Medicare Home Health Care: OASIS Data Use, Cost, and Privacy Implications
Published: 2001-01-30T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: With the Health Care Financing Administration's (HCFA) implementation of a prospective payment system, efforts to protect patients from potential underprovision of care and to hold home health agencies (HHA) accountable are essential. Instituting the collection and reporting of Outcome and Assessment Information Set (OASIS) data is an important step in that direction. The use of OASIS data enhances consistency in the performance and documentation of patient assessments for home health services. As a result, information on patient outcomes will become available for the first time. Collecting such data is not without its costs. To varying degrees, the requirement to collect OASIS data on all home health patients increases the amount of staff time devoted to collecting and reporting patient assessment information. HHAs have been compensated for some of these costs through adjustments made to their payment rates. Moreover, because prospective payment system episode payment rates are based on historically high utilization levels, which have since declined, these rates should allow the completion of OASIS assessments. Protecting the privacy of home health care patients is also important. HCFA has made progress in this area by enhancing protections in the collection and transmission of the OASIS data. The effectiveness of these policies and procedures will depend on how well they are implemented.

section_title: Letter
paragraphs: Although millions of Medicare beneficiaries receive home health care each year, little is known about the specific services provided during home health visits or their impact on patient outcomes. In addition, from 1990 to 1997 both the number of beneficiaries and the amount of services they received increased sharply, raising concerns about Medicare expenditures and the appropriateness of services being provided. As early as 1987, the Congress began to address the need for greater oversight of home health care by requiring that the Health Care Financing Administration (HCFA) implement an outcome-based quality monitoring system. Ten years later, to address the mounting cost of home health care, the Congress directed HCFA to develop a new payment system for home health care that would shift from cost-based reimbursement to a prospective payment system (PPS).
As part of fulfilling both of these provisions, HCFA has begun requiring home health agencies (HHA) to collect and report data on all their patients using a standardized assessment instrument known as the Outcome and Assessment Information Set (OASIS). However, HHAs have expressed concern that the OASIS data collection requirement is overly burdensome. Also, some patients’ rights advocates contend that the confidentiality of individual patient information may not be adequately protected. HCFA officials respond that the OASIS data are essential to accurately monitor home health care quality and to implement plans to achieve quality improvements, as well as to determine payments for individual patients. Furthermore, the agency has said that the cost and privacy implications of using OASIS are minimal.
The Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of 1999 (BBRA) mandated that we examine the cost and privacy concerns associated with OASIS data collection requirements. We addressed the following key questions in our review: 1.  How does HCFA plan to use the OASIS-generated information? 2.  Since the implementation of OASIS, have patient assessments changed and have additional costs been incurred by HHAs? 3.  What has HCFA done to safeguard the confidentiality of OASIS data?
To answer these questions, we interviewed industry representatives, home health experts, HCFA and state officials, and state surveyors in several states. We also obtained perspectives on OASIS implementation by visiting several HHAs in urban and rural areas and interviewing agencies with reputations for high-quality practices. Because reliable data are not available, we could not obtain a comprehensive accounting of all possible costs associated with complying with the OASIS mandate. Rather, we conducted a survey of a representative sample of 50 HHAs regarding ongoing OASIS-related costs beyond those that the HHAs previously incurred for patient assessments. We asked specifically for the agencies’ estimates of changes in staff time for data collection and reporting and for training new staff. (For more detail on our survey methodology, see app. I.) Finally, we reviewed relevant documents, including HCFA regulations and manuals. Our review was conducted from May 2000 to November 2000 in accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: Medicare’s home health care benefit enables beneficiaries with post-acute- care needs and chronic conditions to receive certain skilled nursing, therapy, and aide services in their homes rather than in other settings. To qualify for Medicare’s home health benefit, a beneficiary must be confined to his or her residence (“homebound”), must be under a physician’s care,and must require physical therapy, speech therapy, continued occupational therapy, or skilled nursing on an intermittent basis. Beneficiaries are not liable for any coinsurance or deductibles for these services and may receive care as long as they meet the eligibility criteria. Until recently, Medicare has reimbursed HHAs for their costs, subject to limits, for services they provide to the program’s beneficiaries.
Between 1990 and 1997, Medicare expenditures for home health services went up three times faster than spending for the program as a whole. This rapid rise has been attributed to many factors, including a liberalization of home health benefit criteria and a lack of sufficient controls to protect the program from potential billing practice abuse. In combination, these factors created conditions where providers could deliver more services than necessary to beneficiaries in order to increase their revenues. In response to these problems, the Balanced Budget Act of 1997 required, by October 1, 1999, the implementation of a new home health PPS, and, until then, the implementation of an interim payment system (IPS) to slow spending growth. The IPS incorporated tighter per-visit cost limits than previously in place and subjected each agency to an annual Medicare revenue cap (based on a per-beneficiary amount and the number of patients it served).
The home health PPS, which replaced the IPS on October 1, 2000, is designed to align payments with anticipated service needs. HHAs now receive a single payment for each 60-day episode of care for a Medicare beneficiary. The base payment is adjusted to reflect patient characteristics that have been shown to affect service use. For fiscal year 2001, the base amount per episode has been set at $2,115, but payment rates range from about $1,100 to nearly $6,000, depending on the functional and clinical severity of each beneficiary. Each episode payment is adjusted for differences in labor costs across geographic areas, and certain extremely high cost episodes receive outlier payments. Once the payment is determined, the amount of service provided to that beneficiary does not change the amount of reimbursement.
In order to qualify as providers eligible to bill Medicare for home health services, HHAs have to comply with the program’s conditions of participation. These standards seek to ensure that HHAs have the appropriate staff, policies, procedures, medical records, and operational practices to deliver acceptable quality care. HCFA contracts with state survey and certification agencies to oversee the adherence of HHAs in their states with these standards. However, our previous work has shown that state agencies’ reviews of HHAs to be certified to provide Medicare services did little to ensure quality care and that there was almost no oversight of the actual care provided to home health patients.
In the Omnibus Budget Reconciliation Act of 1987, Congress mandated that HCFA develop a standardized patient assessment instrument to assist in monitoring HHAs. HCFA used information from years of research and demonstrations in the development of OASIS, which contains 79 demographic, clinical, and functional data items for assessing patients and measuring outcomes. (The process of developing and testing OASIS is described in app. II.) In January 1999, HCFA issued final rules requiring HHAs to conduct comprehensive patient assessments incorporating the OASIS data elements and electronically report the OASIS data collected. The requirement covers most private pay as well as Medicare and Medicaid patients. Collection of the information relies on both observation of patient function by a nurse or therapist and patient responses. For each patient receiving skilled care, the data are generally collected at the initial visit, every 60 days thereafter for the duration of treatment, and at discharge. HHAs report the data to their state survey and certification agencies, which then report the data to a central repository maintained by HCFA.
Concerns regarding the privacy of OASIS information were expressed shortly after HCFA issued its rules on OASIS data collection and reporting in January 1999. Some privacy advocates expressed concerns that some questions were irrelevant or delved too deeply into the personal lives of patients. They cited the mental status questions, including one that asks about depressive feelings reported or observed in the patient, as well as a question regarding financial factors that could limit the patient’s ability to meet his or her own basic health needs.
HHAs, advocacy groups, and others suggested that patient identifiers be removed from OASIS data before transmission to HCFA or that HCFA not require OASIS data to be reported on non-Medicare/Medicaid patients. In the spring of 1999, these concerns led HCFA to postpone the effective date of OASIS reporting until it reviewed the privacy issues involved. The outcome of this review was HCFA’s decision to leave the OASIS assessment instrument intact. HHAs would continue to be required to collect all OASIS information on all patients, because HCFA believes it is valuable to HHAs in patient assessments and care planning. However, HCFA put limits on the transmission of certain OASIS data elements, and it has postponed data reporting, but not collecting, for non- Medicare/Medicaid patients.
Under the new conditions of participation effective July 1999, HHAs participating in Medicare must (1) incorporate OASIS data items into the assessment process for Medicare, Medicaid, and private pay patients, (2) electronically transmit accurate OASIS data to the state survey agency or HCFA OASIS contractor, and (3) maintain the privacy of their OASIS data.
section_title: OASIS Designed for Quality Monitoring and Payment Purposes
paragraphs: The OASIS data instrument serves both to monitor home health care quality and to adjust payments to account for differences in patient characteristics. To enhance quality of care, HCFA plans to use the OASIS data to guide its oversight of HHA activities, to provide each HHA with information about its patients’ outcomes compared to those of other HHAs, and to guide the selection of HHAs by patients and physicians. OASIS data affect payments to HHAs both in determining the payment made for current patients and in providing data to analyze possible modifications to the current payment system.
subsections: section_title: OASIS Data Intended to Improve Medicare Oversight and HHA Practices
paragraphs: HCFA proposes to use OASIS data to promote higher-quality home health care by (1) guiding the oversight of HHAs performed by state survey and certification agencies, (2) giving HHAs comparative information that they can use to improve their own practices, and (3) providing information to patients and referring physicians that will help them to choose HHAs that achieve better outcomes. Although none of these approaches has been implemented, planning for the first two is under way, and the third is to be developed in the future.
HCFA intends to use OASIS data to strengthen its oversight of state survey agency monitoring of HHA outcomes. It requires the state survey agencies to examine the OASIS data in preparation for surveys of individual HHAs.Survey agencies have begun checking the OASIS data submitted by HHAs in their states to ensure HHA compliance with OASIS reporting requirements. HCFA expects the survey staff to review OASIS-based reports to identify indicators of potential concern (such as high rates of infection) that would warrant further investigation and ongoing monitoring.
When HCFA mandated that HHAs begin collecting OASIS data, it emphasized that this requirement was intended to set in motion a process of continuous quality improvement within each HHA. Based on the OASIS data collected, each HHA will be granted electronic access to customized reports displaying its own patients’ outcomes in relation to those of home health patients nationally, with statistical adjustments to take account of the clinical characteristics of the patients served by that agency. The HHA will be able to examine outcomes for specific types of care (such as wound care and pain management) and types of patients (such as those with diabetes or those recovering from surgery). This way, each agency will be able to assess its performance over time and compare it to national benchmarks. These reports will enable HHAs to identify areas where their performance was suboptimal and thus provide a basis for planning initiatives to improve patient health status.
The first reports, based on the OASIS data that have been collected nationwide since July 1999, show individual HHAs the demographic and clinical profiles of their patient population and adverse events. These reports are expected to be available by late January 2001, followed by detailed risk-adjusted outcome reports in 2002. Before the reports are made electronically accessible to the HHAs, OASIS education coordinators in each state will provide training and technical assistance for HHAs on how to analyze and act on the information. In addition, HCFA has funded a 2-year pilot project in five states to explore the feasibility of using peer review organizations to help HHAs in interpreting their reports and developing from them effective quality improvement initiatives.
Another way HCFA plans to use OASIS data to promote quality is by providing information to assist physicians and patients in selecting HHAs. HCFA expects that making such comparative information on outcomes publicly available could encourage HHAs to compete for patients on the basis of the quality of care they provide. HCFA has recently initiated planning on how to release this information. The first step will be to evaluate alternative approaches for presenting and distributing these data to the public. One current example of HCFA’s efforts to share comparative information on Medicare providers is its “Nursing Home Compare” Web site. This site has information on facility and resident characteristics of nursing facilities as well as deficiencies reported in past survey inspections, though not on patient outcomes.
section_title: OASIS Data Critical to Adjusting HHA Payments and Improving PPS Formulas
paragraphs: A second major use of OASIS data collection is payment-related. Under the home health PPS, HHAs receive a specified payment per beneficiary for each 60-day episode of care. HCFA uses OASIS data to assign patients to one of 80 relative payment levels, called home health resource groups. This assignment is based on 23 patient descriptors from the OASIS assessment that measure clinical condition, functional status, and service utilization. Each payment group is assigned a relative weight that reflects the cost of the average beneficiary in that category relative to all home health care users.
In addition to providing information necessary to implement the home health PPS in its current form, OASIS data will assist HCFA in (1) monitoring the effects of prospective payment on quality of care and (2) developing potential refinements in the formulas used to determine payments. Because of the change from cost-based reimbursement to prospectively determined payments for each episode of care, PPS creates a financial incentive to limit services per episode and increase the number of episodes billed. HCFA has pledged to undertake monitoring of OASIS data, along with data from other monitoring systems, as part of a surveillance system designed to assess the short- and long-term effects of PPS. For example, OASIS data should enable HCFA to detect unfavorable trends in outcomes for home health care patients, such as delayed or diminished recovery from a stroke.
Questions have been raised about the potential vulnerability of the OASIS data to manipulation intended to maximize provider payments. HHAs could benefit financially from making their patients appear as sick and functionally impaired as possible when initially assessed, in order to be assigned a higher payment group. HCFA was aware of the risk of “gaming” and sought to minimize this risk when it selected the specific OASIS data elements used to assign patients to different PPS payment groups. The Medicare Payment Advisory Commission has nonetheless expressed concern that the OASIS assessments submitted to HCFA will reflect these financial incentives to exaggerate patient severity at admission. To address concerns about data quality, HCFA has undertaken an accuracy demonstration program. This program will evaluate alternative methods to ensure the accuracy of the OASIS data submitted by HHAs. In addition, state surveyors will check a sample of patient assessments against medical records.
Medicare fiscal intermediaries—contractors to HCFA that process HHA claims for payment—are also expected to use OASIS data. The information will help them decide which HHAs to include in focused medical reviews that determine the appropriateness of payment of individual claims for home health services provided to beneficiaries. One aspect of this review strategy involves determining whether OASIS information is supported by documentation in the medical record. If the intermediaries determine that the OASIS data are not appropriate, they will adjust the payment grouping accordingly.
subsections: section_title: Almost All OASIS Data Elements Collected Will Be Used for Quality or Payment Purposes
paragraphs: HCFA has sought to limit the amount of OASIS data collected to that needed for monitoring quality and payment purposes. The research group that developed OASIS under contract to HCFA—the University of Colorado Center for Health Services and Policy Research (CHSPR)— explicitly set out to identify the key data elements that would enable HHAs to measure their outcomes while minimizing the data collection burdens. CHSPR identified a set of 73 core data items needed both to compute quality indicators and to risk-adjust the outcomes reported. (See app. II for more details on this process.) An advisory group appointed by HCFA reviewed CHSPR’s core data set. This Standard Assessment work group was made up of 13 members, including HHA administrators, practicing clinicians, a clinical assessment expert, a state official, and representatives of industry and professional organizations. It recommended that HCFA adopt the core data set, with the addition of several more elements. The feasibility of collecting and using OASIS data was subsequently tested in two demonstration studies that documented improved outcomes for the participating HHAs.
Nearly all the OASIS data elements that emerged from this process will be used to generate the specific outcome measures presented in the HHA customized quality improvement reports. Six of the 79 items currently have no intended use. Four of these, described as “potential risk adjustment factors,” assess environmental and safety issues in the patient’s home, and another item relates to the patient’s financial ability to meet treatment needs. All four were among those added to the data set at the behest of HCFA’s advisory work group. Concerns were subsequently raised by some privacy advocates about the sensitivity of some of these data elements. The financial question in particular was so sensitive that HCFA decided to exclude it from the data transmitted by the HHAs to the states. However, HCFA maintained the obligation of the HHAs to obtain this information for all home health patients.
HCFA also required the HHAs to collect, but not initially transmit, OASIS information on patients receiving skilled care who were not covered by Medicare or Medicaid. HCFA has stated that it is important to collect OASIS data on patients served by HHAs from all payor sources in order to evaluate the quality of care provided. In addition, HHS must ensure that the conditions of participation are adequate to protect all individuals under the care of the HHA. Although HCFA has developed techniques for masking the identity of non-Medicare/Medicaid patients, it has postponed having these data transmitted to the state repositories. HCFA officials told us that the notice to begin transmission of these data could be published in the spring of 2001. HCFA will not, however, require retroactive transmission of the OASIS data collected from non-Medicare/Medicaid patients. Instead, HCFA will notify HHAs to transmit only current assessments on non-Medicare/Medicaid patients.
section_title: Assessments More Consistent Using OASIS, but HHAs Say Requirements Add Time
paragraphs: Incorporating the OASIS data instrument into comprehensive patient assessments has increased the consistency of patient data collected by the HHAs. In contrast to HCFA’s expectation that HHAs would take no more time to conduct start-of-care visits using OASIS, nearly all respondents in our survey of HHAs estimated that start-of-care visits take longer than they did before. These HHAs also reported that additional time is needed to check and edit collected OASIS data, enter and transmit the information electronically, and train new staff.
subsections: section_title: OASIS Mandate Requires More Consistent Documentation of Patient Assessments
paragraphs: The initiation of home health care requires two separate but related steps: performing a comprehensive assessment of the patient’s condition and, based on that assessment, devising the patient’s plan of care. Before the OASIS mandate took effect, Medicare rules required HHAs to perform both of these steps, but called for specific documentation for the plan of care only. Now they require the collection and reporting of the OASIS assessment data for each patient as well as plan-of-care documentation. Thus, what constitutes a comprehensive assessment under the long- standing requirement is now more clearly defined for HHAs.
According to HHA and state officials, the assessments that HHAs performed in the past varied in both scope and format. They told us that while some agencies may have conducted thorough evaluations of their patients, others performed more cursory or narrowly focused assessments. Likewise, HHA documentation practices could vary substantially. For example, some agencies wrote narrative descriptions of the patient’s condition, and others may have developed more structured instruments with short answers or checklists. The effect of the OASIS mandate on each HHA depended on how different its previous practices in conducting and documenting patient assessments were from the current OASIS data collection and reporting requirements.
section_title: OASIS Requires Additional Time for Multiple Activities
paragraphs: HCFA has cited data from selected HHAs in an OASIS demonstration project to support its expectation that OASIS’ standardized, multiple- choice format would take no more time to complete than prior documentation of assessments, which typically involved individual narratives. However, data we collected through interviews and a survey of HHAs suggest that OASIS did result in an increase in time spent in initial care visits and additional time for new tasks associated with transmission of data.
To provide a basis for cost estimates, as required by regulation, HCFA asked CHSPR to assess the OASIS data collection costs on HHAs, in particular the additional staff time required. Of special concern was the start-of-care comprehensive assessment, when clinicians would have to obtain answers to all the OASIS questions from a new patient for the first time.
CHSPR gathered data from 10 agencies participating in a HCFA-sponsored study. Overall, CHSPR found that the median total time taken by these HHAs for start-of-care visits using OASIS was 150 minutes, a few minutes less than start-of-care visits without OASIS. In a second study, Abt Associates measured the time taken for start-of-care visits with a longer version of OASIS, but recorded only the time spent in the patient’s home and not time spent on associated paperwork performed elsewhere. This study of more than 20,000 visits found that start-of-care visits using OASIS required a median of 90 minutes. However, there were no comparable data from start-of-care visits without OASIS.
In contrast to the CHSPR study, officials of the 32 agencies responding to our survey of a representative sample of Medicare HHAs estimated that start-of-care visits incorporating OASIS assessments did take more time than those conducted prior to OASIS. The median total time estimated to complete start-of-care visits with OASIS was 150 minutes, matching the figure obtained in the CHSPR study. However, HHAs reported that this amount represented a median increase of 40 minutes relative to time for start-of-care visits prior to OASIS.
In each of these studies, data from individual HHAs on the amount of time required for start-of-care visits with OASIS varied widely. This variation may reflect differences in how responding HHAs have integrated the new assessment instrument and how it is administered in the patient’s home. Many of the HHAs we interviewed told us that they had followed HCFA’s instructions to replace items requesting similar information on their patient assessment forms with OASIS items. However, one agency had not yet completed this task, requiring the nurse conducting an initial visit to complete the OASIS form separately. To varying degrees, clinicians administer the OASIS assessment through a combination of questioning, examining the patient, and observing patient behavior and home environment.
HHAs also have to perform new tasks related to the submission of OASIS data to the state repositories in electronic form. Both the mandate for HHAs to collect and report OASIS data and the transition to prospective payment based on OASIS information have heightened the concern of HHAs with the validity and completeness of these data. To help ensure that patient assessments are correctly recorded in a form that HCFA’s data repositories will accept, HHAs need to review the data as they proceed from initial recording by the clinician to electronic transmission to the state repository. The steps in this process include the following:   Heightened supervisory review of the assessment forms completed by the clinician performing the assessment.
Entering, rechecking, and correcting OASIS data from paper records into the computerized records.
Batching and then electronically transmitting the data to a centralized state data repository. (The transmission protocol established by HCFA rejects data that do not pass tests for consistency and validity. Any data rejected have to be analyzed, corrected, and resubmitted.)
The HHAs we surveyed estimated that these steps require approximately 50 minutes per OASIS assessment.
HHAs must also commit resources to training newly hired clinicians on OASIS protocols. Eighty-four percent of our survey respondents said they provide training for newly hired staff, with modules focused specifically on OASIS data collection and documentation. Those HHAs offering OASIS- related training reported providing a median of 8 hours to new staff. However, how much additional time is due specifically to the OASIS requirement is not clear, because OASIS-related training could substitute for some prior assessment-related training as well as add new elements.
Many HHAs may find that their additional OASIS-related costs are offset by payments they receive under the new payment system. We recently reported that PPS payment rates are based on 1998 rates of home health care utilization, which have since declined. Therefore, they are likely to be generous in comparison with current use patterns. In our view, the episode payments could provide an ample cushion for many agencies, which can be used to offset the costs associated with the OASIS mandate.
In addition, Congress and HCFA have taken several actions to assist HHAs in complying with OASIS mandates. For example, for each Medicare beneficiary served from October 1, 1999, to September 30, 2000, Congress provided HHAs with $10 to help defray OASIS costs. Also, the prospective payment base was increased by $4.32 per 60-day episode as an ongoing adjustment for OASIS reporting costs. HCFA has taken other steps to reduce the costs imposed on HHAs by the OASIS mandate. These include the development and distribution free-of-charge to HHAs of a software program (called HAVEN) to use in transmitting the OASIS data to state agencies. HCFA has also provided toll-free telephone lines to the HHAs for this data transmission.
section_title: HCFA’s Data Safeguards Aim to Ensure Patient Privacy
paragraphs: HCFA has instituted several policies and procedures to protect OASIS data from unauthorized access, conceal the identity of patients, and ensure that recipients of OASIS information protect confidentiality. HCFA officials believe that these actions provide reasonable assurance that the privacy of OASIS information will not be compromised. As we previously reported, ensuring that users of confidential health data, including OASIS data, comply with required privacy procedures is also a necessary safeguard.
subsections: section_title: Safeguards Established to Prevent Unauthorized Access to Patient Information
paragraphs: As with all patient medical data, HHAs must ensure the privacy of OASIS information. Even before OASIS was mandated, HHAs participating in Medicare had to develop policies and procedures to maintain the confidentiality of patient information. Several state surveyors we interviewed said that, as part of their inspections, surveyors examine how all patient records, including the OASIS forms, are maintained in the HHA’s administrative offices.
The new privacy requirements under Medicare conditions of participation call for the HHA (and any agent acting on its behalf, such as a software vendor) to ensure the confidentiality of all patient information contained in the clinical record, including OASIS data. This requirement also prohibits the HHA and its agents from releasing patient-identifiable OASIS information to the public. In addition, HHAs are required to provide beneficiaries and other patients with an OASIS statement of privacy rights upon admission to the HHA. These OASIS privacy notices inform patients about their rights relating to their personal health information, in language that is intended to be clear and easy to understand. HCFA reported that consumer testing of Medicare beneficiaries indicated that they understood that the notice was informing them about their rights relating to their personal health care information.
HCFA has also implemented data transmission and storage policies to protect the information while it is in transit to, and being stored at, state agencies and HCFA. These mechanisms include required use of a secure communications network to protect the data while in transit, as well as technology designed to make information unintelligible should unauthorized persons access it. Further, HCFA requires that certain patient identifiers associated with non-Medicare/Medicaid patients be “masked” so that state agencies and HCFA will be unable to determine the identity of these individuals. Although HCFA has developed techniques for masking the identity of patients, it has postponed having these data transmitted to the state repositories. Similarly, HHAs are not to transmit the response to the question as to whether the patient has sufficient financial resources to pay for medicine, food, and other essentials. (Details about HCFA’s data transmission and storage protections are discussed in app. III.)
Once the OASIS information is transmitted to HCFA, it is maintained in a national repository, where specific disclosure policies apply. HCFA is bound by the requirements of the federal Privacy Act (P.L. 93-579) in protecting the confidentiality of all health information on beneficiaries, including OASIS information. The Privacy Act allows the disclosure of information without an individual’s consent for “routine uses” that are consistent with the purposes for which the information was originally collected. The routine uses of OASIS information include aiding in the administration of the HHA survey and certification process.
Persons who request OASIS data, such as researchers and members of peer review organizations, must agree to protect the confidentiality of the information as part of a written “data use agreement.” Data use agreements must also be in place between HCFA regional offices and the state’s Medicaid agency before the state’s OASIS agency can release the information to the Medicaid agency. In addition, HCFA officials told us that it is departmental policy to release only the “minimum necessary” data to meet the requester’s purpose.
section_title: Privacy Protections Could Be Further Enhanced
paragraphs: HCFA believes that the policies and procedures it currently has in place provide it with reasonable assurance that the confidentiality of any OASIS information released to approved entities will be maintained. However, in a July 1999 report we identified several weaknesses in HCFA’s privacy practices that could potentially compromise the confidentiality of health information on Medicare beneficiaries. Although we found that HCFA’s policies and procedures regarding disclosure of personally identifiable information were generally consistent with the provisions of the Privacy Act, weaknesses in the implementation of these policies raised concerns. For example, we found that HCFA was not always clearly informing beneficiaries of the purposes for which their information may be disclosed, as required by the Privacy Act. We also found that HCFA did not routinely monitor contractors and others, such as researchers, who use personally identifiable Medicare information. We recommended that HCFA take steps to address these weaknesses.
HCFA has taken steps regarding protection of its OASIS data. As stated above, HCFA has required HHAs to provide both Medicare/Medicaid and private pay patients with OASIS privacy notices. The beneficiary notice lists the patient’s primary rights and gives the patient information as required by the Privacy Act, such as HCFA’s authority for collecting OASIS data and the principal purposes for which the information would be routinely used.
However, based on our discussions with HCFA and state officials, there appears to be little or no oversight of how effectively the state agencies and third parties are maintaining the privacy of OASIS information. Even though HCFA requires state agencies to ensure that access to OASIS data is restricted and that recipients of OASIS information protect its confidentiality, HCFA officials told us that they do not inspect the privacy safeguards in place at the state agency. These officials also indicated that HCFA still has no system in place to monitor whether parties subject to data use agreements are complying with their requirements. Without an adequate monitoring system in place, HCFA could be hampered in its attempts to prevent the occurrence of problems and provide timely information and corrective action for any that might occur.
section_title: Concluding Observations
paragraphs: With the implementation of a prospective payment system, efforts to protect patients from potential underprovision of care and to hold HHAs accountable are essential. Instituting the collection and reporting of OASIS data is an important step in that direction. The use of OASIS data enhances consistency in the performance and documentation of patient assessments for home health services. As a result, information on patient outcomes will become available for the first time.
Collecting such data is not without its costs. To varying degrees, the requirement to collect OASIS data on all home health patients increases the amount of staff time devoted to collecting and reporting patient assessment information. HHAs have been compensated for some of these costs through adjustments to their payment rates. Moreover, because PPS episode payment rates are based on historically high utilization levels, which have since declined, these rates should allow the completion of OASIS assessments.
Protecting the privacy of home health care patients is also important. HCFA has made progress in this area by enhancing protections in the collection and transmission of the OASIS data. The effectiveness of these policies and procedures will depend on how well they are implemented.
section_title: Agency Comments
paragraphs: We provided a draft of this report to HCFA for review. It its comments, HCFA agreed with our findings and conclusions and elaborated on several points addressed in the report. HCFA continues to believe that, once HHA staff learn how to implement OASIS, the amount of time it takes to conduct a thorough patient assessment will decline. The agency contends that, as experience with OASIS is gained, HHAs will be better able to integrate use of the instrument into their ongoing administrative and clinical activities. In addressing the use of OASIS for payment purposes, HCFA considers the OASIS data elements to be crucial to refining payment rates, and if data collection were limited to those elements currently needed for payment, its ability to refine PPS in the future would be constrained. Regarding our discussion of data confidentiality protections, HCFA highlighted several specific steps it has taken to ensure patient privacy. HCFA’s comments appear in appendix IV. The agency made technical comments that we incorporated where applicable.
We are sending copies of this report to the Honorable Robert A. Berenson, Acting Deputy Administrator of HCFA, and others who are interested. We will also make copies available to others on request. Rosamond Katz, Eric Peterson, and Victoria M. Smith developed the information contained in this report. Please contact me at (202) 512-7119 if you or your staffs have any questions.
section_title: Appendix I: Methodology for Survey of Home Health Agencies
paragraphs: To gain the perspective of a representative segment of HHAs with respect to the cost and privacy implications of the OASIS mandate, we surveyed a random sample of HHAs. This appendix describes how the survey was conducted and discusses the strengths and limitations of the information provided.
subsections: section_title: Survey Design
paragraphs: Determining how much it has cost HHAs to implement HCFA’s mandate to collect and report OASIS data on individual patients is complex, for three main reasons. First, the OASIS mandate could lead to additional costs in many different areas, including additional staff time to perform a variety of tasks. HCFA required that the OASIS items be integrated with other assessment forms, which could involve the development of both new forms and new procedures to complete them. The process of encoding and transmitting the OASIS data electronically led many HHAs to expand their use of computers, which could have called in turn for capital investments and the recruitment of new staff.
Second, the home health care industry was undergoing radical change. The ongoing transition from cost-based reimbursement to prospective payment fundamentally altered the financial circumstances and incentives of many agencies. The characteristics of patients seeking and receiving home health care may also have changed as a result. Staff recruitment, training, computerization, and revamped procedures were all affected by these market and payment-related changes as well, making it very difficult to isolate an independent effect from the OASIS mandate.
Third, no cost data specifically linked to patient assessment activities were systematically and consistently maintained either before or after the implementation of the OASIS mandate. Instead, such activities are integrated into the clinical and administrative functions of HHAs. Thus any attempt to estimate the specific effect of OASIS on costs necessarily would involve some reconstruction of such data after the fact.
Our survey of HHAs was designed with these factors in mind. Rather than attempt to obtain a comprehensive accounting of all possible OASIS- related costs, we focused on the additional time spent on four major activities that appeared from our preliminary interviews with HHA officials to have had a substantial effect on total costs:   Clinicians’ total time for the start-of-care visit,   Supervisors’ time reviewing and monitoring patient assessment data   Time for training new hires on OASIS, and   Time entering and transmitting OASIS data electronically.
We asked the executive directors of the HHAs we surveyed to provide both current and pre-OASIS time figures from more than a year ago. It is common for agencies to maintain logs with time spent at different types of visits. While most HHAs said they were able to draw on relevant and specific recorded data, others provided rough estimates. However variable in quality, these data recorded by the HHAs for their own purposes represent the best available data we found for estimating the cost implications of the OASIS mandate.
section_title: Sample Selection
paragraphs: To select our sample, we used 1999 data extracted from HCFA’s Provider of Service File and associated claims data. We started with a list of each HHA that had been paid for at least one Medicare home health visit in 1999. We excluded those agencies that had not begun providing home care under Medicare prior to January 1, 1999, and those that served fewer than 15 Medicare patients in 1999. We then selected a simple random sample from the remaining agencies. Thus, the sample represents the universe of HHAs, not patients.
Although our sample was not stratified, we did take precautions to ensure that the agencies in the sample did not have a highly skewed distribution along several major dimensions. Specifically, we observed the distribution among all the HHAs in our sampling universe for five characteristics— caseload size (number of Medicare patients treated annually), urban/rural, geographic region, organizational affiliation (Visiting Nurse Association (VNA), facility-based, freestanding), and tax status (nonprofit, for-profit, government). (See table 1.) We then took a series of independent random samples of 50 agencies each. (Every agency had an equal chance of being selected for each of these samples.) We used the sample that best matched the distribution found in the sampling universe.
section_title: Sample Response Rate
paragraphs: We received usable responses from 32 HHAs. Three of the 50 surveyed had ceased to operate as separate agencies, either by going out of business or by merging with another entity. That gave us an effective response rate of 68 percent (32 out of 47). As shown above, the respondent group generally matched the characteristics of the sampling universe and the sample. The main exception was an underrepresentation of the Northeast region and overrepresentation of the West. Facility-based agencies were also somewhat overrepresented among the respondents compared to freestanding HHAs.
Because our sample was randomly selected, it provides unbiased estimates of the results we would have received had we been able to survey the entire universe. Still, a sample of 50 (with 32 respondents) is likely to have considerable sampling error compared to that of a larger sample. The standard errors and 95 percent confidence interval for the main survey items presented in the report are provided below. These confidence intervals indicate the range within which there is a 95 percent chance the mean would fall if the full universe had been surveyed. They therefore show that there is imprecision in the estimates of the means due to the relatively small size of our sample. For example, the estimate for the mean time required for start-of-care visits using OASIS was 143 minutes, but the 95-percent confidence interval for that estimate ranged from 125 minutes to 160. In the text of the report we chose to present medians rather than means, since they are less sensitive to outliers. Table 2 below shows both means and medians.
section_title: Potential Measurement Error
paragraphs: Apart from the imprecision introduced by sampling considerations, numerous factors are likely to have influenced the estimates provided to us by the HHAs we surveyed:   The surveyed HHAs varied in the extent to which they relied on written records to calculate the amount of time taken for start-of-care visits pre- and post-OASIS. We asked them to draw on such records if possible, but available records varied from one agency to another.
To the extent that the respondents believed that higher estimates of time spent on post-OASIS visits might promote more generous payments for home health care under Medicare, there could be an upward bias in the figures provided.
The comparison of current visit times with those preceding the OASIS mandate incorporates the effects of all the changes that affected home health care over that period, such as shifts in payment methods and amounts by Medicare and other payers, fluctuations in market demand for nursing and therapist staff, and the sharp decline in the number of agencies providing care (following an earlier period of rapid growth), as well as OASIS.
section_title: Appendix II: Development and Testing of the OASIS Data Set
paragraphs: OASIS was developed by the University of Colorado Center for Health Services and Policy Research (CHSPR) for the purpose of measuring home health care outcomes. This effort involved first a review of the existing approaches for assessing the quality of home health care, including both a literature review and consultations with clinical experts. A series of studies examined the data that could be obtained from clinical records as well as secondary data sources such as Medicare claims and plan-of- treatment forms. The subsequent empirical testing of candidate measures collected data from 3,427 Medicare and non-Medicare patients treated in 49 HHAs.
The data elements collected were tested for their statistical reliability. The measures based on those data elements were assessed on a range of criteria, including their clinical meaningfulness (as judged by clinical review panels), coverage across multiple dimensions of health status, minimization of redundancy, and ability to detect differences among HHAs. At the end of this process, CHSPR arrived at a set of 73 core data items needed both to compute core quality indices and to adjust the outcomes reported for different agencies to take account of relevant differences in the circumstances of the patients that they treat (that is, risk adjustment).
In late 1994, HCFA convened a 13-member Standard Assessment work group made up of HHA administrators, practicing clinicians, a clinical assessment expert, a state official, and representatives of industry and professional organizations. Its charge was to assess CHSPR’s core data items for inclusion in a patient assessment instrument to be mandated under revised conditions of participation for HHAs under the Medicare program. This group recommended that HCFA adopt the core data items with modifications. Specifically, they suggested that HCFA expand three of the data elements, convert one item to three more detailed items, and add eight new items, including cognitive functions, financial ability to meet treatment needs, and hearing, speech, and vision capabilities.
This expanded core data set, now named OASIS, was then tested in several demonstration studies conducted by CHSPR. Beginning in 1995, a group of 50 HHAs nationwide, plus another 67 in New York State, were selected to see whether HHAs could in fact use OASIS assessments to identify dimensions of care with suboptimal outcomes and then take measures to improve those outcomes. Empirical testing of the OASIS data and measures continued, including a second round of reliability assessments. In addition, a demonstration conducted by Abt Associates also collected OASIS data elements for the purpose of identifying appropriate criteria for setting rates in a home health PPS. A separate set of reliability assessments took place as part of this study. The interim results published by Abt and CHSPR indicate that the OASIS data set is generally reliable, although a few data items had poor reliability according to the standards adopted in these studies. Both CHSPR and Abt are planning to report additional reliability results based on larger numbers of patients, but these findings are not yet available.
The Medicare Quality Assurance Demonstration and the New York State Outcome Based Quality Improvement Demonstration showed that HHAs could use OASIS data to improve home health care outcomes. Based on their initial OASIS results, the HHAs examined their processes of care in order to develop plans of action designed to enhance two specific outcomes: reducing the hospitalization rate of their patients, and another outcome selected by each participating HHA. Overall, the rate of hospitalization among patients treated by the Medicare Quality Assurance Demonstration HHAs declined in one year from 31.4 percent to 28.3 percent, a decrease of 10 percent. The corresponding decline in hospitalization rates among patients in the New York State Demonstration HHAs was 9 percent. However, no similar decrease in hospitalizations was observed for home health patients nationally during this period. Thus HCFA concluded that outcome-based quality improvement initiatives adopted by the demonstration HHAs were effective in achieving their stated objective.
section_title: Appendix III: OASIS Data Privacy Protections
subsections: section_title: Privacy Act Protections Applicable to OASIS
paragraphs: In protecting the confidentiality of health information of its beneficiaries, HCFA’s activities, like those of other federal agencies, are governed by the Privacy Act of 1974 (5 U.S.C. 552a, P.L. 93-579). The Privacy Act requires that agencies limit their maintenance of individually identifiable records to those that are relevant and necessary to accomplish an agency’s purpose. Federal agencies store personally identifiable information in systems of records—a group of records, under the control of a federal agency, from which information can be retrieved by the name of an individual or an identifier such as a number assigned to the individual. As of November 2000, HCFA had 47 systems of records related directly to Medicare beneficiaries containing information stored in both electronic and paper form. HCFA stores personally identifiable data on a Medicare beneficiary’s enrollment and entitlement to benefits; demographic information such as age, race, ethnicity, and language preference; and diagnoses and utilization of medical services.
The Privacy Act generally prohibits the disclosure of individuals’ records without their consent. However, it allows the disclosure of information without an individual’s consent under 12 circumstances called conditions of disclosure, such as disclosure by a federal agency to its employees based on their need for records to perform their duties. Another condition of disclosure allows an agency to establish “routine uses” that the agency has determined to be compatible with the purposes for which the information was collected.
In accordance with the requirements of the Privacy Act, HCFA issued a notice in June 1999 that it was establishing a new system of records to contain OASIS data. In this notice, HCFA outlined several precautionary measures it was taking to minimize risks of unauthorized disclosure. For example, HCFA stated that it will collect only that information necessary to perform the functions for which it plans to use the OASIS data, such as creating patient outcome reports for HHAs. Similarly, HCFA said it will disclose only the minimum amount of OASIS data necessary to achieve purposes compatible with these functions. All patient-specific information is to be kept confidential, with access limited to ensure that privacy remains protected.
Also included in the notice are the details regarding the scope of the data collected and HCFA’s policies and procedures regarding disclosures for the following routine uses of OASIS data:   Aid in the administration of the survey and certification of   Enable regulators to provide HHAs with data for their internal quality   Support agencies of the state government to determine the overall effectiveness and quality of HHA services provided in the state,   Aid in the administration of federal and state HHA programs within the   Monitor the continuity of care for patients who reside temporarily outside   Support regulatory, reimbursement, and policy functions,   Support constituent requests made to a congressional representative,   Support litigation involving the agency, and   Support research projects related to disease prevention or health maintenance.
In its notice, HCFA listed seven entities who may receive disclosures of OASIS data under HCFA’s routine use exception: (1) Department of Justice, court or adjudicatory body, (2) agency contractors or consultants who have been engaged by the agency to assist in the performance of a service related to the OASIS system of records and who need to have access to the records in order to perform the activity, (3) an agency of a state government, or established by state law, (4) another federal or state agency (including state survey agencies and state Medicaid agencies) for contributing to the accuracy of HCFA’s health insurance operations and/or for supporting state agencies in the evaluations and monitoring of care provided by HHAs, (5) a peer review organization, (6) an individual or organization for research purposes, and (7) a member of Congress or congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
section_title: Other OASIS Data Privacy Protections
paragraphs: In addition to Privacy Act protections, beneficiaries are afforded confidentiality protections under the HHA conditions of Medicare participation. For example, HHAs and their agents cannot release OASIS information that identifies particular patients to the public. Additionally, patients have the following rights: (1) the right to know why the HHA is asking the OASIS questions, (2) the right to have their personal health care information kept confidential, (3) the right to refuse to answer questions, (4) the right to look at, and request changes to, their personal assessments, and (5) the right to be informed that OASIS information will not be disclosed except for legitimate purposes allowed by the Privacy Act.
HCFA has established additional methods to ensure the security of OASIS information while in transit and in storage. First, HCFA will retain information on individuals who have non-Medicare/Medicaid payment sources in a format that does not identify particular patients. For these patients, the HHA will submit OASIS information with certain patient identifiers “masked.” According to HCFA officials, masking involves obscuring items such as the patient’s name, Social Security number, and HHA patient identification number, while still allowing data for individual patients to be linked. These officials told us that they cannot decode masked identifiers or re-identify the information based on nonmasked identifiers, and therefore neither the state nor HCFA will know the identity of the non-Medicare/Medicaid patients who are the subjects of transmitted OASIS information.
Second, HHAs are currently required to submit OASIS data through a private telephone line. HCFA officials told us that they required HHAs to transmit OASIS data via the Medicare Data Communications Network (MDCN) as of October 1, 2000. The MDCN system includes an encryption standard for increased protection from unauthorized access while the data are in transit. According to HCFA officials, the MDCN’s 128-bit encryption standard will guard against unauthorized access to OASIS data, such as by computer hackers, while in transit.
HCFA and state OASIS automation coordinators also told us that the use of the MDCN network is subject to numerous password protections. In order to access the MDCN, a user needs to know three different items of information, all of which are subject to confidentiality policies: (1) the phone number of the MDCN network, (2) the individual user identification number and password for the MDCN, and (3) the HHA-specific user identification code and password for the applicable state system. In addition, the MDCN passwords must be changed on a periodic basis.
Third, according to HCFA officials, the agency has implemented physical safeguards and record retention policies to reduce the risk of unauthorized access over time. For instance, the HCFA OASIS data computer server is kept in a secure room, and only personnel with designated access may enter. HCFA officials told us that although they do not inspect the privacy safeguards in place at the state level, guidelines issued to the state agencies require server safeguards. The state OASIS coordinators we spoke with said their server rooms are locked and access restricted. HCFA officials told us that for now, OASIS data will not be maintained online for more than 3 years. HCFA officials stated that they would also not maintain identifiable OASIS data any longer than 15 years.
section_title: Appendix IV: Comments From HCFA