submit numerous requests to  providers for data corrections and medical record reviews. When  asked about this comment, CMS officials noted that the agency wants  encounter data elements to be comparable to FFS claims data.  Although not all of the encounter data elements are used for risk  adjustment purposes, CMS noted that they should be reliable,  comprehensive, and complete in the event they are used for any  authorized purposes.
Technical problems with encounter data submission.
Representatives we interviewed from several health insurance and  provider trade associations reported that MAOs have experienced  difficulties with certain data submissions. They cited, for example,  difficulty with submitting encounters for recurring services, such as  physical therapy. While MAOs and providers typically record such  services as a single encounter, they must submit multiple separate  encounters to CMS for recurring services. Agency officials told us they  had not heard about this problem from MAOs. In addition, stakeholder  representatives mentioned challenges resulting from frequent,  randomly scheduled changes to data submission requirements, which  they say generate costs and confusion. CMS stated that technical  changes occur quarterly, which is typical for other CMS data collection  efforts. Agency officials pointed out that CMS has worked with some  of the larger MAOs to address data submission issues.
Inadequate CMS communication with individual MAOs. Although  some researchers praised CMS officials for their assistance and  support, representatives from several health insurance trade  associations told us that their members are dissatisfied with CMS’s  communication efforts. Representatives noted that CMS’s webinars  are not designed to facilitate a conversation between the agency and  MAOs, and that the email address CMS set up to handle questions  from MAOs does not produce responses that can be shared across  MAOs in a timely fashion. CMS officials told us that its response  time for emailed questions on MA encounter data largely depends on  the complexity of the issue. They said that the agency has not been  able to provide individualized assistance because of resource  limitations, but has recently contracted with an external organization  to provide on-site assistance to MAOs to improve their data  submission processes.
Although CMS has taken several steps to ensure the completeness of MA  encounter data, as of October 2016, the agency had yet to take a number  of other important steps identified in the agency’s Medicaid protocol.  Steps CMS has not taken include the following: establish benchmarks for completeness and accuracy. This step  would address the data validation protocol activity to establish  requirements for collecting and submitting MA encounter data.  Without benchmarks, CMS has no objective standards against which  it could hold MAOs accountable for complete and accurate data  reporting. conduct analyses to compare against established benchmarks.
This step would address the data validation protocol activity to  conduct statistical analyses to ensure accuracy and completeness.  Without such analyses, CMS is limited in its ability to detect potentially  inaccurate or unreliable data. determine sampling methodology for medical record review and  obtain medical records. This step would address the data validation  protocol activity to review medical records to ensure the accuracy of  encounter data. Without medical record reviews, CMS cannot  substantiate the information in MAO encounter data submissions and  lacks evidence for determining the accuracy of encounter data. summarize analyses to highlight individual MAO issues. This step  would address the data validation protocol activity to provide  recommendations to MAOs for improving the completeness and  accuracy of encounter data. Without actionable and specific  recommendations from CMS, MAOs might not know how to improve  their encounter data submissions.
To the extent that CMS is making payments based on data that have not  been fully validated for completeness and accuracy, the soundness of  billions of dollars in Medicare expenditures remains unsubstantiated.  Given the limited progress CMS has made, we continue to believe that  the agency should complete all the steps necessary to validate the data  before using them to risk adjust payments or for other intended purposes,  as we recommended in our July 2014 report.
section_title: CMS Has Detailed Plans for Using MA Encounter Data for Risk Adjustment but Not for Other Purposes, Creating Unease among Some Stakeholder Organizations
subsections: section_title: CMS Plans to Fully Transition to Using MA Encounter Data for Risk Adjustment Purposes by 2020, Generating Mixed Reactions from Some Stakeholder Organizations
paragraphs: Since our July 2014 report, CMS has made progress in defining its  objectives for using MA encounter data for risk adjustment purposes and  in communicating its plans and time frames to MAOs. Although  additional work is needed, CMS has improved its ability to manage a key  aspect of the MA program.
In April 2014, CMS announced that it would begin incorporating patient  diagnoses from MA encounter data submissions into risk score  calculations. For 2015 MAO payments, CMS used encounter data  diagnoses as an additional source of diagnoses to compute risk scores.  CMS supplemented the diagnoses from each enrollee’s RAPS data file  with the diagnoses from each enrollee’s MA encounter data file. For  2016, CMS used a different process that increased the importance of  encounter data in computing risk scores. Specifically, CMS calculated risk  scores as follows:
CMS determined two separate risk scores for each enrollee. CMS  based one risk score on the diagnoses from each enrollee’s RAPS  data file and the other risk score on the diagnoses from each  enrollee’s encounter data file.
CMS combined the two risk scores, weighting the RAPS risk score by  90 percent and the encounter data risk score by 10 percent.
CMS intends to increase the weight of encounter data in the risk score  calculation in the next 4 years so that encounter data will be the sole  source of diagnoses by 2020. (See fig. 3.)
While some stakeholder organizations we interviewed supported CMS’s  time frame for transitioning from RAPS data to encounter data for risk  score calculation, others raised objections to CMS’s planned timeline.  Representatives from several stakeholder organizations we interviewed— primarily research firms and a health insurance trade association—said  that CMS’s time frame was appropriate and that MAOs had adequate  time to adjust their data submission processes. However, representatives  from several health insurance and provider trade associations we  interviewed said that many MAOs and providers are apprehensive about  CMS’s time frame because it does not allow sufficient time for a  successful transition. They told us that many MAOs and providers are still  configuring their encounter data systems. In a December 2015 memo to  all MAOs, CMS noted that, since 2016 will be the fourth year of collecting  encounter data, the transition time frame is a reasonable, modest step  toward ultimately relying exclusively on encounter data as the source of  diagnosis information in risk adjustment. The agency noted that it has  worked with MAOs to correct issues with how the agency applies the  methodology for identifying diagnoses for risk adjustment is applied.
section_title: CMS’s Plans and Time Frames for Using MA Encounter Data for Other Authorized Purposes Remain Undeveloped, Creating Unease among Some Stakeholder Organizations
paragraphs: Although the agency has formulated general ideas of how to use MA  encounter data for some purposes besides risk adjustment, CMS has not  determined specific plans and time frames for most of the additional  purposes for which the data may be used, namely (1) to update risk  adjustment models; (2) to calculate Medicare disproportionate share  hospital percentages; (3) to conduct quality review and improvement  activities; (4) for Medicare coverage purposes; (5) to conduct evaluations  and other analysis to support the Medicare program (including  demonstrations) and to support public health initiatives and other health  care-related research; (6) for activities to support the administration of the  Medicare program; (7) for activities to support program integrity; and (8)  for purposes authorized by other applicable laws. CMS officials  explained that their main priority to date has been to use MA encounter  data for calculating risk scores and that they plan to use the data for other  purposes at a future time. However, this is inconsistent with federal  internal control standards relating to risk assessment and information and  communication that call for clearly defining objectives and communicating  those objectives to key external organizations.
In addition to articulating plans for using encounter data for risk  adjustment, CMS has indicated its interest in using MA encounter data for  additional purposes. As of October 2016, CMS has begun planning for  two of the eight remaining authorized uses: quality review and improvement activities. In April 2016, CMS  awarded a contract to develop quality metrics that represent care  coordination using encounter data. As of September 2016, the  contractor had developed some plans for using encounter data to  develop the metrics but testing and analyzing the data are ongoing. program integrity activities. CMS officials told us they anticipate  including MA encounter data in the Fraud Prevention System to help  identify abusive billing practices, but have yet to fully develop plans for  this proposed use. To date, CMS officials reported that the Center for  Program Integrity has begun using encounter data to determine  improper payments to providers. It conducted a study of the number  of services both paid as FFS claims and submitted as MA encounters.  Additionally, it used encounter data to identify MA providers that were  not enrolled in Medicare.
For the remaining authorized uses of encounter data, CMS reportedly has  developed general ideas, but not specific plans and time frames. For  example, CMS officials told us the CMS Innovation Center has plans to  use MA encounter data to evaluate three demonstration models.  Because these efforts are in their infancy, the officials could not provide  details or specific time frames for these applications of encounter data. In  addition, CMS has released MA encounter data to the Medicare Payment  Advisory Commission and the Department of Health and Human  Services’ Office of Inspector General for research purposes using  standard protocols for releasing FFS data to those agencies. However,  CMS has not yet released the data to other organizations or finalized  protocols for doing so.
Stakeholder organizations we interviewed acknowledged that the agency  has the authority to collect MA encounter data, but some indicated  unease about CMS’s expansion of allowable uses of the data. In addition,  some were concerned about the potential for future expansions because  CMS has not fully defined its plans and time frames for other applications.  In contrast, representatives from both health insurance and provider trade  associations and research organizations noted that the authorized  purposes are within CMS’s purview and that the agency already uses  FFS data for similar purposes. CMS officials told us that some of the  authorized uses are purposefully broad because they want to have some  flexibility to expand their uses of encounter data in the future.
A common point made by all of the stakeholder organizations we  interviewed was the importance of privacy protections for releasing MA  encounter data to researchers and other interested parties. Many  organizations were concerned that CMS might release commercially  sensitive information to external entities. A few also highlighted the  importance of protecting patient privacy. To protect proprietary  information and patient privacy, stakeholder organizations offered the  following suggestions:
Aggregate the data. Representatives from some health insurance  trade associations said aggregating the data on a geographic level,  such as the county or state level, would generally allow MAOs to  remain anonymous. One MAO stated that aggregating the data at the  physician group level would be appropriate. In the preamble to its final  rule, CMS clarified that payment data released to external entities  would be aggregated at the level necessary to protect commercially  sensitive information, such as proprietary payment rates between  plans and providers.
Deny or delay the release of certain data. Representatives from  health insurance and provider trade associations were opposed to  releasing encounter data elements—such as payment or utilization  data—that could be used for anti-competitive behavior. They  proposed delaying the release of encounter data by several years to  protect proprietary information. In the preamble to its final rule, CMS  stated that such delays in releasing the data to external entities would  defeat the purposes of improving transparency in the Medicare  program.
Limit data access. Representatives from health insurance and  provider trade associations and research organizations emphasized  that CMS should implement appropriate safeguards for releasing MA  encounter data to external entities similar to those protections used  for Medicare FFS data. Representatives from three trade associations  argued that encounter data should not be made available to  researchers and other interested parties until the data quality is  assured. In the preamble to its final rule, CMS stated that making  encounter data available to researchers using a process similar to that  applied to FFS data would enhance transparency in the MA  program.
To the extent that specific plans for using the MA encounter data remain  undeveloped, CMS is unable to communicate a set of well-defined  objectives to stakeholders. Furthermore, in the absence of planning for all  of the authorized uses, the agency cannot be assured that the amount  and types of data being collected are necessary and sufficient for specific  purposes. Given the agency’s limited progress on developing plans for  additional uses of encounter data, we continue to believe that CMS  should establish specific plans and time frames for using the data for all  intended purposes, in addition to risk adjusting payments to MAOs, as we  recommended in our July 2014 report.
section_title: Agency Comments
paragraphs: We provided a draft of this report to the Department of Health and Human  Services (HHS) for comment. HHS provided technical comments, which  we incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees and the Secretary of Health and Human  Services. In addition, the report will be available at no charge on the GAO  website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Major contributors to this report are listed in  appendix I.
section_title: Appendix I: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Rosamond Katz (Assistant  Director), Manuel Buentello, David Grossman, and Jessica Lin made key  contributions to this report. Also contributing were Muriel Brown, Christine  Davis, Elizabeth Morrison, and Jennifer Rudisill.